Your data,
on your terms

Scope

This policy covers AriCore (the iOS companion app) and aricode (the desktop agent). They are built by the same author and share the same data-handling philosophy: keep it local, keep it encrypted, don't collect what we don't need.

What we collect

Nothing. Neither AriCore nor aricode has a backend that collects personal information from you. There is no account system, no analytics pipeline, and no crash-reporting SDK phoning home. We don't know how many people are using the app, what they're doing with it, or what models they're running.

What stays on your device

AriCore stores the following locally, inside the iOS app sandbox:

• Conversations — both on-device chats and the decrypted cache of any linked-mode session.
• Provider API keys — stored in the iOS Keychain; never transmitted except to the provider you selected.
• Preferences — default model, system prompt, selected mode; stored in UserDefaults.
• Imported GGUF model files — stored in Application Support under Models/.

When you delete the app, iOS removes all of this. There is nothing to delete on our side because there is nothing stored on our side.

On-device inference

When you run a local model (a .gguf file you imported), prompts and responses are processed by llama.cpp embedded in the app binary, on your device's CPU and Neural Engine. The model weights and your prompts do not leave your phone. Airplane mode confirms this — local inference continues to work.

Pairing with a desktop (Linked mode)

When you pair AriCore with an aricode desktop instance over the QR code handshake, the two devices derive a shared secret using X25519 elliptic-curve Diffie–Hellman. After that, every message, file, and command between your phone and your desktop is sealed with ChaCha20-Poly1305 authenticated encryption.

Traffic flows through a relay server we operate so your phone and desktop can reach each other without being on the same network. The relay exists only to forward encrypted bytes.

Relay metadata is held only long enough to route a message between your devices. There is no persistent traffic log.

You can verify the pairing is direct and uninterrupted by comparing the six-digit fingerprint shown on both devices during pairing. A mismatch means something intercepted the handshake — cancel and try again on a trusted network.

Third-party LLM providers (optional)

AriCore lets you bring your own API keys for remote providers — OpenAI, Anthropic, DeepSeek, Groq, Ollama Cloud, or any OpenAI-compatible endpoint. When you add a key:

• The key is stored in the iOS Keychain on your device.
• Prompts and completions travel directly from your device to that provider. They do not pass through our relay.
• Each provider has its own privacy policy. Your usage of them through AriCore is governed by their terms, not ours.

Permissions AriCore asks for

• Camera — only when you're pairing, to scan the desktop's QR code. No photos or video are captured, stored, or transmitted.
• Local network — to reach paired desktops over LAN or Tailscale. No network discovery traffic is sent beyond your own devices.
• Files — when you import a GGUF model via the system file picker. AriCore copies the chosen file into its sandbox and does not access anything else you didn't pick.

Children

AriCore is not directed at children under 13 and does not knowingly collect information from them. It is a developer tool.

Changes

If the data picture ever changes — for example if we ever add anything resembling telemetry — this page will be updated and the effective date at the top will change. Material changes will also be surfaced inside the app the next time you open it.

Your rights

Since we don't collect personal data, there's nothing on our side to access, export, or delete. To remove everything AriCore has stored on your device, uninstall the app — iOS handles the rest.