PRIVACY
WorkPilot runs on your Mac.
There is nowhere for us to look.
Effective 2026-08-23 · Updated 2026-09-25 · Applies to the WorkPilot macOS app and this website
The short version
- No account. You never register with WorkPilot. There is no WorkPilot login, and no WorkPilot server stores your work. (The iPhone relay passes messages through without storing them — see section 02.)
- Your work stays in a normal folder. Threads, knowledge, images and video are written to your Mac as ordinary files. Delete the app and they remain.
- No analytics, no ads, no telemetry. The app ships with no analytics, advertising or crash-reporting SDK. We do not count your clicks.
- What leaves your Mac, you chose. Your prompts go to the AI vendor you selected for that thread — not through us. Anything that publishes externally stops for your approval first.
01What is stored on your Mac
WorkPilot keeps your working data as plain files under your Documents folder, plus a small application-data area for app state.
- Threads, knowledge, skills, generated media — Markdown, images and video under
~/Documents/WorkPilot.
- App state — settings, thread index and usage counters, in the app's own data area.
- Credentials — API keys and tokens are encrypted with the operating system's secure storage (Keychain on macOS) and written to a permission-restricted file. They are never placed in browser storage inside the app.
Because these are ordinary files, your own backup tools (Time Machine, iCloud Drive, Dropbox, a NAS) may copy them. That is under your control, not ours.
02What leaves your Mac, and who receives it
WorkPilot connects directly to the services you enable. The one exception is the iPhone relay described below: when you use your iPhone as a remote, those messages pass through a relay server operated by boice Inc.
| Recipient |
What is sent |
When |
| Anthropic · OpenAI · Google · Moonshot |
Your prompts, and the files or images you attach to that thread. |
Only for the engine you selected, when you send a message. Each vendor's own privacy policy applies. |
| Media & voice providers |
The prompt and reference material needed to generate an image, video or voice. |
Only when you use a media or voice feature that you have connected. |
| GitHub |
A normal web request. GitHub sees your IP address, as with any download. |
When you download a release, or open the changelog. |
| boice Inc. relay server (remote.workpilot.space) |
On startup: an ID generated for your Mac, its computer name and the app version. While you use your iPhone as a remote: the requests and replies between iPhone and Mac. |
The Mac connects on startup unless the relay is switched off. Encrypted in transit; message content is not stored. Not yet end-to-end encrypted. |
| TypeSafe (quick decision · optional) |
Only the message you are about to send (up to 2,000 characters). |
Only if you add a TypeSafe API key. Off otherwise. |
| boice Inc. update server |
An update check. The server sees your IP address and the version you are running. No content from your threads is sent. |
On startup and when you check for updates. |
We want to be exact here: boice Inc. operates two servers — the update server and the iPhone relay. Update checks show us an IP address and a version number, nothing else. The relay passes your iPhone ↔ Mac messages through without storing them; until end-to-end encryption is added, those messages are readable to the relay while in transit. If you don't use the iPhone remote, you can switch the relay off, and then nothing reaches it at all.
03What we do not do
- We do not embed analytics, advertising, attribution or crash-reporting SDKs in the app.
- We do not sell, rent or share your data. There is no data business behind the free price.
- We do not train models on your content.
- We do not require an account, an email address or a payment method to use WorkPilot.
04Team sharing
A Shared Space is a folder you already own — a NAS, Dropbox, Google Drive, anything. Members join with a code. Files are written to that folder and never pass through us. Each member signs in with their own AI subscription, so no credentials are shared.
Before files are shared, WorkPilot scans for things that should not leave — environment files, private keys, repository internals — and stops to ask.
05This website
- This site (workpilot.space, docs.workpilot.space and blog.workpilot.space) uses Google Analytics 4 to count visits, and it sets a cookie for that purpose. No advertising scripts run here; nothing is used for ad targeting and nothing is sold on.
- What that measures is limited to which pages were viewed, where the visit came from, approximate region and browser type. It never includes your name or email address. The app itself still ships with no analytics SDK — see section 03.
- Your language choice and the latest-version lookup are stored in your browser only, on your device.
- The download button asks GitHub which release is newest, so GitHub receives that request. Fonts are loaded from Google Fonts, which receives your IP address as a result.
- Workshop booking runs on Spir, an external scheduling service embedded in the workshop page. The name, email address and time slot you enter there are registered with Spir, and the confirmation email is sent by Spir. Simply loading that calendar sends connection data such as your IP address to Spir. Unless you actually book, we never receive your name or email address.
- If you donate, the payment is handled entirely by that platform. We never see your card details.
06Your control
Because everything is a file on your own machine, you exercise your rights directly: open the folder to see your data, move it, back it up, or delete it. Deleting the folder deletes the data — we hold no copy to erase on your behalf. Disconnecting an engine stops any further transmission to that vendor.
Content you have already sent to an AI vendor is held under that vendor's policy. Requests to delete it must go to them.
07Changes and contact
If this policy changes in a way that affects what leaves your Mac, we will say so in the release notes rather than quietly editing this page.
Questions can be raised at GitHub Issues.
You can also write to .
← Back to WorkPilot
