Privacy Policy

Last updated September 28, 2026

The short version: your screen never leaves your Mac, ever. The local coach is free forever, and nothing about a local session goes to the internet at all. If you subscribe to Tolby+ or Tolby+ Extra, the online coach's traffic (the quick, frequent check for whether it's worth speaking up, the coaching conversation itself, and sometimes a nightly review) travels as text, never as images, through Tolby's proxy server, which doesn't keep what was said.

What Tolby sees on your Mac

Tolby continuously records your screen as video and reads window titles and on-screen text (via OCR) to understand what you're doing. The video, and the text read off your screen, are written to your Mac and stay there — they are never uploaded, on the free local coach or on a paid subscription. (On a paid plan, the name of the app in front and its window title do go out as text; see below.) By default, setup keeps one week of screen recordings and deletes older ones; you can choose to keep everything instead, and change it later in Settings. You can also delete them yourself at any time, from Tolby's Settings › Delete Data panel.

A model running locally on your Mac then judges that activity against the intention you declared. That judgment is always made locally. What happens to the judgment's text next depends on your plan — see below.

The local coach: free forever, fully local

By default, the coach also runs on your Mac, using a local model, for as long as you use Tolby — there's no trial period and no expiration. Nothing about a local session — not your screen, not your declared intention, not your conversation with the coach — is sent anywhere. There's no Tolby server involved at all. (The one exception: the first time you run Tolby, it downloads that local model from the model registry it uses (about 6 to 7GB, depending on your Mac's memory) — an ordinary download that sees your Mac's IP address the way any download does, but carries none of your data.)

If you subscribe: what a paid plan sends

Subscribing doesn't turn off the local coach; it adds a larger online coach on top of it. Once you subscribe, coaching-related calls go through Tolby's own proxy server, so you're never asked to hold or manage an API key yourself. That includes:

• A quick check, as often as about once a minute while Tolby is active. This is the part that decides whether anything is worth saying at all — most of the time the answer is no, and it says nothing. This still happens, and still sends data, even on a quiet day where the coach never once speaks to you.
• The coaching conversation itself, when it does speak or when you reply.
• A nightly review, only if your Mac can't run it locally, that looks back over the day's activity and conversation to update the coach's standing notes about you.

Each of these sends, as text, some or all of:

• the intention you declared
• the on-device classifier's written judgment of your activity — this is prose generated on your Mac, and it can name specific apps, documents, or people it saw on screen
• the name of the app in front and its window title (withheld if it contains an ID-like number; on a banking or medical site, replaced by the kind of site)
• the coaching conversation
• the coach's standing notes about you

None of these ever contains a screenshot or a screen recording — only the text described above.

Before any of it leaves your Mac, Tolby filters out things that look like identity, card, and bank account numbers, and anything shaped like a password or access key. The filter works by pattern and checksum, so it catches the common forms, not every possible one. When you're on a banking or medical site, window titles are replaced with just the kind of site, and a second check, run by the model on your Mac, holds back the written note about your screen if it carries private details from that page.

If your Mac is offline, or the service is briefly unreachable, a paid subscription falls back to coaching locally, automatically. It also coaches locally when your license has lapsed (with one message offering to renew) and, for some replies, when you're using your online allowance faster than it would last, so it lasts the month. The app says whenever a reply came from your Mac. An outdated app does not fall back silently — it shows up as a message, since you need to update.

If you use your own OpenRouter key

Settings lets you add your own OpenRouter API key instead of subscribing. If you do, the same text described above goes straight from your Mac to OpenRouter under your own account and its settings, not through Tolby's server, and Everett Wilber never sees it.

Automated misuse checks (not built yet)

Tolby may later add automated checks on coaching requests to catch misuse of the online service (the acceptable-use rules in the Terms of Service). If that's added, those checks would never store the requests they look at, and you'd be asked to accept an updated version of the terms in the app before any such check starts — the same in-app acceptance flow described there.

What the proxy stores

The proxy does not store or log the contents of your requests or the coach's replies. Its operational logs are limited to a route name; an HTTP status and error code, or the reason a request was answered on your Mac instead; the kind of request, and whether it answered something you typed or ran in the background; the model used; timing; a cost figure; your app version; your plan and the share of requests currently going online; an operational alert code; and a short prefix of a one-way hash of your license key. Never the text of what was said.

The only thing kept per license, indexed by a one-way hash of the license key (never the key itself), is:

• usage counters in US dollars — today, this billing cycle, this pacing month, and lifetime — plus the dates your cycles are counted from, that month's budget, which plan the cycle is paced as, one pacing number, and when the service first saw the license; used only to pace your plan's allowance, never to charge you per call
• the result of the last license check for each Mac you've activated it on — valid or not and why, the license status, expiry date, plan, the license's creation date, a short technical note on the check, and when it was checked
• the terms of service version you last accepted, and when
• short-lived records of requests currently in progress
• a rate-limit counter

When you activate Tolby on a Mac, that Mac's name — generated automatically, something like "Wren on Alex's MacBook Pro" (the in-app coach is still named Wren even though the product is Tolby) — is sent to Lemon Squeezy as the activation's name, so you can tell your activated Macs apart when freeing up a slot. The proxy passes this through and does not store it itself. Your name and email address, which the license service can return, are discarded on receipt.

Who else the traffic touches

Getting a coaching reply to you involves a small number of other services, each seeing only what it needs to do its job:

• Cloudflare runs the proxy itself. It processes each request in memory and keeps its own operational logs (IP address, time, path, status) — not the contents of your requests.
• OpenRouter, and whichever inference provider it routes a given request to (currently one of DeepInfra, CoreWeave, or Fireworks), receive the full text of that request in order to generate a reply, and handle it under their own policies.
• Lemon Squeezy, Tolby's payment processor and merchant of record, receives your license key whenever it's checked, and the Mac's name described above when you activate a license — see Payments below.

Payments

Subscriptions are sold and billed by Lemon Squeezy, who acts as the merchant of record. Lemon Squeezy collects and processes your payment details directly; Tolby never receives or stores your card number.

This website

This site loads no third-party analytics, trackers, advertising scripts, or fonts, and stores nothing in your browser. "Send yourself the link" never sends anything — it opens an email addressed to you, and nothing leaves your device unless you press Send there. "Notify me" sends your email address and what you checked it for (a platform, or that you're waiting on the general release) to Tolby's own server (the same proxy described above, run on Cloudflare) — never a third-party mailing list. The signup it keeps holds exactly three things: that email address, what it's for, and when you signed up. It has no set expiry and is used only to tell you when Tolby is ready for you. (Cloudflare's own request logs, described above, apply to this request like any other.) If sending fails, it falls back to opening an email instead.

Changes to this policy

If how Tolby handles data changes, this page will change with it, and the date at the top will be updated.

Questions

Email hello@tolby.app for a direct answer.