Tolby Download

Privacy Policy

Last updated November 3, 2026

The short version: your screen never leaves your Mac, ever. The local coach is free forever. Nothing from a local session leaves your Mac: not your screen, your intention or your chat. Tolby only checks once a day for a new version and for notices from me. If you subscribe to Tolby+ or Tolby+ Extra, the online coach's traffic (the quick, frequent check for whether it's worth speaking up, the coaching conversation itself, and sometimes a nightly review) travels as text, never as images, through Tolby's proxy server, which doesn't keep what was said.

What Tolby sees on your Mac

Tolby continuously records your screen as video and reads window titles, the address of the browser tab in front, and on-screen text (via OCR) to understand what you're doing. The video, that address, and the text read off your screen are written to your Mac and stay there. They are never uploaded, on the free local coach or on a paid subscription. (On a paid plan, the name of the app in front and its window title do go out as text; see below.) By default, setup keeps one week of screen recordings and deletes older ones; you can choose to keep everything instead, and change it later in Settings. You can also delete them yourself at any time, from Tolby's Settings › Delete Data panel. When the coach offers to put a site's tabs away and you reply, Tolby reads the title and address of every tab open in that browser, on your Mac, so it can show you which ones would move before anything does.

A model running locally on your Mac then judges that activity against the intention you declared. That judgment is always made locally. What happens to the judgment's text next depends on your plan; see below.

The local coach: free forever, fully local

By default, the coach also runs on your Mac, using a local model, for as long as you use Tolby. There's no trial period and no expiration. Nothing from a local session is sent anywhere: not your screen, not your declared intention, not your conversation with the coach. Tolby does check once a day for a new version and for notices from me, and Tolby itself downloads from Tolby's own server. Those are ordinary web requests that show your Mac's IP address and which version of Tolby you have, the way any web request does, and nothing about what you do. If you connect Todoist, Tolby also fetches your tasks from Todoist directly. Updates install only when you say so, unless you turn on automatic updates in Settings. (The first time you run Tolby, it also downloads the local model from Hugging Face (about 6 to 7GB). That's an ordinary download that sees your Mac's IP address the way any download does, but carries none of your data.)

If you subscribe: what a paid plan sends

Subscribing doesn't turn off the local coach; it adds the coach running on a server instead, which is easier on your battery and fans. Once you subscribe, coaching-related calls go through Tolby's own proxy server, so you're never asked to hold or manage an API key yourself. That includes:

Each of these sends, as text, some or all of:

None of these ever contains a screenshot or a screen recording, only the text described above.

Before any of it leaves your Mac, Tolby filters out things that look like identity, card, and bank account numbers, and anything shaped like a password or access key. The filter works by pattern and checksum, so it catches the common forms, not every possible one. When you're on a banking or medical site, window titles are replaced with just the kind of site, and a second check, run by the model on your Mac, holds back the written note about your screen if it carries private details from that page.

If your Mac is offline, or the service is briefly unreachable, a paid subscription falls back to coaching locally, automatically. It also coaches locally when your license has lapsed (with one message offering to renew) and, for some replies, when you're using your online allowance faster than it would last, so it lasts the month. The app says whenever a reply came from your Mac. An outdated app does not fall back silently. It shows up as a message, since you need to update.

Calendar and Todoist (only if you turn them on)

Both are off until you turn them on in Settings › General. Tolby reads the Calendar app on your Mac. For Todoist, it contacts Todoist directly from your Mac with the token you paste in, on any plan, and not at all while "Keep the coach on this Mac" is on.

With the online coach, the event on now and the next one go online as text: each title, time and length, whether it's a call or in person, and whether it's with other people. So do Todoist task names, priorities and due times. A title can name a person or an appointment. Attendee names, addresses, notes, and Todoist descriptions, comments, labels and projects are never sent. With the coach on your Mac, none of this goes online.

Which AI providers can see your request

On Tolby+ or Tolby+ Extra, OpenRouter, Tolby's model router, forwards each request to one of a short list of inference providers. Today that list is:

Every provider on the list is set to zero data retention on Tolby's OpenRouter account: they generate the reply, keep nothing of the request afterward, and don't train on it. If the list changes, this page changes with it.

Choosing Anthropic, OpenAI or Google (not built yet)

Tolby may later let a subscriber send the online coach's traffic (the quick check, the coaching conversation and, if it runs online, the nightly review) to Anthropic, OpenAI or Google instead of the providers above. It would be off unless you turn it on. Unlike the providers above, these companies keep a copy of what they receive, under their own policies.

They would receive the same text described above, never images. That includes the written notes about your screen and the coach's standing notes about you, such as health details you've mentioned. The filter described above catches common forms of identity and account numbers, not every one, so anything it misses would be kept too. Turning the option off would stop new requests going to them, but what they already kept stays under their policies. If your chosen provider can't answer, the reply never comes from another company that keeps a copy.

Automated misuse checks (not built yet)

Tolby may later add automated checks on coaching requests to catch misuse of the online service (the acceptable-use rules in the Terms of Service). If that's added, those checks would never store the requests they look at, and you'd be asked to accept an updated version of the terms in the app before any such check starts, using the same in-app acceptance flow described there.

What the proxy keeps

The proxy never stores or logs what you and the coach say. It keeps five kinds of records, each for one job:

All of this is kept until you ask me to delete it, except the version records, which are deleted after 30 days, and logs, which Cloudflare deletes after a few days. To ask, email hello@tolby.app. The exact fields are listed under Technical detail below.

When you activate Tolby on a Mac, that Mac's name (generated automatically, something like "Tolby on Alex's MacBook Pro") is sent to Lemon Squeezy as the activation's name, so you can tell your activated Macs apart when freeing up a slot. The proxy passes this through and does not store it itself. Your name and email address, which the license service can return, are discarded on receipt.

Who else the traffic touches

Getting a coaching reply to you involves a small number of other services, each seeing only what it needs to do its job:

Payments

Subscriptions are sold and billed by Lemon Squeezy, who acts as the merchant of record. Lemon Squeezy collects and processes your payment details directly; Tolby never receives or stores your card number.

This website

Apart from one analytics script, this site loads no third-party scripts or fonts. It sets no cookies and stores nothing in your browser. Every page except the one a gift link opens loads Cloudflare Web Analytics, from Cloudflare, which already hosts this site. Each time a page opens, it reports the page, the site that sent you here, your country, your browser, system and device type, and how quickly the page loaded and responded. Like any web request, it shows Cloudflare your IP address, which is how it tells your country. It's built not to follow you to other sites or link one visit to the next. None of it comes from the Tolby app. "Send yourself the link" never sends anything. It opens an email addressed to you, and nothing leaves your device unless you press Send there. This site's "Notify me" sends your email address and the platform you ticked (an 8GB Mac or Windows) to Tolby's own server (the same proxy described above, run on Cloudflare), never a third-party mailing list. The signup it keeps holds exactly three things: that email address, the platform, and when you signed up. It has no set expiry and is used only to tell you when Tolby is ready for that platform. (Cloudflare's own request logs, described above, apply to this request like any other.) If sending fails, it falls back to opening an email instead. Opening a gift link sends the code in that link to Tolby's own server as soon as the page loads, only to check whether it has already been used. That code travels in the request's own address (its query string), which is part of what Cloudflare's operational logging above already keeps -- unlike an emailed address sent in a request's body, which those logs don't see.

The app has its own "Notify me", shown when Tolby can't run on your Mac yet. It sends your email address to the same server, which keeps it the same way, with the platform set to an 8GB Mac.

Technical detail

The exact fields behind each kind of record above. This list is updated as the proxy changes.

Logs

Its operational logs are limited to a route name; an HTTP status and error code, or the reason a request was answered on your Mac instead; the kind of request, and whether it answered something you typed or ran in the background; the model used, and per-call stats such as which provider answered, token counts and timing; a cost figure; your app version; your plan and the share of requests currently going online; an operational alert code; a short prefix of a one-way hash of your license key; and a code that stands for you, which is explained under OpenRouter below. Never the text of what was said.

Per license

For each license, filed under a one-way hash of the license key (never the key itself):

Other records

Changes to this policy

If the Tolby app or its proxy server starts keeping a new kind of data, sends it somewhere new, uses it for something new, or keeps it longer, I'll ask you to agree to the updated policy in Tolby before the change applies to you. If it's an option that's off until you turn it on, the app tells you what it sends before you can turn it on, and asks again if that changes. Changes to this website are listed below with smaller corrections. The app doesn't ask you about those.

Questions

Email hello@tolby.app for a direct answer.