Skip to main content

Privacy & Security

ChatWalaʻau is localhost-first. By default it binds to 127.0.0.1 and stores your data on your own machine.

Where your data lives​

  • Conversations are stored as JSON files on your host.
  • Uploads, generated images, and RAG vectors (ChromaDB) are stored locally.
  • API keys and secrets live in your .env file -- never committed, and never shipped to a third party by the runtime.

Network access​

The runtime only talks to the model providers and tools you configure. No telemetry is sent by default.

Access control​

  • Binding to a non-loopback address fails closed unless you configure authentication (APP_REQUIRE_AUTH_ON_LAN=true by default).
  • A Bearer API_KEY protects the API and write endpoints.
  • An optional web sign-in (AUTH_USERNAME) gates the web app behind an HttpOnly session cookie.

See Authentication for the full model.

Sharing your screen​

Privacy Screen scrambles your chat history, your own messages, and your attachments so you can demonstrate a real instance on a shared screen. It replaces the text rather than blurring it, so the original is not left on the page for a stray selection or an in-page search to reveal.

It covers your side of the conversation, not the whole app: the agent's replies stay readable by design, and saved memory, prompt templates, tool arguments, workspace files, and your account name are not hidden. See what it does not cover.

This website​

This marketing and documentation site is statically generated. The only dynamic endpoint is the contact form, which stores your submission so we can reply. The form uses spam protection, and your submitted details are never shared with a third party or used for marketing -- we use them only to respond to your inquiry.

Analytics​

This site may use Google Analytics 4 to understand aggregate traffic (which pages are visited, where visitors arrive from). When enabled, IP addresses are anonymized, and we collect only aggregate visitor statistics -- not the contents of your contact-form submission. Analytics is opt-in for the operator and is only active when an analytics ID is configured for the deployment. You can opt out with your browser's controls or the Google Analytics opt-out add-on. We do not use any other third-party marketing or advertising scripts.