What stays on your Mac, and what leaves it.

Your microphone audio, your repositories and your agent sessions stay on your machine. Four things leave it: your sign-in, which goes through Firebase Authentication; the commands you give the planner, together with a snapshot of your board, which our planner service sends to a hosted model to turn into a plan; the short lines the app speaks back to you, which our gateway sends as text to Inworld to generate the audio; and your payment, which Paddle processes as our merchant of record. Our gateway verifies your account and counts usage against its subscription. Device and request identifiers also support session security and duplicate-request prevention. While it is open, the app also asks our website every few minutes whether your subscription is active, and checks it for updates about once an hour; like any web request, these carry your IP address and the app's version. We do not run analytics or telemetry inside the app.

To do its job, the app handles the following locally:

• Your voice. The current Mac release transcribes microphone audio locally using Parakeet, an on-device speech model downloaded on first use from Hugging Face. We do not receive your microphone audio, and the current release does not send it to an Apple Speech or Whisper fallback. The transcribed commands you send to the hosted planner are treated as described below.
• Spoken replies. The audio the app plays back is generated by our voice service, described in section 3, and cached on your Mac so a line that was generated once replays without a new request. The cache lives in the app's Application Support folder, is limited to 100 MiB per account, drops entries unused for 30 days, and can be cleared from Settings.
• Source code. The agent CLIs you connect run as real terminals on your machine. The app reads the repos you open to build the studios, project memory and previews.
• Session state. Workspaces, console layouts, memory, loops and preferences are stored on your local disk as files you can inspect and delete. A board you clear or close is moved to an archive folder beside the others, not erased.
• Agent profiles. A profile is a folder in the app's Application Support directory that holds one sign-in of a CLI. When you save your current sign-in as a profile, the app copies that CLI's own sign-in and settings files into it; this exists for Claude Code and Codex. The copies stay on your Mac, readable only by your macOS user, and are never sent to us.
• Agent settings. If you turn on live agent status, the app writes a small script under ~/.hypervibe and adds hook entries to the settings files of Claude Code and Codex, keeping a backup of each file. Turning the option off removes the entries and the script. What the hooks report stays on your Mac, apart from the short activity line described in section 3.
• Usage figures. The usage pill is read from each CLI, and token history from the session logs the CLIs keep on your disk. Neither is uploaded.

• Account. When you sign in with Google or email and password, Firebase Authentication (a Google service) manages your identity, verification, recovery and secure session. The web and Mac use the same Firebase account UID but maintain separate sessions. We receive your UID, email, verification state and available profile details. Billing ownership uses the verified UID, not a matching email. An avatar selected on your Mac stays local; this account does not synchronize boards or files. When you accept the Terms we keep a record of it: your UID, the date, the version and the fingerprints of the documents you accepted.
• Sessions and usage. The gateway uses your verified Firebase UID, service session and request identifiers to authorize access, enforce the shared credit allowance and avoid billing a repeated request twice. Older service routes may also use a salted device identifier. These identifiers are not your files or microphone audio.
• Subscription and update checks. While it is open, the app asks our website every few minutes whether your account has an active subscription, sending your sign-in token, and tells our gateway its version when it opens a session. It also fetches the update feed from our website about once an hour and downloads new versions from it. These are ordinary web requests: our hosting provider sees your IP address and the app's version.
• Planner commands. When you give the planner a spoken or typed command, the app sends our planner service the text of the command and its language, a request identifier, plus a snapshot of your board: the names, types and roles of your consoles, the order each one is working on, and its activity, which can name the tool an agent is running or waiting to run, quote up to 80 characters of a question it is asking you, or give the reason it stopped on an error; groups and their members; the names of agents you added yourself, and of orchestrator cards with what they are wired to; the text of recent orders, up to 600 characters each, and who answered; the repo folder name, workspace names and how many consoles each has, selection, zoom, active tool, open panel, figure counts and the names and states of loops; up to 60 relative paths of Markdown files; and the latest messages of the orchestrator thread, eight plus the last plan note, with your turns and notes trimmed to 220 characters and agent reports to a 140-character excerpt. Our service forwards this to Groq, which runs OpenAI's gpt-oss-120b model, and returns a plan. The app then carries out that plan as the Terms describe: the instructions it holds for your agents are typed into their consoles and submitted. Microphone audio is never sent, and file contents are not attached. But the command, the orders, the recent messages and the agent excerpts inside them can contain code or other information you or an agent wrote, so treat the planner like any hosted model.
• Spoken replies. When the app confirms a command or narrates a mission out loud, it sends our gateway the text of that line (at most 500 characters), its language, the chosen voice, a request identifier, a mark for stock phrases and, when the planner set credit aside for the reply, that reservation. Our gateway forwards the text, voice and language to Inworld, which generates the audio with its TTS-2 Flash model and streams it back through our gateway to the app. Generated audio, including audio containing your words or console names, can be cached for five minutes on our server, scoped to your account and a hash of the request. It is not shared with other accounts. Older voice routes may share only predefined generic audio with no user content. Inworld receives text only: it never receives your microphone audio or your transcripts.
• Billing. If you subscribe, Paddle processes your payment details, name, email and billing address as merchant of record. Our server stores your Firebase UID association with Paddle customer, transaction, subscription and adjustment identifiers, paid periods and signed billing notifications in Upstash. These records support access verification, accounting and recovery from missed notifications. Card details stay in Paddle checkout; we never receive full card numbers. The notifications Paddle sends us, which we keep, can include your name and email address and, for a card payment, the card type, its last four digits, its expiry date and the cardholder's name, or the account email for a PayPal payment. Billing portal links are temporary and are not stored by our application.
• Contact. If you email us, we receive the address and message you provide.
• Website. symvibe.com is hosted on Vercel and uses two Vercel tools: Web Analytics, which counts visits, and Speed Insights, which measures how fast pages load. Neither uses cookies or stores anything in your browser, and the measurements are aggregated. They may include the page path, referrer, browser, device, approximate country and loading times. On the home page they also include how far a visitor gets through the short questions shown before pricing: whether they were opened, finished, skipped or closed, and at which step. The answers to those questions are not sent: they stay in your browser's session storage, so the pricing section and the plan page can show them back, until you close the tab. We remove query strings and fragments from the page addresses sent to both tools, and neither is loaded on account, checkout or email-action pages. Hosting and security services also process request metadata such as IP addresses.
• Components from other companies on the website. The pages that show the price, which are the home page and the plan page, load two outside components for every visitor, before any click. One is Paddle's checkout script, which shows the price for your country and opens checkout: it contacts Paddle and its ProfitWell service, and Paddle's servers set a security cookie from Cloudflare (__cf_bm, on paddle.com, lasting about 30 minutes). The other is the Firebase sign-in component from Google, which tells the page whether you are signed in: it contacts Google and creates two small databases in your browser's storage, where your session is kept once you sign in. The home page also shows a Product Hunt badge, an image loaded from Product Hunt. As with any embedded component, these companies receive your IP address and act under their own policies. We use no advertising tools and do not track you across other sites, so there is nothing for a Do Not Track signal to switch off.

• Firebase Authentication (Google LLC) for sign-in.
• Paddle (the Paddle entity identified in your checkout and receipt) as merchant of record for checkout, invoicing, taxes and the customer portal.
• Vercel for hosting the website, its cookieless analytics and speed measurements, and the gateway behind the planner and the spoken replies.
• Upstash (hosted Redis) for server-only billing ownership, paid periods and notification history, in addition to the gateway's usage counters, short-lived planner response cache and account-scoped generated audio cache.
• Groq (Groq, Inc.) running OpenAI's gpt-oss-120b model behind our planner service, which receives your planner commands and board snapshot as described above. The current release uses the included service rather than personal Groq or Cerebras keys.
• Inworld (Inworld AI) generating the audio of the spoken replies from the text our gateway sends, with its TTS-2 Flash model.
• Hugging Face as the download source of the on-device speech models.
• Product Hunt for the badge image on the home page.

These providers process data to supply their services; Paddle also processes billing information as merchant of record. See Firebase, Paddle, Vercel, Upstash, Groq, Inworld and Hugging Face for their privacy information. Provider retention may differ from the short caches we operate.

Data is processed in the United States and in other countries where these providers operate. For personal data that comes from the European Economic Area, the United Kingdom or Switzerland: Google, Vercel and Upstash are certified under the EU-U.S. Data Privacy Framework, its UK extension and the Swiss framework; our agreements with Groq and Inworld include the European Commission's standard contractual clauses and the UK addendum; and Paddle is an independent controller of the billing data it handles, under its own terms. Write to us for a copy of the clauses that apply to your data.

Symvibe orchestrates agents you connect, such as Claude Code or Codex. Those agents are independent software and send your prompts or code to their own providers under their own policies and under your own account with them. Symvibe surfaces which agents are active, but it does not control their network behavior. Review the privacy terms of each agent you use.

Account, device, planner, voice, billing and contact data is used solely to sign you in, produce your plans, generate the spoken replies, count usage against the limits of your subscription, deliver the product, fulfill purchases and answer you. Symvibe does not use this data to train models; processing by model providers is subject to their service terms. We do not sell data, and we do not share it for advertising.

Where data-protection law requires a legal basis, account access, subscription delivery, planner and voice requests rely on performance of our contract with you. Fraud prevention, service security, debugging and limited website measurement rely on our legitimate interests in running a reliable service, balanced against your rights. Records required for tax, accounting or responding to lawful requests rely on legal obligations. We use your correspondence to answer your request. Where processing requires consent, you may withdraw it without affecting prior lawful processing. Providing account and payment information is necessary for a subscription; optional profile details are not.

Local data lives in your Mac's standard application support directory and is protected by your device's security. Firebase manages account sessions; Google states that it keeps sign-in records such as IP addresses for a few weeks, and the account itself until it is deleted. Billing records and original signed notifications are retained server-side for account operation, recovery and applicable accounting requirements; they are not automatically deleted when you sign out or uninstall. The record of your acceptance of the Terms is kept for as long as it may be needed as evidence. Access and deletion requests are reviewed separately from subscription cancellation. Secret keys and payment portal URLs are not included in our application logs.

On our gateway:

• Planner. The command and the board snapshot are not stored. The model's response is cached for five minutes, scoped to your account and to a fingerprint (a hash) of the request, so a repeated command costs nothing; it is not shared with other accounts. For each request we also keep a usage record with no automatic expiry: your account identifier, the request identifier, the time, the cost, the billing period and that fingerprint. A fingerprint cannot be turned back into your text, although it could confirm a guess of a short, common phrase.
• Spoken replies. The text of a line is not stored. Generated audio may be cached on our servers for five minutes, scoped to your account and a fingerprint of the request. It is not shared with other accounts. The app also caches audio locally. Usage records contain character counts, cost, timestamps, an account identifier and the request fingerprint, without the spoken text. They are retained for service operation; a second set of voice records, kept under a hashed account identifier, expires after 90 days.
• Usage counters. Credit balances, character counts and spend totals are kept per account and subscription period. They currently have no automatic expiry. We review them on account-deletion requests and retain only what is necessary for account operation, fraud prevention, disputes or applicable recordkeeping obligations; cancellation alone does not delete them. Short-lived rate-limit counters expire within days.
• Logs. Our gateway writes a log line only when a request fails or needs attention: the kind of request, an error code, how long it took and counts such as the number of consoles. It never logs the command, the board or the spoken text. Our hosting provider keeps its own request logs, which include IP addresses, for a short period under its log retention.

What Groq and Inworld keep of the text they receive is governed by their own terms. As of this version, Groq states that it does not retain the content of requests by default, that it may log it for up to 30 days to investigate abuse or reliability problems, and that it does not train on it without our instruction. Inworld's terms say it does not train its generally available models on customer content, apart from feedback and content flagged for safety, and it does not publish how long its logs keep the text and audio.

Write to hello@symvibe.com to request access, correction or deletion. Depending on your location, you may also have rights to portability, restriction, objection, withdrawal of consent and a complaint to your local data-protection authority. We may ask for reasonable proof that the account is yours; never send us your password or full card details. We respond within the time required by applicable law and explain any records we must retain. Subscription cancellation and data deletion are separate requests. We do not sell personal data, so where the law gives you a right to opt out of its sale there is nothing to opt out of; you can still write to the same address.

Removing the app from Applications does not remove its Application Support files, preferences or Keychain entries. It also leaves the speech model, stored under Application Support in a folder named FluidAudio; your agent profiles, with the sign-in files copied into them; and, if you turned on live agent status, the script under ~/.hypervibe and the hook entries and backups in the settings of Claude Code and Codex. Turn that option off before removing the app and the entries are taken out. Your repositories remain wherever you saved them under your macOS user. Local workspaces belong to that macOS profile and are not a cloud repository account: another person using the same unlocked macOS profile can access its local files. Use separate macOS users for separate people. You can clear spoken-reply caches in Settings and contact us for help removing Symvibe local data without deleting your projects.

Symvibe is a developer tool and is not directed at anyone under 16. We do not knowingly collect personal data from children; if you believe a child has given us data, write to us and we will delete it. Subscribing requires being an adult, as the Terms say.

We may update this policy as the product evolves. Changes are identified by the effective date above. We provide any additional notice or obtain consent required by applicable law before a material change takes effect.

Questions about privacy: hello@symvibe.com.