Privacy
Your data is yours. Nearly everything stays on your computer. The only thing that leaves is a tiny heartbeat ping every 60 seconds that carries no prompt content. Emu is a guest on your machine, not a gatekeeper.
What stays, what leaves
What stays, what leaves
The asymmetry is the point. Your prompts, the AI replies, the guardian log, the guardian brain (gists and embeddings), the Ask Emu sessions, the memories, and the weekly recaps all stay on your computer. The only thing that leaves is the 60-second heartbeat that says "this device is healthy." It carries no prompt content. No one at Trinitite sees your prompts.
The per-device key
Emu mints a unique key on each device when you install. The key is generated
on your computer and never leaves it. A local guardian on 127.0.0.1 reads
only AI-app traffic. Your bank, your email, and everything else are never
touched.
The key is constrained so it can only sign certificates for AI hosts on the allowlist. Emu literally cannot mint a certificate for your bank, even if it wanted to. The allowlist is the boundary, and the key cannot cross it.
The key is gated behind Touch ID on macOS or Windows Hello on Windows at app launch, if you opt in. One biometric prompt per launch, and Emu is unlocked for the session. You can change this later in Settings.
Fail-open by default, fail-safe in exactly two spots
Emu is a guest on your computer, not a gatekeeper. If Emu breaks your AI app, you uninstall Emu, and then you have no protection. So the number-one design rule is: a guardian failure must never be worse than no guardian at all.
Everything fails open. If the on-device model is slow, the request goes through. If the brain is busy, the request goes through. If the proxy hiccups, the request goes through. You keep your AI app working, and Emu catches up in the background.
There are exactly two places Emu is allowed to be stricter than no guardian, because those are the places where "no guardian" would mean a secret leaving or a destructive tool running:
- Egress hold. When a request is about to send a password or key out, Emu holds it for 45 seconds. If you do not answer, the default is to redact or cancel. Nothing leaves.
- Sync gate. When a tool call is destructive, Emu holds it for five minutes. If you do not answer, the default is to block. The wrapped MCP server never sees the call.
Both refusals are readable, never a hang. An egress cancel returns a clear "Emu stopped this request because it contained a password or key. Nothing was sent." A sync-gate block returns a JSON-RPC error that says "Blocked by Emu." You always know what happened and what to do next.
Ask Emu and feedback
Ask Emu sessions, memories, and recaps are all on-device. The one exception is explicit feedback you give on an Ask Emu answer (thumbs up or down with an optional comment). That leaves the device so the agent can learn from your explicit signal. The run id is a locally-generated uuid. Unless the backend correlates it independently, the feedback is anonymous.
Uninstall wipes everything
The uninstaller removes the proxy, the key, the daemon, and wipes every log and memory file Emu created. There is nothing left on your computer. The 60-second heartbeat stops. The device drops off the cloud registry on its own.
Where to go next
- What Emu does for the five jobs and where the two fail-safe spots live.
- Modes for the three per-app modes and what Emu watches.
- Get started for the five-beat install, including the biometric opt-in.