Privacy

Everpaper is built to stay on your Mac. Capture, transcription, the knowledge graph, and your whole journal database live locally, and nothing is sent to an AI unless you connect a provider and — for cloud providers — explicitly turn cloud analysis on. This page explains exactly what stays put, what can leave, and how to control it.

On-device by default#

Out of the box, everything happens on your machine:

• Screen capture and text recognition. In the screen history modes, Everpaper takes screenshots of your displays and reads them on this Mac. Screenshots are stored locally and never uploaded.
• Meeting transcription. Meetings are recorded and transcribed by on-device speech models. Recordings are never uploaded.
• Your journal and graph. The journal database, the people, files, sites, and beliefs in Memory (also called Second Brain), and your meeting library are all stored on this Mac.
• Insights, Connections and beliefs in Memory are worked out on this Mac from your own history, so they work with no AI provider connected at all.

What connects to the internet#

Everpaper goes online only for these:

• Model downloads, when you set up speech or AI models (for example with Prepare on this Mac or Set up), or when your first meeting needs the transcription model: from Hugging Face and everpaper.app, and the oMLX server from GitHub.
• Update checks to everpaper.app, daily by default and never while a meeting is recording. Choose how they work, or turn them off, in Settings → General → Updates.
• Your AI provider, and an Embedding model provider if you set one, under the rules below.

Nothing else. Everpaper has no analytics or telemetry. Recordings, screenshots and your calendar are never uploaded. Only text, such as screen text, transcripts and meeting titles, can reach an AI you set up. The browser extension for Computer History talks only to Everpaper on this Mac.

How long it's kept#

Screenshots are deleted after 30 days by default (Settings → Privacy → Keep screenshot images for: 7, 30, 90 days or Forever). The same choice is also in Settings → Daily history → How long it stays, as Keep screenshots for.

On a new install, Also delete expired text & recall data (under Manage saved text…) is on. In Daily history the same switch is called Also delete their text & recall data. After the same period, Everpaper also deletes that day's recognized text, search data, running notes and written entry. Some of the day, such as the app timeline and the notes you typed yourself, can stay; to remove everything, delete the day. Turn the switch off to keep text and entries after the images go. If you upgraded from a build that already had journal data, it starts off and only images are deleted.

Original typed text from Computer History expires after 48 hours. Meeting recordings are kept until you delete them.

AI is opt-in#

Everpaper never talks to an AI provider unless you set one up:

• No provider, no traffic. If you haven't configured a provider, features that use AI (answers in Ask your memory… and Memory's Ask tab, summaries) simply wait. Nothing is sent to any AI.
• On-device providers keep everything on your Mac: Everpaper Native, or Ollama, LM Studio, oMLX or Nativ while their address is on this Mac, which is the default. If you point one of them at another computer, Everpaper treats it like a cloud provider. For an OpenAI-compatible endpoint, you decide with This is a trusted, private endpoint. Trusted endpoints receive text without the cloud switch, with only secrets removed, so turn it on only for a server you control.
• Cloud providers are gated by consent. A cloud provider (Anthropic, OpenAI, Google Gemini, OpenRouter) is only allowed to receive your data after you turn on Allow cloud AI to analyze your journal, which is off by default.
• Meeting summaries. Recording and transcription stay on your Mac. If you set up AI, the transcript of each recent meeting goes to your AI to write its Summary. With a cloud provider, this happens only after you turn on Allow cloud AI to analyze your journal. Run marked prompts automatically (Meetings page, off by default) also sends transcripts after each meeting.

Every AI feature in the app passes the same check before anything is sent: if no provider is configured the call is declined, an on-device or trusted provider is allowed, and a cloud provider is allowed only with your consent. Journal text, meeting transcripts, chat questions and notes all go through it. Two things work differently: Allow external agents (MCP) lets another AI app read your journal (see below), and the command line's AI commands send text to the provider you name on each call (see Command line). See AI on your Mac for every option.

Secrets are removed before any AI call#

Before any text is sent to a provider, Everpaper runs an offline, on-device pass that scrubs secrets out of it. This runs both at capture time (before anything is written to your journal) and again before every outbound AI call. It recognizes:

• Private keys
• JSON Web Tokens (JWTs)
• API keys
• Bearer tokens
• Payment card numbers
• Social Security numbers
• One-time passcodes (OTPs)

For cloud providers, and endpoints you haven't marked trusted, Everpaper also replaces email addresses, phone numbers and names it detects, for example [REDACTED:email].

Each match is replaced inline with a placeholder like [REDACTED:api_key] before the text is saved or sent to an AI. Screenshots are images, so a secret that was on screen still shows in them, and only patterns like those above are caught. The redaction pass runs entirely on your Mac and makes no network calls of its own.

Computer History#

Computer History is an optional record of what you do on your Mac, beyond what's on screen. It's offered in every history mode except Screen history, and stays off until you turn it on (Computer History events & text in setup, Record clicks and text in Settings → Daily history).

What it records. Clicks, shortcuts, text you select (Text you select) and text you type (Text you type), in all apps and websites unless you exclude them. This can include email and messages. You can turn selected or typed text off on its own.

What it never records. Password fields and private browsing.

How typed text is kept. As an encrypted, redacted record. The key is kept in this Mac's Keychain and doesn't sync. The original text is gone after 48 hours.

Permissions. Accessibility, to read the controls and text you chose, and Input Monitoring, to notice clicks and shortcuts. Grant them in setup or in Settings → Daily history → Set up permissions.

Limiting it. Settings → Daily history → Interaction source policy → Manage… sets the default for apps and websites: Observe unless excluded or Only included sources, plus rules per app and per website. For per-website rules in Safari, turn on the Everpaper Browser Bridge extension (Safari setup in the same sheet; pair with a code valid for five minutes). It sends only the current site's address and whether the window is private, and only to Everpaper on this Mac. Revoke all removes every pairing.

Other people. Communication apps are included unless you exclude or pause them. Capture other people's communications only with their prior consent.

What your AI sees. While it's kept, the text you select and type is part of what your AI reads to write the day's running notes and entry, and those can quote or summarize it. They stay after the 48 hours, under How long it's kept; delete the day to remove them. It is stored only on this Mac. A cloud AI receives it only after you turn on Allow cloud AI to analyze your journal; a trusted endpoint receives it without that switch.

Keeping apps out#

Settings → Privacy → Skip apps lists apps Everpaper never captures while they are in front. No apps are excluded until you add them. In Screen history, a screenshot shows your whole display, so an excluded app visible behind another window can still appear. Use Pause, or Activity only, for sensitive work. For Computer History, use Interaction source policy → Manage… to exclude apps and websites.

Choices and their defaults#

All of these are in Settings unless noted.

External agents get people, files, links and connections, with secrets removed (names, email addresses and phone numbers are kept), and never screenshots. What an agent reads is then handled by that app and the AI it uses, which may be a cloud service. Allow cloud AI to analyze your journal doesn't apply to it, so turn MCP on only for apps you trust. AI refinement of insights lets your AI tidy the beliefs and topics in Memory; turn it off to keep the plain version. Like everything else, it uses only the AI you chose, under the same rules.

Local AI sees the real thing#

When you use a private provider (Everpaper Native; Ollama, LM Studio, oMLX or Nativ on this Mac; or an endpoint you marked trusted), Everpaper sends the full, un-redacted context. It preserves real names, emails, and phone numbers so Memory grounds on the real thing instead of [REDACTED:name] placeholders. On-device providers keep all of it on your Mac. A trusted endpoint receives it as is, which is why you should mark only a server you control. Secrets (cards, keys, tokens) are still scrubbed for every provider, local or cloud.

Answers are checked#

Before a Memory answer is shown, Everpaper checks each sentence. If it names a person, file or other named thing that isn't in your captured history, or cites a source that doesn't exist, that sentence is removed. A name that is only a close match is kept but flagged. This catches most invented names, but it can't judge every fact, so open the cited sources before you rely on an answer.

Deleting what Everpaper keeps#

• One day: on its page in Timeline, Delete this day and all its evidence. You can undo it from Today right after.
• One meeting: in Meetings, right-click it and choose Delete. Its audio goes too, and this can't be undone.
• All meetings: Settings → General → Setup & data → Clear meeting history (type DELETE to confirm). Settings → Privacy → Delete saved history… takes you there.
• Voices: forget one in Remembered voices (Manage…), or all of them by turning off Remember voices between meetings.
• Downloaded models: speech models under Settings → Speech → Models on this Mac → Remove; Everpaper Native models under Settings → AI & summaries → AI connection → Remove.

Your journal and meetings are stored in Everpaper's folder in your user Library. Some downloaded models are kept elsewhere, so remove models with the buttons above rather than by deleting folders.

Where to configure it#

Open Settings (sidebar, or ⌘,). AI choices are in AI & summaries → AI connection. What is saved, for how long, and what is shared are in Privacy.

To connect a provider:

1. Pick a provider from AI option (or None to disconnect).
2. For a cloud provider, paste your API key. For a local provider, you can usually leave the key blank.
3. Optionally set a base URL (for OpenAI-compatible endpoints this is required) and a model, or use Refresh list to pull available models.
4. Press Save, then Test Connection.

With a cloud provider, Allow cloud AI to analyze your journal appears under Your memory & summaries. It is off by default and is also in Privacy as Allow online journal analysis. Turn it on, and Share your profile with cloud AI appears beneath it; it sends your name, role and what you wrote about yourself. With only on-device or trusted providers, the page instead says Your AI uses only on-device or trusted private providers — cloud AI is off. The MCP switches are under Access from other AI apps.

Where your keys are stored#

Your API key is stored only in the macOS Keychain, in a per-provider entry under an Everpaper-specific service. It is never written to the app's preferences and never appears in your saved configuration. Switching providers keeps each provider's key in the Keychain, so you can move back and forth without re-entering it. Clear disconnects the current AI and removes its key from the Keychain. To change a key, paste the new one and press Save.