Privacy

Everpaper is built to stay on your Mac. Capture, transcription, the knowledge graph, and your whole journal database live locally, and nothing is sent to an AI unless you connect a provider and — for cloud providers — explicitly turn cloud analysis on. This page explains exactly what stays put, what can leave, and how to control it.

On-device by default

Out of the box, everything happens on your machine:

• Screen capture and OCR. The Day Journal periodically captures your screen and reads it with on-device OCR. Screenshots are processed and stored locally and never uploaded.
• Meeting transcription. Meetings are transcribed by an on-device speech model. Audio never leaves your Mac.
• Your journal and graph. The journal database, the people, files, sites, and beliefs in the Second Brain, and your meeting library are all stored on this Mac.
• Insights, Network, and beliefs. These are computed deterministically from your own history on-device, so they work with no AI provider connected at all.

By default, journal entries are kept for 30 days and then pruned. You can change retention (7, 30, 90 days, or Forever) in the Colophon.

AI is opt-in

Everpaper never talks to an AI provider unless you set one up:

• No provider, no traffic. If you haven't configured a provider, features that use AI — Ask the book, Second Brain chat, drafting — simply wait. Nothing is sent anywhere.
• Local providers keep everything on your Mac. Connect a local model runner (Ollama, LM Studio, oMLX, or any OpenAI-compatible endpoint on localhost) and your text is processed on your machine, with no calls off the Mac.
• Cloud providers are gated by consent. A cloud provider (Anthropic, OpenAI, Google Gemini, OpenRouter) is only allowed to receive your data after you turn on Allow cloud AI to analyze your journal, which is off by default.

Every AI feature passes the same check before anything is sent: if no provider is configured the call is declined, a local provider is allowed, and a cloud provider is allowed only with your consent. There is no separate path — journal text, meeting transcripts, chat questions, drafts, and image descriptions all go through the same gate.

Prompts are redacted before any cloud call

Before any text is sent to a provider, Everpaper runs an offline, on-device pass that scrubs secrets out of it. This runs both at capture time (before anything is written to your journal) and again before every outbound AI call. It recognizes:

• Private keys
• JSON Web Tokens (JWTs)
• API keys
• Bearer tokens
• Payment card numbers
• Social Security numbers
• One-time passcodes (OTPs)

Each match is replaced inline with a placeholder like [REDACTED:api_key]. The matched secret itself is never shown in the app and never leaves your Mac. The redaction pass is pure and offline — it makes no network calls of its own.

Optional features that can send more

These are all off by default and each is independently controlled in the Colophon:

• External agents (MCP). Lets an external AI agent query your journal locally. It exposes only the structured, already-redacted recall — people, files, links, and graph — never screenshots. Exposing raw screen text (full-text search) is a separate, extra opt-in, and turning the agent server off revokes it.

A related option, AI refinement of insights, is on by default once a provider is configured. It lets the connected AI tidy your beliefs and topics; turn it off to keep the plain, deterministic Second Brain. Like everything else, it only uses the provider you chose, under the same gate.

Local AI sees the real thing

When you use a local provider (Ollama, Apple Foundation Models, LM Studio), nothing leaves your Mac — so there's no privacy cost to sending the full, un-redacted context. Everpaper preserves real names, emails, and phone numbers for local providers so the Second Brain grounds on the real thing instead of [REDACTED:name] placeholders. Secrets (cards, keys, tokens) are still scrubbed for every provider, local or cloud.

Every answer is verified

Every chat answer from the Second Brain is checked against your actual captured history before it's shown. If the model invents a person, project, or fact that isn't grounded in your data, the claim is stripped out. This verification runs on every answer — not just the relational ones — so a fabricated claim can never slip through regardless of the question type.

Where to configure it: the Colophon

All of these settings live in the Colophon, Everpaper's settings page. Open the Index with ⌘K and choose Colophon, then go to the Intelligence section.

To connect a provider:

1. Pick a provider from AI option (or None to disconnect).
2. For a cloud provider, paste your API key. For a local provider, leave the key blank.
3. Optionally set a base URL (for OpenAI-compatible endpoints this is required) and a model, or use Refresh list to pull available models.
4. Press Test Connection to verify, then Save.

When a cloud provider is selected, the Allow cloud AI master toggle appears under The Second Brain — one trust decision, with Share your profile as an optional sub-toggle for sending your name and role. When a local provider is selected, the cloud toggles are hidden and you'll see a simple "Your AI runs on your Mac — nothing leaves this device." Under External Readers you'll find the agent (MCP) toggles.

Where your keys are stored

Your API key is stored only in the macOS Keychain, in a per-provider entry under an Everpaper-specific service. It is never written to the app's preferences and never appears in your saved configuration. Switching providers keeps each provider's key in the Keychain, so you can move back and forth without re-entering it. Pressing Clear removes the active provider's key from the Keychain.