Aarmos runs in your browser as a local-first, protocol-agnostic agent gateway. API keys, OAuth tokens, chat history, agents, connector configs, and the local audit ledger stay on this device. We do not collect them. By default, agent content stays on your device. Two things change that, and only when you turn them on: the workspace evidence relay (Team and Enterprise), which stores signed receipts on our servers so a team can share them, and evidence forwarding to a destination you choose. Every server-side surface — narrow proxies for services that block CORS, account and license records, team pointers, entitlement checks, and the evidence relay — is listed under When Aarmos's server touches traffic.

• LLM API keys added to the on-device vault.
• OAuth access + refresh tokens for connected services.
• Custom REST API configs, MCP server URLs, and agent definitions.
• Chat history, tool-permission rules, and consent decisions.
• Signed audit ledger entries and cost / token telemetry.
• If you set a device password, a PBKDF2 verifier — never the password itself.

Anyone with access to this browser profile — including extensions — can read unlocked vault contents. Set a device password, enable auto-lock, and treat the profile as sensitive.

The static hosting that serves the app may log basic request info (like your IP and timestamps) to keep the site up and prevent abuse. There are no ads and no session recording.

When the model runs a tool or answers a prompt, your browser connects directly to:

• Your LLM provider — OpenAI, Anthropic, Google, Azure OpenAI, Groq, Mistral, or your local Ollama / LM Studio runtime — using your own API key. Their terms and privacy policies apply to the prompt and any tool arguments the model sends.
• Connectors and MCP servers you configured — GitHub, Slack, Notion, Google, Linear, custom REST APIs — using the OAuth tokens or keys in your on-device vault.

For services that support cross-origin requests, your browser connects directly and Aarmos sees nothing. For services that block CORS, your browser routes through a stateless proxy — see the next section. Review each provider's own privacy docs before sending sensitive data.

Governance is local-first. Evidence aggregation is optional. Eight server-side surfaces exist; seven store no chat, tool results, keys, tokens, policy bodies, or workspace contents. The eighth, the workspace evidence relay, is opt-in and stores the governance evidence you send it — under a typed contract, with size ceilings, and byte-for-byte as your device signed it. Policy evaluation, receipt signing, and key custody never require our cloud.

1. MCP transport proxy (/api/mcp/proxy) — forwards a single POST to MCP servers that don't send CORS. Reads no secrets, persists nothing.
2. MCP OAuth proxy (/api/mcp/oauth-proxy) — same, for OAuth discovery, DCR, and token endpoints. Tokens land in the on-device vault; the server holds nothing.
3. Connector OAuth proxy (/api/oauth/proxy) — token exchange for allow-listed providers (GitHub, Slack, Notion) whose token endpoints refuse cross-origin POSTs. Nothing persisted.
4. Discovery probe (/api/discover) — fetches .well-known/ manifests server-side for a URL you paste. Only the URL you supply is fetched.
5. License records (public.licenses_issued + license_activations) — paid purchases write the license key, plan, billing email, and per-device activation fingerprints so keys can be revoked on refund and seat limits enforced. Public revocation returns a boolean — no email or key exposed.
6. Team pointers (Team/Enterprise only) — team name, membership (user IDs), and a policy bundle pointer: URL + Ed25519 signing pubkey + minimum version. The bundle bytes live in storage you own (BYOS); member devices fetch, verify locally, and enforce. Never the bundle contents.
7. Entitlement verification — paid console surfaces (Team, Compliance) request a short-lived HMAC-signed token from the server to unlock the UI chunk. The token carries plan + expiry only. No agent data, no policy, no receipts flow through this call.
8. Workspace evidence relay (Team/Enterprise, opt-in) — the relay transports governance evidence. It never participates in governance. If you enable it, evidence your device signs is copied to your workspace so teammates, exports, and compliance reviews can reach it. Two evidence classes are held, with separate retention, access, and encryption:
   • Receipt evidence — typed sections (decision, participants, verdict, chain, producer, and any declared extensions), size-bounded, deduplicated by hash, and scoped to your workspace by row-level security. Older pre-contract receipts are kept exactly as signed and are never rewritten.
   • Policy evidence — encryptable independently of receipts, server-managed keys by default and customer-managed on request. Content hashes and version pointers stay readable so replay and verification work without decryption.
   The relay is content-preserving: it never transforms, normalizes, enriches, repairs, or interprets. Stored bytes are the bytes you signed. Retention follows your plan and daily ingest caps apply. Where the relay runs is your choice — hosted by us, your own object storage, or your own environment; behavior is identical in every case. Enforcement, signing, and the on-device chain do not depend on the relay — turn it off and Aarmos keeps working locally. See Terms §16 for retention and export.

These proxies exist because same-origin blocks the browser from calling non-CORS services. For zero server touches, use direct-CORS connectors and the desktop connect flow.

Aarmos does not load any analytics, tracking pixels, or third-party scripts unless you explicitly turn analytics on in Settings → Appearance & consent. No cookies are set for analytics. If you opt in, anonymous product events (screens, features, errors) are sent to PostHog EU with IP dropped server-side and Do-Not-Track respected — no message content, credentials, tokens, names, or emails. A random anonymous ID lives in local storage; no cross-site tracking. You can withdraw at any time from the same setting or the Analytics chip in the page footer.

A local ledger records agent runs and tool calls — model, tokens, estimated cost, errors — so operators can reconstruct what happened. Community and above signs entries with a per-device key and hash-chains them so tampering is detectable. Tokens, emails, and common PII patterns are redacted before write.

Aarmos prunes local data on a schedule you control from Storage:

• Usage & cost events — 30 days.
• Run history & signed traces — 90 days.
• Team audit buffer — 7 days.
• Chats, agents, connections, and keys — until you delete them.

Shorten, extend, export, or wipe on demand. You'll get a warning at 80% storage capacity before writes start failing.

Team and Enterprise admins can enable Bring Your Own Bucket — signed ledger entries stream as NDJSON to your S3, GCS, R2, or compatible bucket via a pre-signed URL. Aarmos never holds long-lived storage credentials; nothing forwards until enabled on the device.

Admins can also configure an evidence destination — Splunk HEC, Datadog Logs, or an HMAC-signed webhook — so workspace audit events are forwarded outbound as they are written. Team includes one destination; Enterprise removes the cap. Only the audit event envelope is forwarded (actor, action, resource, timestamp, chain position, and metadata capped at 512 bytes) — never chat, tool results, keys, or tokens. The delivery credential is stored as an environment-variable name; the secret value lives in your secrets manager, not in the database.

Aarmatix LLC (a Delaware limited liability company) is the data controller for the limited personal data described on this page — primarily your account email, license records, and, if you opt in, anonymous product analytics. You can reach us at support@aarmatix.com.

We share personal data only with the following categories of recipients, each acting as a processor or independent controller for a narrow purpose:

• Paddle.com Market Ltd — our Merchant of Record for all paid purchases. Paddle collects billing details, processes payments, calculates and remits sales tax/VAT, issues invoices, and handles refund and chargeback requests. See the Paddle Privacy Notice.
• Static hosting & CDN providers — serve the app and may log basic request metadata (IP, timestamp) for uptime and abuse prevention.
• PostHog EU — only if you opt in to analytics; IP is dropped server-side.
• Authorities or professional advisers — where required by law.

No ads or cross-site tracking cookies. Local storage and IndexedDB remember settings, chats, run history, and consent choices — for the app to work.

Built for adults using Aarmos in a professional capacity. Not designed for children or use below the age of digital consent in your jurisdiction.

No compliance claims (HIPAA, PCI DSS, GDPR-specific processing). Don't route medical records, cardholder data, or other regulated categories through Aarmos unless your provider, MCP servers, and APIs are individually approved and your organization accepts the flow.

• Remove any LLM API key from Settings → AI providers.
• Revoke OAuth connectors and MCP servers; tokens are wiped from the vault.
• Set a device password and auto-lock for shared machines.
• Export an encrypted backup and restore on another device.
• Use Reset app data in Settings → Storage to wipe the profile.

The optional device password derives an AES-GCM key via PBKDF2-SHA256 (WebCrypto) that wraps the vault at rest. No browser vault defeats a compromised browser, extension, or device malware — use a strong password, store the recovery code in a password manager or HSM, and keep browser + OS patched.

We may update this page as Aarmos evolves. The date in the banner at the top shows when it last changed.