Privacy policy.

The short version

Silo Vault does not collect your data. Silo Systems receives none of your content, and it leaves your Mac only through the optional paths you turn on.

No analytics. No telemetry. No account. No document uploads to Silo Systems. No usage metrics, error beacons, advertising IDs, fingerprinting, or crash reports sent to us. Silo Systems never collects or stores your documents, your vaults, or anything derived from them. Silo Vault shares their text only through paths you turn on: your own cloud key, which sends requests directly to the provider you configured, and an AI tool you connect through Connect AI.

Processing runs on your Mac by default, using a bundled local runtime and locally stored models. There is no Silo Vault account and no Silo Systems service that holds your work. Two optional paths can reach the network, and both are off until you turn them on: your own cloud key, which sends each Ask question and its excerpts directly to the provider you chose and pay for (through version 1.12.2 it also serves the other AI features described below), and the live model-catalog refresh, which downloads one signed metadata file and sends none of your content. Both are described below, along with the one-time model download.

What we don't have, and therefore never see

Silo Vault has no server-side component run by us, so none of the following reaches us: your name, email, phone, or address; your device identifier or any hardware fingerprint; your content and anything derived from it; session timing, feature usage, or behavioural data; crash reports. With the optional catalog refresh switched off, the app makes no requests to Silo Systems at all.

The local backend is not a network service

Silo Vault runs a local process for its on-device work. It binds strictly to the loopback interface (127.0.0.1:8801), never to a network-facing address, and the app talks to it through that same-device endpoint. It accepts no external connections and is not reachable from your network or the internet.

When you connect an AI tool through Connect AI, that tool starts Silo Vault itself over stdio on this Mac. No network port is opened. The tool receives the vault listings, passages and graph results it asks for, plus matching Timeline moments while the Timeline is on; what it then does with them, which can include sending them to its own cloud service, is governed by that tool's own terms.

Workspace recall (opt-in)

Silo Vault includes an optional, opt-in Timeline that builds a private, searchable record of your own work from periodic on-device screen text recognition and optional audio transcription. It is off by default and never runs until you explicitly enable it.

• On-device processing. Recognition and transcription run locally, and Silo Vault never uploads the Timeline on its own. An AI tool you connect through Connect AI can read matching moments while the Timeline is on. Through version 1.12.2, a question asked with your own cloud key on, Recall on and RAG off also sends up to three matching moments to that provider; later versions never send Timeline moments to a cloud provider.
• A visible indicator in the menu bar shows whenever capture is active.
• Exclusions. You can exclude specific apps, and a frame is skipped entirely while macOS secure input is active, for example when a password field has focus.
• Retention you control. You set a retention window; older entries expire, and Turn off & securely purge deletes the history and verifies that no captured rows remain.
• Storage. Timeline text is stored in the ordinary local index inside the app's sandbox container. Silo Vault does not add a separate encryption layer to it; protection at rest depends on your macOS and FileVault settings.

If you never enable it, none of this runs and nothing is captured.

Outbound traffic you initiate

All outbound traffic is user-initiated, and none of it goes to a Silo Vault server:

1. Model downloads. Before your first question, and only after you approve an in-app disclosure showing the exact size and license, Silo Vault downloads revision-pinned chat and embedding models from Hugging Face and verifies them before use. The first download is about 3.8 to 5.4 GB depending on your Mac's memory; larger models are optional picks. No account or document content is part of the request. The host receives ordinary request metadata such as your IP address, under its own privacy policy. Once the verified models are on disk, Silo Vault works offline.
2. Optional model-catalog refresh. Off by default; see below.
3. Ask answers with your own cloud key (optional). Off until you choose a provider in Settings and confirm the consent notice; see below.
4. App Store updates. Delivered between your Mac and Apple. Silo Vault is not involved.
5. Links you click. Handled by your default browser. Silo Vault is not involved.

Optional model-catalog refresh (off by default)

Silo Vault can tell you when a newer local model is available. This check is off by default and makes no request until you turn it on. Once enabled, Silo Vault fetches, at most once a day, one developer-signed catalog file from ohmslaw.net, a site operated by Silo Systems and hosted on Vercel, and verifies its signature on your Mac before using it. This is the only request the app ever makes to a Silo Systems domain. It is a one-way download.

No document, vault name, search query, chat message, embedding, or account identifier is part of the request. It exposes only what any HTTPS request exposes: your IP address and a user-agent string. Silo Vault writes no log of the check; the hosting infrastructure may keep standard web access logs, which we do not use to profile you or link to anything you do in the app.

The catalog only changes which models the in-app picker can offer; downloading any model still takes its own consent. Turning the setting off stops the checks and deletes the stored network copy of the catalog. A missing, expired, or unverifiable catalog leaves Silo Vault on the signed model list already inside the app, which it reads without any network request.

Some catalog models may be marked experimental. That label means the model has not been tested on Silo Systems hardware, and its memory figure is an estimate, not a measurement. An experimental model is never chosen for you and never a default, and installing one takes an explicit extra confirmation beyond the normal download consent. It may need more memory than estimated, or run poorly, on your Mac.

Your own cloud key (off by default)

This is the one path by which Silo Vault itself sends your content off your Mac, and it stays closed until you open it. If you choose a cloud provider in Settings, enter your own API key and confirm the consent notice, then each Ask question sends, directly from your Mac to that provider under your own account:

• the question;
• up to 20 earlier messages of that conversation;
• the excerpts retrieved from your vault for it.

That provider receives this content and ordinary request metadata, including your IP address, and handles both under its own privacy policy and retention practices, not ours. After version 1.12.2, indexing, search, embeddings, summaries, contract review, the Source Inspector, Timeline capture and the MCP server stay on your Mac whether or not a key is set.

Through version 1.12.2, the key also serves other AI features. Summaries and other transforms, contract review, document comparison and the Source Inspector send that feature's instructions, any question you type and the document excerpts it reads, labelled with their document names. A question asked with RAG off and Recall on sends up to three matching Timeline moments instead of vault excerpts.

Silo Vault shows a cloud badge whenever a cloud provider is active, and you can switch back to on-device answers at any time. None of it is ever sent to Silo Systems. We run no server, proxy, or relay on this path, and we never see your content or your key. The key is kept in the macOS Keychain on this Mac. If you choose the local model server option instead, requests go to a server on this Mac at 127.0.0.1 and stay on this Mac.

Permissions we request, and why

• Files, folders, and export destinations you choose. Silo Vault reads documents only from locations you select and writes only to destinations you choose in the macOS Save panel. Selected access may be remembered with app-scoped security bookmarks.
• Screen Recording. (optional) Used only by the optional Timeline for on-device screen text recognition. Requested only when you enable it.
• Microphone. (optional) Used only by optional Timeline audio capture for on-device transcription. Requested only when you enable it.

Silo Vault does not request Camera, Contacts, Location, or any other protected resource beyond those listed above. Apart from the optional Timeline, it reads only the files and folders you pick.

On-device data you create

Your content and everything derived from it live inside the app's sandbox container at ~/Library/Containers/com.silovault.app/Data/Library/Application Support/SiloVault/. Settings lists the vault index, chat history, memory records, models and archive staging, with delete and purge controls. A file you explicitly choose for import or export stays under your control at that location. Removing the app may leave its container in place, so use the in-app delete and purge controls first.

Portable export writes a .silovault archive only to the destination you choose. The archive is encrypted with authenticated AES-256-GCM under a passphrase you set, and Silo Vault never uploads it. Import verifies integrity and previews conflicts before creating a separate local copy.

Third-party services

Silo Vault runs its models and text recognition locally. The services below are contacted only for a request you chose to make, and none of them receives your documents from Silo Vault except the cloud provider you configure yourself:

• Hugging Face: contacted only when you approve a model download. The app shows each model's name, size and license before it downloads.
• ohmslaw.net (Silo Systems, hosted on Vercel): contacted only while the optional catalog refresh is on, to download one signed metadata file.
• The cloud provider you choose: contacted only for requests made while your own key is on, as described above.
• Apple: App Store purchase and updates.

Children's privacy

Silo Vault is rated 4+. Because no personal data is collected from any user, no special treatment is required for users under 13. The same policy applies regardless of age.

Changes

If we ever materially change how Silo Vault handles data, we will publish an updated version of this page, announce the change in the release notes, and require explicit consent in-app before any new collection begins. The current policy is: nothing about you is collected, and your content leaves your Mac only through the optional paths described above.

Contact

Questions about this policy: admin@ohmslaw.net