← Back

Privacy Policy

Last updated: March 2026

We don't collect, store, or sell your data. The app runs locally on your machine and there is no Atrophy server. There is no analytics. There is no telemetry. However, when you use the app, your conversations and other content are transmitted directly from your machine to third-party services you configure (such as Anthropic, ElevenLabs, and Google). See "Third-party services" below for details.

What the app does

Atrophy is a companion agent that runs on your Mac. It stores conversations, memories, notes, and configuration files locally on your computer. It does not phone home.

Data storage

All data created by the app lives in two places on your machine:

Location	What's there
`~/.atrophy/`	Memory databases, configuration, API tokens, agent state, Google OAuth tokens
Your Obsidian vault (optional)	Notes, journal entries, reflections, agent prompts. Requires an Obsidian API key configured in your environment variables.

Nothing in either location is transmitted to Atrophy. We have no server to transmit it to.

Third-party services

The app can optionally connect to third-party services that you configure. These are all opt-in - the app works without any of them.

Claude Code (Anthropic)

The app uses Claude Code as its inference engine. Your conversations are processed by Anthropic's API according to their privacy policy.

What's sent: Your messages and the agent's system prompt
What's not sent: Your memory database, notes, or other local files (unless you ask the agent to read them)
Their policy: anthropic.com/privacy

ElevenLabs (voice)

If you enable voice, the text the agent speaks is sent to ElevenLabs for synthesis.

What's sent: Text to be spoken
Their policy: elevenlabs.io/privacy

Fal.ai (images and video)

If you enable avatar generation, image/video prompts are sent to Fal.ai.

What's sent: Text prompts, and your avatar source image if generating video
Their policy: fal.ai/privacy

If you enable Telegram, the agent sends and receives messages through Telegram's Bot API.

What's sent: Agent messages to your Telegram chat
What's received: Your messages to the bot
Their policy: telegram.org/privacy

Google (Gmail and Calendar)

If you authorise Google access, the agent can read your email, send email, and manage calendar events. Your Google data is accessed directly from your machine - never routed through any Atrophy server.

What's accessed: Gmail messages, Google Calendar events
How it works: OAuth2 - tokens stored locally at ~/.atrophy/.google/token.json
Revocation: Run python scripts/google_auth.py --revoke or remove at myaccount.google.com/permissions
Their policy: policies.google.com/privacy

Atrophy's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

API keys and credentials

API keys are stored locally in ~/.atrophy/.env with restricted file permissions (0600). Google OAuth tokens at ~/.atrophy/.google/token.json with directory permissions 0700. Never transmitted to Atrophy.

The website

The website at atrophy.app is a static page. No cookies, no analytics, no tracking, no accounts.

What we collect

Nothing. No server, no analytics, no crash reports, no telemetry, no email addresses, no user accounts, no tracking pixels, no fingerprinting.

Lawful basis for processing

Under UK GDPR:

Legitimate interests (Art 6(1)(f)) - transmitting conversations to Anthropic for AI inference is necessary for core functionality.
Consent (Art 6(1)(a)) - optional integrations are activated only when you explicitly configure them.

Your rights

Under UK GDPR, you have the right to:

Access - all data is at ~/.atrophy/ and your Obsidian vault.
Rectify - edit or delete any local files directly.
Erase - delete ~/.atrophy/ to remove all app data.
Restrict processing - disable any integration in Settings.
Data portability - standard formats (SQLite, JSON, Markdown).
Object - stop using the Software at any time.
Lodge a complaint with the ICO at ico.org.uk.

International data transfers

Your data may be transferred to countries outside the UK when using third-party services. These transfers are governed by each provider's terms.

Children

Not intended for anyone under 18.

Changes to this policy

Updates will be posted here with a new date.

Contact

Will Lilley
privacy@atrophy.app
github.com/wlilley93/Atrophy