Privacy Policy

Ask Alway · Updated: 17 October 2026

Webnow AS, org. no. 831 434 252, Norway, is the data controller for the limited personal data described here. Contact: contact@alway.app.

Alway watches what you do on your Mac. That is an unusual amount of trust, so this page is written to be read, not to be survived.

The short version

• Your memory database and stored capture archive live on your Mac. Online AI can process selected text from that memory, your screen and your conversation. It can also process text during automatic background memory work, without a new question from you.
• Voice and screen pictures have separate cloud paths. Cloud transcription sends your held recording; cloud voice answers and speech use text. Guidance can share a downscaled display picture, and computer control can share a window picture for a task you request.
• Our relay does not persist request or response content. It stores account/subscription/device linkage, usage counters, optional content-free diagnostics and feature requests you choose to send. AI providers process the requests under the terms applicable to our provider accounts; their retention is separate from local retention.
• You control capture, cloud exclusions, retention, export and deletion in Privacy & Data.

1. What is stored on your Mac

Stored under ~/Library/Application Support/HumanAOS, with owner-only file permissions:

• captured screen text and retained screenshots
• voice transcripts that become part of your conversations or journal
• cards, people, projects, decisions, summaries and profile facts
• conversations, journal entries, personal writing preferences and background-task records

Stored screenshot blobs use encryption with a key in the macOS Keychain. The SQLite text database is not encrypted by Alway. If FileVault is enabled, it protects the disk when the Mac is shut down; Alway does not enable it for you. Screen locking and file permissions do not isolate mounted files from other software already running as your logged-in user. There is no automatic cloud sync of this archive, but the selected excerpts and explicit image/audio requests described below can leave the Mac.

You can pause capture, exclude apps and sites, choose raw-data retention periods, delete recent data or erase the local archive. Exports, backups and documents delivered to your own folders or Notes are separate copies; Alway’s local deletion does not remove them.

2. What leaves your Mac, and when

When you ask Alway something

Alway sends, through our relay, to an AI provider:

• your question or transcribed speech
• a short context extract: relevant fragments of your memory, a summary of what is on screen, and a few recent turns of the conversation
• for a guidance request, a downscaled picture that can include the display and other visible windows; for computer control, a window picture with task-scoped sharing

Outbound model text uses pattern-based masking for recognised secrets such as known API-key formats, labelled passwords and validated card numbers. It does not catch every sensitive detail: health information in prose and unlabelled secrets can remain. Cloud exclusions apply at the context boundary. Image pixels and recorded audio cannot be masked by this text filter.

Automatic memory processing and document import

When Included AI is available, background distillation can send a bounded, policy-allowed and redacted activity-text batch and relevant profile context to the model through our relay. Otherwise it falls back to local processing. Selecting a document for import can send extracted, redacted text for analysis; the original file is read locally.

Voice input and spoken replies

Cloud transcription sends your held recording to OpenAI through our relay; local speech recognition is used when available as a fallback. Voice answers, spoken replies and guidance use OpenAI Realtime. The Realtime answer path receives the transcript and bounded conversation context, rather than a continuous microphone stream. Recordings and returned speech are held in memory during processing. A failed recording can remain temporarily in memory for a bounded retry; ordinary microphone recordings are not saved as an archive. Ambient microphone and system-audio recording are not enabled.

If enabled, TypeSafe’s Jev service can help select the appropriate response form for unclear requests. It receives the text of your current question after known secret patterns have been masked, plus whether current screen context is available. This classification request does not include screen contents, saved memories or conversation history. It cannot approve actions. Provider data-handling terms apply; this integration does not promise zero retention.

When optional memory selection is active, TypeSafe can also receive a small set of stored memory statements after source exclusions and known-secret masking. It ranks these against your current question, or selects exact source statements for a maintained person/project overview. These requests may contain personal context. They contain no screenshot, raw capture batch or conversation history. Scoring does not delete your saved memories or rewrite their facts. Uncertain results retain sources or use the established processing path.

When optional visual guidance is active, TypeSafe can receive a task-scoped screenshot already cleared by your screen and cloud-exclusion settings, together with the requested target and a bounded set of visible control labels and positions. Known sensitive text patterns are masked where supported; a screenshot can still contain personal information. This does not enable continuous screen transmission or let the model approve actions. Uncertain results use the established guidance path.

The included AI service uses Anthropic and OpenAI. TypeSafe visual guidance is enabled for eligible requested guidance tasks. Optional TypeSafe routing, memory selection, voice receipts and research source checking remain disabled in production. ElevenLabs is an optional developer comparison adapter, rather than the normal shipped voice provider. Our relay forwards model requests without persisting their content and counts usage. Provider retention, training settings, processing regions and transfer arrangements depend on the applicable provider accounts; local deletion does not erase copies retained by those providers. We do not promise zero provider retention or processing exclusively within the EEA.

When you use web lookups or maps

The search terms or place names go to the relevant provider. Your location is used only when you ask for a route or nearby places, and only for that request.

When something crashes, and only if you allow it

Continuous diagnostics are off unless you turn them on (Settings → App → Help fix crashes). Reports contain fixed event/error codes, severity, event time, app/build and macOS versions, architecture, optional numeric performance/error measurements and a fingerprint used to group similar failures. They contain no question, answer, screen content, recording, transcript, file path, raw log or raw crash stack. The relay links reports to the account/device used to authenticate the request; these reports are content-free, not anonymous. It removes records older than 30 days when new reports arrive and caps storage at 100,000 reports, so deletion exactly on day 30 is not guaranteed. Turning sharing off clears unsent reports and stops continuous reporting.

When you request a feature

Only after you choose to send a feature request, the app shares a short generic capability title and key, a random retry ID and app version, linked to the authenticated Mac. It does not send the original question, conversation, screen or audio. Requests are retained for 180 days and removed by scheduled cleanup. Delete everything on this Mac in Settings → Privacy & Data also removes requests shared from that Mac; this action deletes your local memory too. Account deletion removes linked requests. A deletion marker containing the request/device IDs can remain for 180 days to prevent retries restoring a removed request.

Optional onboarding progress

This is off by default. The welcome page has no measurement checkbox, and continuing setup or accepting the Terms does not enable measurement. You can enable Share setup progress in Settings → App. A previously granted choice covering page times remains in effect until you withdraw it; older progress-only consent does not enable page-time measurement. The app sends a random ID for that setup run, fixed names of the pages actually visited, completion, and cumulative whole seconds spent on each page while the app is active. Time on the video page does not show whether you watched or understood the film. Developer replay does not contribute. It sends no account ID, device token, question, voice, screen content or permission result. We retain the run, page counts and times for 90 days, then delete them in an hourly cleanup. Our private admin panel shows grouped page counts and average page times, with the current and earlier setup flows kept separate. Runs less than 24 hours old are excluded from provisional stopping estimates because people may return later. Turning sharing off requests deletion of setup runs this Mac still knows about and retries the request if offline. A temporary hashed IP bucket limits abuse; no IP address is stored in the onboarding record. The random ID links events within one setup run; these are limited setup statistics, not a claim that every network request is fully anonymous.

When you download from our website

Website download-click counting is currently paused. Clicking a Mac download link does not send a measurement event to our relay. Downloads remain available. On non-Mac devices, you can ask us to email the download link to you. We send the link through Resend and store the address and request dates in a separate Cloudflare EU database for up to 90 days after the latest request. We use it for the requested link, not for marketing emails. We do not track whether you installed the app. To remove your address sooner, contact us.

Advertising measurement

Meta and Google advertising measurement is currently disabled on this website. We do not load their advertising tags or send them page-view or download-click events. The advertising consent popup and footer choice are therefore not shown. When you visit, we remove the previous advertising choice and known first-party advertising cookies left by our earlier setup.

If we reactivate advertising measurement, we will restore the consent controls and ask for a new choice before loading the tags. Browser Do Not Track and Global Privacy Control signals will continue to suppress that measurement. We will update this policy to describe the active setup.

3. What we store on our servers

Account, device and usage records are held using Cloudflare and Stripe. Website link requests use a separate Cloudflare EU database:

The model relay does not persist prompt text, response text or captured content. Feature requests are a separate, deliberate sharing of a generic capability title, as described above.

Payment details are handled entirely by Stripe, who are a separate controller for them. We never see or store your card number.

4. Why we are allowed to do this

• To perform our contract with you (GDPR art. 6(1)(b)): running your subscription, applying your limits, sending your question to an AI provider so it can be answered, restoring your purchase.
• Our legitimate interests (art. 6(1)(f)): preventing abuse and fraud, keeping the service secure and affordable. We have weighed these against your privacy — which is why the data is counters rather than content.
• Your consent (art. 6(1)(a)): onboarding progress, continuous crash diagnostics, and letting an external AI read your memory through the connector. These are off until you turn them on, and you can withdraw at any time. Accepting the Terms or continuing setup is not consent to optional measurement.
• Legal obligation (art. 6(1)(c)): keeping payment records.

Capture is optional and controlled on your Mac. Local storage alone does not remove privacy obligations: excerpts may be processed online as described above.

5. Other people’s data

Alway will inevitably capture things about other people — names in your inbox, faces in a call, a colleague’s message. Selected excerpts or explicitly shared pictures may be processed online. You decide to run a tool that records your screen. Use the pause control, the exclusion list and the 30-minute delete when you are working with something that is not yours to record, and follow whatever rules apply where you work.

6. Your rights

You can, at any time and free of charge:

• Export your local data — Settings → Privacy & Data → Export your data. The export includes a complete memory database snapshot, table-level JSON, readable memory, personal skills, task records and retained attachments. Attachments are decrypted in the exported folder; protect it. Keychain credentials and already-delivered external documents are excluded.
• Delete your data on this Mac — Settings → Privacy & Data → Delete everything on this Mac, or delete just the last 30 minutes.
• Delete your account with us — Settings → Privacy & Data → Delete account. On confirmed success, this cancels your subscription, removes the account-linked email, Macs, usage and diagnostic records, and revokes access tokens. Stripe may retain legally required payment records. Local memory deletion is separate. Setup runs and website link requests are separate from your subscription; remove known setup runs in Settings or contact us about a link request.
• Correct anything wrong, object to or restrict our processing, and receive your data in a portable format — contact us about these rights; local export covers your Mac’s archive.
• Withdraw consent for onboarding progress, diagnostics or connector access. Turning off onboarding progress also requests deletion of the setup runs this Mac still knows about.

Write to contact@alway.app. We answer within 30 days. If you are not satisfied you may complain to the Norwegian Data Protection Authority (Datatilsynet), or to the authority where you live.

7. Security

Stored screenshot blobs are encrypted with keys in the macOS Keychain; the text database uses owner-only file permissions and relies on the Mac’s disk protection. Local erasure stops active work, attempts key removal and removes the data/cache files. If any step fails, the app reports incomplete erasure rather than success. This is not a guarantee of forensic removal from SSDs, backups or copies outside Alway. Traffic to our relay is HTTPS only. Access tokens are stored hashed on our side and can be revoked per Mac.

No system is perfect. If a breach ever affects you, we will tell you and Datatilsynet without undue delay, as GDPR art. 33–34 require.

8. Children

Alway is not for anyone under 18 and we do not knowingly collect data from children. If you believe a child has an account, write to us and we will delete it.

9. Changes

If we change this policy materially we will tell you in the app or by email at least 30 days before it takes effect. The date at the top always reflects the current version.

Webnow AS · contact@alway.app · https://alway.app