What leaves your machine, and what does not.

The program on your computer

• Your notes stay on your disk. The vault is a folder of Markdown files. There is no sync, no cloud copy and no account required to use it.
• No telemetry. Nothing reports your usage, your file names, your errors or the fact that you launched it. The command-line program talks to exactly two kinds of server, both at your own command: the model provider you connected it to, and our account and billing server at api.ferrow.ai when you run the account commands yourself — activate, subscribe, billing and their kin. Those calls carry what Surfaces 3 and 4 describe and nothing more: never a note, a file name or a provider key. Working with your vault makes no network call at all.
• Your provider keys stay in your keychain — via security(1) on macOS, or a file at mode 0600 otherwise. They go to that provider's API and nowhere else. They are never sent to us.
• The local browser UI is local. ferrow ui binds to 127.0.0.1, so nothing off your machine can reach it, and its API needs a token minted at boot and destroyed when you stop it. Said honestly: any program running as you on that machine can read that token. It stops a website you are visiting from reaching your vault over localhost; it is not a defence against software you have already installed.

This website

These pages are static files. They set no cookies, load nothing from anyone else's server — no fonts from a CDN, no analytics, no tag manager, no embedded video — and make no network request of their own. The headers this site is served with pin that: default-src 'self', connect-src 'self', and a test in the repository fails if any file in site/ so much as contains the code for making a network request.

Cloudflare serves the pages and, like any host, sees the request itself — the address you asked for, your IP and your browser's user-agent — as part of delivering it. We do not join that to anything, and there is no account or profile on this site for it to be joined to.

Your Ferrow account

An account exists so a purchase can find you again on a new machine. It is deliberately thin. The record holds:

• Your email address, lower-cased.
• A one-way derivation of your password — PBKDF2-HMAC-SHA256 over a random per-account salt, 100,000 iterations (the most our host will compute; the count is stored on the record so it can rise the day that ceiling moves), stored as salt, iteration count and hash. The password itself is never written down, and nothing stored can be turned back into it.
• Which plan you are on, and the key your purchase minted.

That is the whole record. There is no name field, no address, no phone number, no company and no profile. Sign-in also fails identically for an unknown email and a wrong password — same words, same timing — so the account system will not tell a stranger whether you have an account.

The web client keeps your session in your browser's own storage so you are not signed out on every reload. That is the browser's storage on your device, not a cookie sent to us.

If you forget your password, self-serve reset is built in. The reset request sends your email address and nothing else; the confirm step sends the one-use token from the reset email. The server answers the request identically whether or not the address has an account, so the reset flow cannot be used to probe who is registered. Still stuck? Email support@ferrow.ai — a person will sort it out.

Paying

Stripe handles cards. Checkout happens on Stripe's own pages, under Stripe's privacy policy. Your card number, its expiry and its security code are entered there and never reach Ferrow — we could not show them to you if you asked.

What our billing worker receives from Stripe is the part it needs to know you paid: a checkout session id, a subscription or payment id, the plan, and the email address you used. It never receives a vault, a note, a file name or a provider key, because none of those are anywhere near that path.

Managed model calls, and the hub relay

These are the two places where content — not just metadata — passes through a server, so they get their own section.

Managed

On Managed, Ferrow makes the model call for you. That means the text of the request goes through Ferrow's worker to the model provider it is routed to, and the model's answer comes back the same way. Alongside it, the meter records what a call costs so your spend cap can be a hard stop rather than a guess: the model, the token counts the provider reported, the cost, and a request id. A completed answer is held against that request id for a short window so that a retry of the same request replays it instead of calling — and charging — the provider twice.

On Private, none of this applies: your own key calls your own provider directly from your machine, and Ferrow's servers are not in the path at all.

The hub relay

If you pair a phone or a browser to the machine running ferrow hub, a Ferrow relay passes messages between your own devices. What crosses it is sealed by the devices at each end — the relay carries blobs it cannot read. It does not carry your vault, your notes or your keys, and those stay on the machine running the hub.

Things we do not do

• We do not sell or rent your data, and there is no advertising anywhere in Ferrow.
• We do not read your vault. We do not have it.
• We do not train models on your content. Ferrow trains no models at all — it routes to providers you choose, whose own terms govern what they do, and those are worth reading for the provider you pick.
• We do not track you across the web, and there is no third-party script on this site to do it with.

Getting a copy, or getting rid of it

Email support@ferrow.ai from the address on the account and ask for either. A copy is small — it is the record described in Surface 3 plus your purchase history. Deletion removes the account record and its key; we keep what payment law requires us to keep about a transaction that happened, which is held by Stripe as much as by us.

Deleting your account does nothing to your vault, because it was never ours to delete. It is a folder on your disk and it stays exactly where it is.

If we ever change how any of this works, the date at the bottom of this page changes with it.