privacy policy.

last updated september 4, 2026

offload is a mac app. donna runs on your machine, reads what you can already read, and stages anything she wants to send until you say yes.

this policy is written to match what the app does. it is short because the architecture is short. almost nothing leaves your computer.

what stays on your mac

your personal data is read on your machine by a local program called life. it reads the stores your mac already holds: iMessages, mail, calendar, contacts, and your browser history. it is read-only by construction. it has no write path and no network path. we never receive a copy.

a local daemon records the arrangement of your screen: which apps are open, which windows, on which displays. it writes to your disk and nowhere else. window titles and screen contents are read only under the grants you give, and stay on the machine too.

a local service acts inside your apps for you: moving windows, clicking, typing. it runs on your mac under the accessibility permission macos gives it. the browser extension drives the browser you already own, on the same machine.

the notes donna keeps, the drafts she prepares, and the receipts of what was done are files in your home folder.

macos owns every one of these grants: accessibility, full disk access, screen recording, automation. you give them in system settings and you take them back in system settings. we never build a permission surface softer than the one the operating system already gives you.

the chrome extension

offload for chrome is the half of donna that works in your browser. it does nothing on its own: it is driven by the offload app on the same mac, and it works inside a tab group it opens and names, so you can see what it is doing from your own tab strip.

what it reads. the pages you send her to, in order to act on them: their text, their links, their forms, and what they write to the console and the network while she works. when you ask her to tidy, group, or search your tabs, the titles and addresses of your open tabs. when you ask her to save or find something, your bookmarks. that is the whole list.

where it goes. to the offload app on your mac, and from there, as part of your conversation, to the ai account you already pay for, under your own plan and your own agreement with them. it does not go to a server of ours. we do not see, log, or store it, and we do not sell it or use it for anything but the work you asked for.

what it never does. it holds no permission to read your browsing history, your passwords, your payment details, or your other extensions. it never closes a tab it did not open and never deletes a bookmark. it never presses a send, buy, publish, submit, or delete control: those are refused in the page, before the click, and handed back to you.

your controls. drag a tab out of her group and she can no longer touch it. remove the extension from chrome and every part of this stops at once; it keeps nothing of its own on your mac.

what leaves your mac, and why

the model. donna thinks with the ai account you already pay for. you sign in with your own chatgpt subscription, and that sign-in is stored on your mac. your conversation, and whatever context it needs from your machine, goes to openai under your own plan and your own agreement with them. there is no offload server in that path. we do not see, log, or store your conversations. how openai handles data on your plan is governed by their terms and by the data controls in your own account, not by us.

diagnostics, if you turn them on. the app can send run traces so we can find bugs. they are off unless you switch them on. they carry the shape of a run, not the contents of your messages, mail, files, or screen. they go to storage we operate at traces.offload.so and are deleted after ninety days.

that is the list. your messages, mail, calendar, contacts, browsing history, tabs, bookmarks, screen contents, and files are never uploaded to us.

what we never do

we do not sell your data, and we never will.

we do not run ads and we send nothing to an ad network.

we do not train models on your data. we do not train models, and we do not hold your data.

we do not read your messages, mail, or files. they are on your computer, not ours.

nothing sends without your yes

anything that reaches another person is staged as a draft: a message, an email, a calendar invite. donna writes it, puts it in front of you, and stops.

releasing a draft is a separate step, and only you can take it. this is a code path, not a promise. the part of the app that can send is denied to the model, and it stays denied no matter what the model is asked or told. every draft can be read in full before it goes, and thrown away instead.

the same rule governs your windows and your browser. she works where you can watch, leaves a receipt for what was done, and gives back any window you have touched.

your account

an offload account is small on purpose. we hold your phone number, used to send a one-time sign-in code, a passkey if you register one, and your email address when you start a subscription. that is what our account service at auth.offload.so stores.

payment is handled by stripe, our payment processor. we never see or store your card number.

your ai sign-in is not an offload account. it lives on your mac and it is yours.

what we keep, and for how long

on your mac: everything, until you delete it. the app’s files live in your home folder and go when you remove them.

with us: your account record for as long as the account exists, and diagnostic traces for ninety days if you turned them on. nothing else, because nothing else reaches us.

your controls

revoke a grant. open system settings, then privacy and security, and take back accessibility, full disk access, or screen recording at any time. donna will say plainly what she can no longer reach rather than fail quietly.

disconnect the model. sign out of your ai account in the app. the stored sign-in is deleted from your mac.

turn diagnostics off. the same switch that turned them on turns them off. they stay off by default.

uninstall. delete the app and remove the .offload folder in your home directory. that is every local file, including the notes and the drafts.

delete your account. write to [email protected] and we will delete your account record and anything attached to it. depending on where you live you may also have rights of access, correction, portability, and deletion under laws such as the gdpr or the ccpa. the same address exercises them.

children

offload is not for children. it is not directed to anyone under thirteen, or under the minimum age where you live, and we do not knowingly collect their data.

changes

if this policy changes we change the date at the top. if a change is material we will tell you in the app or by email before it takes effect.

contact

offload is operated by Offload Studio, Inc. write to [email protected] about anything in this document.