Where your content goes
A local chat model alone doesn’t make every tool offline. A web search, a remote MCP tool, a cloud transcription provider, or a cloud embedding model still sends content over the network.
Control what you send
Look over attachments and context before you send a request. Appshots, screenshots, selected text, clipboard content, and browser pages can hold more than the sentence you mean to ask about. Choose your context sources in Context Awareness. Grant macOS permissions only for the features you use, and revoke them in System Settings when you no longer need them.Credentials
You manage API keys and account sign-ins on each provider’s Authentication section and in Credential Management. Treat your local Enconvo configuration, backups, exported settings, and support logs as sensitive, and keep keys and account tokens out of prompts, screenshots, and shared files. A provider profile can share its credentials across several features. Check every feature that uses a profile before you delete or replace it.Tools and integrations
An Agent can act through the tools you turn on. Browser control, computer use, shell commands, file edits, Gmail, and external MCP servers each reach different things. Check the Agent’s tools, and the action it proposes, when it works with important data. Running an extension in its own worker doesn’t stop it from reaching your local files or the network. Install tools from sources you trust and check their configuration.Local AI clients
Knowledge Base MCP is off until you turn it on, and accepts local connections. Its visibility switches choose which knowledge bases it exposes. A local client may send what it retrieves to its own AI provider, so set up that client with care too.Analytics and diagnostics
Enconvo records product usage events under a device ID, not your account. The events are designed to leave out email addresses, conversation text, and media. To stop sharing them, turn off Share anonymous product analytics under Privacy in Settings → General. Crash and freeze reports are sent only while that switch is on, and carry none of your content. Diagnostic logs are separate from analytics. When Enconvo freezes, crashes, or misbehaves, send them to the Enconvo team with Submit Diagnostics… in the menu bar menu, or from Settings → Diagnostics:- Before anything leaves your Mac, Enconvo takes out personal details, such as your home folder’s name, file names, email addresses, API keys, tokens, links, IP addresses, and the text of prompts and replies.
- A report carries a random ID made only for diagnostics, not your account or email. Only the Enconvo team can read it, and it’s deleted after a set number of days.
- Logs can still name the apps, commands, and models you used.
- The page shows exactly what was sent, and lets you withdraw or delete each report.
Keep or remove local data
Each feature manages its own data: chat history, knowledge bases, recordings, and credentials each have their own controls. Read deletion confirmations, and keep backups of anything you need. Removing the app doesn’t always remove its configuration and data. Removing local data doesn’t delete copies an external service already processed. For a provider’s retention and account policies, see that provider: this page covers Enconvo’s data flows, not theirs.Related
macOS Permissions
What each permission lets Enconvo do.
Credentials
API keys, sign-ins, and shared profiles.
Context Awareness
Choose what context goes with a request.
Enconvo Account
Sync, and what it keeps on your computers.