Privacy Policy

1. Scope and Controller

For the purposes of Regulation (EU) 2016/679 (the "GDPR"), we are the controller of the personal data that we process through the Website, as described in Section 3.

We are not the controller of the data that the Software processes on your equipment. That data remains under your control and is not transmitted to us (Section 2). A provider of a language model or of another third-party service that you select processes the data that it receives under its own terms and privacy policy (Section 11).

2. Data That We Do Not Receive

The Software does not require an account with us, and we do not operate a hosted BoBe service. The Software does not transmit telemetry, usage analytics or crash reports to us. Requests to the Website for updates are described in Section 3.

We do not receive:

• your conversations with the Software;
• the memory and the goals that the Software maintains;
• the text that the Software recognises on your screen;
• audio from your microphone;
• your files; or
• your credentials for providers of language models.

The Software processes this data on your equipment. Depending on your configuration, some data is also sent to your selected model provider, connected tools or paired devices (Section 11, Section 12 and Section 14). We cannot access, disclose, restore or delete the data in your installation.

3. Personal Data That We Process Through the Website

Server logs

When you visit the Website, our hosting provider, Cloudflare, processes on our behalf the IP address of your device, the type and version of your browser, the address of the page requested and the date and time of the request. This processing is necessary to deliver the Website and to protect it against misuse.

Update checks

When the Software checks for an update, it requests a file from the Website. That request is processed in the same manner as any other request to the Website.

Communications

If you contact us, we process the content of your message and the contact details that you provide, in order to respond to you.

Data that the Website does not collect

The Website does not set cookies, does not use analytics and does not load resources from the hosts of third parties. If you select a theme or a language, your browser stores that preference in its local storage; the preference is not transmitted to us. The animated character on the Website is scripted: it does not use a language model and does not transmit your selections.

4. Purposes and Legal Bases

We process the personal data described in Section 3 only for the following purposes, on the following legal bases under the GDPR:

• to deliver the Website and the update file, and to maintain their security (our legitimate interests, Article 6(1)(f));
• to respond to your enquiries (our legitimate interests, Article 6(1)(f)); and
• to comply with our legal obligations (Article 6(1)(c)).

We do not sell personal data, use it for advertising or use it to train models. We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

5. Recipients

• Hosting provider. Cloudflare hosts the Website on our behalf and processes the server logs described in Section 3.
• GitHub. The source code, the issue tracker and the releases of the Software are hosted on GitHub. When you visit GitHub, download a release or submit an issue, GitHub processes your personal data as an independent controller under its own privacy statement. The content of an issue is public.
• Public authorities, where we are required by law to disclose personal data. We can disclose only the data that we hold.
• A successor, if the project is transferred to another party. This Privacy Policy will continue to apply to the data transferred.

6. International Transfers

Our hosting provider may process personal data in countries outside the European Economic Area, including the United States. Such transfers rely on an adequacy decision of the European Commission, such as the EU-U.S. Data Privacy Framework, or on the standard contractual clauses adopted by the European Commission.

7. Retention

• Server logs are retained by our hosting provider for a limited period, in accordance with its retention settings. We do not copy them to any other system.
• Communications are retained for as long as is necessary to deal with your enquiry. An issue that you submit on GitHub remains public until it is deleted there.
• The data that the Software stores on your equipment is retained as described in Section 8.

8. Data That the Software Stores on Your Equipment

The Software consists of the application for macOS and a background service that maintains the memory, the goals and the tools (the "Runtime"; the Website refers to it as "the brain"). The Software stores its data in a single directory on the machine that runs the Runtime (by default ~/.bobe). That directory contains your conversations, the memory and the goals that the Software maintains, its skills and working files, your credentials for providers of language models, and any backups that you create.

• The memory and the goals are stored as Markdown files, which you can open, edit and delete.
• The Software does not encrypt this directory. Access to it is restricted by the permissions of your user account on the computer. Disk encryption, such as FileVault, is a function of your operating system, and enabling it is your responsibility.
• Credentials for providers are stored in files that only your user account can read. A backup that you create contains those credentials and should be kept confidential.
• The data is retained until you delete it. The Software automatically deletes older conversations that have been closed.

9. Screen Awareness

Screen awareness is an optional feature. It requires the Screen Recording permission of macOS. You can disable it at any time in the settings of the Software, or by selecting the Quiet mode.

When the feature is enabled, the Software periodically (by default, every two minutes) captures an image of your main display, recognises the text in that image on your Mac, and discards the image. The image is not stored and is not transmitted from your Mac. The recognised text, the name of the application in the foreground and the title of its window are transmitted to the Runtime, which requests from the language model that you selected a short note describing your current activity. That note is added to the memory that the Software maintains.

If you selected a cloud model, the recognised text is transmitted to the provider of that model. If you selected a model that runs on your own equipment, the text is not transmitted to any third party.

10. Voice

• The voice features require the Microphone permission of macOS.
• By default, speech recognition is performed on your Mac, and speech synthesis is performed on the machine that runs the Runtime. The Software does not use a cloud speech service and does not store raw audio.
• If the Runtime runs on another machine of yours, you may choose to transmit the audio of the microphone to that machine. This option is disabled by default.

11. Providers of Language Models

The Software requires a language model, which you select: a cloud provider (for example OpenAI, Anthropic, DeepSeek, OpenRouter or GitHub Copilot), another endpoint that you configure, or a model that runs on your own equipment through Ollama.

If you select a cloud provider, the Software transmits to that provider the data that is required to generate a response. That data may include your conversation, the memory and the goals that the Software maintains, the output of tools, the text recognised on your screen, and files or images that the Software opens in order to perform a task. The provider processes that data in accordance with its own terms and privacy policy, and it may charge you for the use. We are not a party to that relationship, and we do not receive the data.

If you select a model that runs on your own equipment, model processing takes place on that equipment. Connected tools and services may still transmit data as described in Section 12.

12. Actions Performed by the Software

The Software is designed to act on its own initiative. It can read and write files, execute commands, use Git and use the tools that you add, with the permissions of your user account on the computer and without requesting your confirmation for each action. The Software does not run in a sandbox. The output of those tools may form part of the data that is transmitted to the provider that you selected (Section 11). Tools and services that you connect may also transmit data to their own providers, regardless of where the language model runs. Those providers process the data under their own terms and privacy policies.

13. Updates and Downloads

• When the Software checks for an update, it requests a file from the Website and, where an update is available, downloads the release from GitHub. Our hosting provider and GitHub process the IP address of that request, as for any visit.
• When you instruct the Software to install speech models, Ollama or a local model, the Software downloads them from their publishers (GitHub, Hugging Face and Ollama). Those publishers process your IP address.

14. Other Devices

An iPhone, a second Mac or a physical device connects directly to your own installation of the Software, without a relay or a cloud service operated by us. Each device is paired by means of a code and receives its own credential, which you can revoke. The application for iPhone transmits the recognised words, not audio. A physical device transmits the audio of a spoken turn and the readings of its sensors to your installation.

15. Deleting Your Data

The Delete All Data function in the settings of the Software deletes your conversations, the memory, your goals, the learned skills, the files in the working directory, the scheduled jobs, the souls and profiles that you created, your paired devices and your tool servers. It retains your settings, your credentials and sign-ins for providers, the downloaded models and your backups.

To delete all data, quit the Software and delete its directory (~/.bobe) and the downloaded speech models. Data that has already been transmitted to a provider is under the control of that provider, and a request for its deletion must be addressed to that provider.

16. Your Rights

Subject to the conditions of the GDPR, you have the right to obtain access to your personal data, to have it rectified or erased, and to have its processing restricted. You also have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence.

The only personal data that we hold about you is the data described in Section 3. To exercise your rights, contact us (Section 20). We will respond within one month and may request the information that is necessary to confirm your identity. You can access, rectify and erase the data that the Software stores on your equipment yourself, at any time.

17. Children

The Website and the Software are not directed at persons under the age of 16, and we do not knowingly process the personal data of such persons.

18. Security

The Website is served over encrypted connections. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. The security of the data that the Software stores on your equipment depends on the security of that equipment and of your user account. To report a vulnerability in confidence, use GitHub Security Advisories.

19. Changes to This Privacy Policy

We may amend this Privacy Policy from time to time, in particular when the Website or the Software changes. The date at the top of this page shows when it was last amended. The source code of the Software and the history of its repository document how the Software behaves.

20. Contact

Questions and requests concerning this Privacy Policy: an issue on GitHub (issues are public, so put no personal data in one). To report a vulnerability in confidence, use GitHub Security Advisories.