Legal
Privacy Policy
Effective date: [date published]
Metroon is built to run locally by default. It does not promise that all data always stays on your Mac.
Metroon's developer never receives session content; configured cloud providers may process and retain it under their terms.
What stays on your Mac
Metroon's default inference backend is MLX, which runs on Apple Silicon. If you use only local citizens and do not use dictation that falls back to Apple's speech service, your questions and model conversations are not sent out for inference.
Metroon stores its working data locally. This includes session questions, generated artifacts, citizen settings, the knowledge graph, economic ledgers, and downloaded model files. Most of this data is stored in Metroon's own storage area on your Mac, in the app group container macOS gives the app; diagnostic files described below are the exception and stay under your Mac's Application Support directory.
If a model returns text that Metroon cannot parse, Metroon saves the raw model output under Application Support in MetroonAI/DebugDumps/parse-failures. These files may contain session content. Metroon bounds them: each file is truncated at 64 KB, files older than 14 days are removed, and the whole folder is held to 16 MB and 2,048 files, with the oldest removed first. Metroon prunes on launch and again whenever it writes a new one. There is no button in the app for deleting them yourself; you can remove the folder in Finder.
When you use a cloud citizen
Cloud inference is optional. It happens only when you select a cloud-backed citizen and save an API key for that provider.
For a cloud request, Metroon may send:
- Your question exactly as entered.
- Curated knowledge-graph excerpts, including text from prior-session artifacts.
- The cloud citizen's portfolio block, which can also contain prior artifact text.
- The citizen's identity and role instructions.
- An excerpt from Metroon's constitution.
- Current-session model replies and discussion context.
- During Debrief, the citizen's full accumulated conversation for that session.
The request goes directly from your Mac to the provider selected for that citizen:
| Provider | Destination |
|---|---|
| Anthropic | api.anthropic.com |
| OpenAI | api.openai.com |
| xAI | api.x.ai |
| Google Gemini | generativelanguage.googleapis.com |
Your API key identifies your account to that provider. Provider processing and retention are governed by your account settings and that provider's terms. As of August 20, 2026:
| Provider | Published default or model-specific retention relevant to Metroon |
|---|---|
| OpenAI | Abuse-monitoring logs may contain prompts and responses and may be kept for up to 30 days. Metroon sends store: false on its OpenAI Responses requests, but that setting does not disable abuse-monitoring logs. OpenAI data controls |
| xAI | API requests and responses are stored for 30 days by default. Team-level Zero Data Retention can change this. xAI API security |
| Google Gemini | Prompts, contextual information, and outputs are retained for 55 days for abuse monitoring and related legal or regulatory purposes. Google abuse monitoring |
| Anthropic | Covered models supported by Metroon require 30-day retention. Other Anthropic API requests follow the data arrangement on your Anthropic organization or workspace. Anthropic API retention |
Provider terms can change. Check the linked provider page and your provider account before sending sensitive material.
API keys
Metroon stores cloud API keys in the macOS Keychain as a local, device-only Keychain item. The app keeps a non-secret list of which providers are configured so it can show readiness without opening the Keychain.
Metroon uses each key only with the provider it belongs to. The key is sent to that provider for credential checks, model-list requests, and inference requests. Metroon does not send a provider key to Metroon's developer or to another model provider.
Other network requests
Metroon makes a small number of requests that do not contain your question or session content:
- When its cached copy is more than 24 hours old, Metroon requests a signed model registry from
raw.githubusercontent.comduring launch. That file is the list of models Metroon offers and how it routes them; a signed update lets Metroon change that list without shipping an app update. Metroon accepts it only if the signature verifies against a key built into the app and the file is newer than the last one it accepted. The request carries no session content. - Metroon registers a daily background task that can request the available-model list from a configured cloud provider. This request uses that provider's saved key but does not include session content.
- When you browse or download supported local models, Metroon requests model metadata and model files from
huggingface.co.
These services receive ordinary connection information such as your IP address and request timing. That can reveal that Metroon is in use and how often a request occurs. Metroon's developer does not operate these services.
Dictation
Metroon asks macOS to use on-device speech recognition when the recognizer says it is supported. When it is not supported, macOS may use Apple's speech service. In that case, audio may leave your Mac and be processed by Apple. Do not use dictation for material you do not want sent to Apple's speech service.
Product analytics
Metroon never includes advertising, and it never sends your session content to Metroon's developer. Questions, deliberations, artifacts, and your knowledge graph stay out of this entirely.
Metroon does include optional product analytics, and it is off until you say otherwise. The first time you set Metroon up, one screen asks you two choices, side by side, with neither answered in advance. You cannot continue until you have answered both, and choosing "Don't share" for either does not restrict any part of the app. Metroon collects a category only if you chose to share it, and neither choice is assumed from installing, launching, or continuing to use the app.
Product activity — that the app was launched or used that day, that setup finished, that a deliberation started, how it ended, and that a model was downloaded, connected, or replaced. No model names, no provider names: these events say that it happened, never which model.
Reliability — that the app crashed or a step failed, and which kind of failure it was. Never a stack trace, a log, or the text of an error message.
If you decline both, Metroon's developer receives no analytics from your Mac. (Metroon still makes the network requests described elsewhere in this policy — model downloads, its model registry, providers you configure, and Apple's speech service if you use dictation.)
What an analytics event contains
Every event carries six things: the event's name, drawn from a fixed list of eleven; a random identifier that belongs to this installation of Metroon; a second random identifier unique to that one event; when it happened; a marker telling PostHog not to build a person profile from the event; and a schema version.
Two of the eleven events carry more. The event recorded when you first turn a category on also carries the Metroon version and build, which channel you installed from (direct download or the Mac App Store), and when you gave that consent. The reliability event carries the same version, build, and channel, plus which of the two categories are turned on at that moment.
Every other event carries at most two values, each drawn from a short fixed list published on the setup screen: how onboarding ended, how a deliberation ended, what happened to a model download, whether a model was local or cloud-backed, and which class a failure fell into.
Metroon does not send your macOS version, and it does not send any description of your Mac's hardware.
The setup screen shows the exact, complete field list, every field name and every value each one can take, before you choose. Settings shows the same list at any time.
The random identifier is created locally and belongs to that installation of Metroon. Metroon never connects it to your name, email, Apple Account, provider accounts, or any other app: there is no account to connect it to. It is kept in Metroon's own storage area, in a folder separate from your sessions and knowledge graph, so clearing session data does not change it. Using "Reset analytics identifier" in Settings gives you a fresh one, and so does removing all of Metroon's data; an ordinary reinstall that keeps your data keeps the identifier.
What it never contains
Your questions, model responses, artifacts, insights, or knowledge graph. Your name, email, or any account. Your API keys. File paths or file names. Model or provider names — curated, custom, or cloud. Your location.
Like any internet request, delivering an event exposes your IP address to the receiving server. Metroon has PostHog configured to discard it rather than store it with your events, and Metroon never uses it.
How long it is kept, and how to delete it
Analytics events are deleted after 12 months. Metroon keeps aggregate statistics past that point — counts like "how many installations completed setup in March" — which do not identify you and cannot be traced back to your installation.
To delete your analytics data earlier: Settings shows your analytics identifier with a copy button. Send it to the support address below and Metroon's developer will delete every event that carries it. This works because only your Mac holds that identifier; no account or proof of identity is needed or asked for.
"Reset analytics identifier" in Settings is different: it gives your installation a fresh identifier from that moment on, which disconnects your future events from your past ones. It does not delete anything already sent.
Each category has its own control in Settings, under Privacy, and you can turn either one off on its own without touching the other. Turning a category off stops those events from that moment, and anything already queued on your Mac and not yet delivered is discarded rather than sent. It does not delete events already received: use the deletion route above for that.
If Metroon cannot save a change to your analytics choices, it tells you the change is not saved yet and keeps trying. If it still cannot save the next time you open Metroon, analytics stays off until it can. If you saw that message, check Settings > Privacy the next time you open Metroon to confirm the category is off.
Note
[DRAFTED, NOT YET TRUE. LANDS WITH THE CONSENT LANE'S UNIT 3.]Corey ruled D106 Q1 on 2026-09-07 as branch A, no unclean-launch witness: "asking on next launch if it does not write on the previous is ok". The two sentences above are written against that ruling and are the wording to publish, but they describe unit 3a (a mandatory launch probe write answeringauthorityUnavailable) and unit 3b (the intent record and its launch replay), neither of which is built. Today the opposite is true and a running test says so: "AUDIT FATAL 3 (RED)" fails atD097AnalyticsCoordinatorTests.swift:5634 withenqueue(...) == .admitted andenabledCategories[.productActivity] == true, so after a save failure plus process death a relaunch resumes collection, while the pane says "Still confirming that this category is turned off. This keeps retrying automatically." (PrivacySettingsView.swift:1508). Confirm the exact wording with the claude-consent-fatals lane when 3a and 3b land, then delete this block.
THE THIRD SENTENCE IS RULED IN (chief, 2026-09-07), and the reason is recorded because it is the kind of sentence a later editor trims as noise. Branch A ships a residual by construction: a save that failed, then storage recovering before the next launch, with no record of the intent, resumes collection with no cue. Closing it is D106 unit 8, which Corey has defaulted to after launch, so it ships. The first two sentences do not reach that case, and it is the one a user is actually harmed by. A policy that promises a withdrawal sticks may not be silent about the one shipped case where it may not, and checking the pane is the only action available to the user. Do not delete this sentence before D106 unit 8 lands.
Metroon keeps a small number of timestamped backups of your analytics choices so a damaged file does not silently lose them. A backup is never treated as your current answer on its own: if Metroon cannot read your choices, it does not guess and it does not quietly restore an old file behind your back. It turns both categories off and asks you to choose again, and if the backup carries an identifier your installation had already retired, it gives you a new one rather than reusing it.
Who receives it
PostHog, an analytics provider, receives these events on Metroon's behalf and stores them in the United States. Metroon has turned off PostHog's settings for AI training and for sending data to third-party AI services. Metroon does not sell this data, and does not share it with anyone else.
Your choices
- Use only local citizens if you want model inference to stay on your Mac.
- Do not configure a cloud provider for material you do not want that provider to process.
- Remove a saved provider key when you no longer want Metroon to use that provider.
- Avoid dictation if you do not want audio to be eligible for Apple's speech-service fallback.
- Turn either analytics category off at any time in Settings, and Metroon stops sending it from that moment.
- Treat raw parse-failure files as sensitive because they can contain model output from your session.
Contact
Questions about this policy: support@metroon.ai