Privacy

Where your data actually is

If you have a box. Everything Wollie knows — your messages, your email, your calendar, what it remembers about your household — is stored on the Raspberry Pi (or equivalent computer) that you flashed and plugged in. If you turn on recall by meaning (Settings → Memory), each memory is also kept there as a list of numbers derived from its text, so Wollie can find it by what it means and not only by the words it contains; those numbers are computed on the box and stay on it. At home the app talks to that box over your home network, and that connection is not encrypted unless Tailscale is on on the phone too: how the phone and the box talk says exactly what that means. When you are away it reaches the box over your own private network (Tailscale); the traffic is encrypted end to end between your phone and your box. Deleting your data means deleting it from your box, or unplugging the box. Nobody has to approve that, and no copy survives somewhere else.

If you don't. The app keeps your conversation and your entries on the phone itself, and there is no box in the picture. To answer you it has to reach a model, and unless you have supplied your own Anthropic key it does that through ai-gateway.sromano.com, a server I run myself. Deleting the app deletes what is on the phone; what that server holds is covered below.

There is also a case in between: a phone paired to a box, but out of reach of it (the “away” mode). Your entries stay on the box, but the questions you ask while away go through the same gateway.

What leaves, where it goes, and why

This is the whole list. Some of it depends on which shape you run and which features you use; where that matters, it says so.

• The app → Wollie's gateway → Anthropic — when you have no box

  This is how the iPhone beta works unless you supply your own Anthropic key. What you type, and any photo or document you show it, goes to ai-gateway.sromano.com — a server I run myself — and from there to Anthropic. So does whatever Wollie looks up in order to answer: a meal you logged, a note, an event from your calendar. If you have connected Apple Health, asking about your diet carries the figures derived from it along the same path, because the answer is computed from them.

  That server keeps your conversation so it can carry it on from one message to the next, and it keeps it as a file on its disk, not only in memory: one transcript per conversation, holding what you wrote and what came back. It is kept for one reason, and the reason has a limit: after ten minutes of silence the server lets your conversation's process go, and the file is what lets the next message continue it instead of re-sending and re-paying for everything said so far. There is no version of this that keeps the continuity without the file — the toolkit underneath is explicit that a session which is not written down cannot be resumed.

  So it is kept, and not forever: a conversation is deleted seven days after its last message, together with the record that would have let the server pick it up again. And since a restart makes the older ones impossible to continue in any case, those are cleared out when the server next starts — a few minutes after, not the same instant, because a file still being written to might belong to a process that has not finished shutting down. It also records, per phone: a token it issued you, how many tokens of model capacity you have used today, and when it last saw you — so that one person cannot use up the shared allowance. The app never sends your name, your email or any Apple identifier — the label it registers with is the phone model, the language, and a code the app invents for itself. One exception, and it is worth knowing: if I invited you personally rather than with a shared code, the label I typed is stored on your row, and that is often a first name. It answers on my own Claude subscription, which is why there is an allowance at all.

  If you would rather this server were not in the path, there are two ways out, both supported: put your own Anthropic API key in the app, and it talks to Anthropic directly; or set up a box, and it talks to your box. Both take this server out of the path for answering you; the public lookups in the next item are made by the app itself and are unaffected by either. To have the token this server issued you revoked, or your row deleted, ask.

• Your box → Anthropic (Claude) — when you have one

  Wollie thinks with Claude, using your own Claude subscription or API key, which you provide during setup. When you talk to Wollie, the box sends the conversation to Anthropic's API to get an answer, along with whatever context that answer needs — which can include the content of an email you asked about, a file you sent, or notes it has saved for you. This is the relationship between you and Anthropic, under your own credential and their terms; I am not a party to it and never see the traffic.

  One exception worth knowing. If your phone is paired to a box but cannot reach it — the “away” mode — the phone answers by itself, and those questions go through the gateway above, not through your box.

• Your box → a public model repository — once, if you turn on recall by meaning

  Finding memories by meaning needs a small language model on the box (about 130 MB). It is not in the image: the box downloads it from Hugging Face, a public model repository, the first time you turn the feature on, checks it against a fingerprint fixed in Wollie's code, and keeps it. That download is a plain fetch of two public files: nothing of yours goes along, and the only thing that host learns is that a download came from your connection, as with any download. The model then runs on the box and never talks to anyone.

• Public sources Wollie looks things up in

  When you ask for something it has to fetch, the question — or the part of it that is the query — goes to the service that answers it. Most of these carry what you asked and not who you are: no account, no identifier attached. One group is different, and it is the last one below: checking a wallet's balance means handing a blockchain explorer that wallet's address, and an address is a public, permanent identifier.

  Weather: Open-Meteo, and its geocoding service, which receives the place name you typed — or, if you share where you are and ask about "here", coordinates rounded to about a kilometre. A box also asks api.met.no. Food: Open Food Facts, which receives what you searched for; the second food source is a dataset (CIQUAL) bundled inside Wollie, read from disk, so nothing about that search leaves. News: Google News, GNews and Hacker News.

  Prices and the market: CoinGecko (api.coingecko.com) receives the coins asked about — for the Portfolio, the list of every coin in it, never an amount — and is where the list of known tokens comes from, which is what tells a real token in a wallet from junk someone airdropped into it. If you save a CoinGecko Demo key in the Portfolio, that key goes with the Portfolio's price requests and with the download of that list of tokens, and on a box also with the hourly re-read and with Wollie's own price look-ups, so CoinGecko can tie those to your account there; the other requests to CoinGecko go without it. Binance receives a ticker: api.binance.com for prices, candles and the order book, fapi.binance.com for the open contracts on the futures market and their funding (what one side of those contracts pays the other) — when you ask Wollie about a coin, and when you open a coin's page in the Portfolio. DefiLlama (api.llama.fi) receives the name of a coin's own chain, and GitHub (api.github.com) the name of one public repository, only when you ask how a coin's project is doing; both names come from a table inside Wollie, not from anything you typed. nfs.faireconomy.media serves the week's economic calendar, the same file for everyone. A box also asks Finnhub for stocks, and a price alert you set on a box asks CoinGecko (Binance if it doesn't answer) for that one coin, every quarter of an hour unless you chose otherwise, until it fires.

  Wallet balances: blockchain.info (Bitcoin), eth.blockscout.com (Ethereum), polygon.blockscout.com (Polygon), bsc-dataseed.binance.org (BNB Chain, a public node run by Binance), base.blockscout.com (Base), arbitrum.blockscout.com (Arbitrum), explorer.optimism.io (Optimism), graphql.mainnet.sui.io (Sui), api.mainnet-beta.solana.com (Solana) and babel-api.mainnet.iotex.io (IoTeX). Each receives the address it is asked about. A 0x… address is written the same way on Ethereum, Polygon, BNB Chain, Base, Arbitrum, Optimism and IoTeX, so one you add to the Portfolio is read on all seven, and each of those seven services receives it. For Bitcoin, an extended public key never leaves: your phone or your box works out its addresses and asks about them in batches, so blockchain.info can see that those addresses belong together. An address is asked about when you ask about it, whether you type it in a chat or saved it for checking. And one you add to the Portfolio as an account is read again, once its last reading is more than half an hour old, whenever something needs it: the Portfolio or that account's own page being open, or Wollie being asked what you hold, which on a box can also happen inside a scheduled task. A page that stays open checks again every twenty seconds, so it keeps reading every half hour; on a box the Portfolio's main page waits an hour and a quarter instead. On a phone with no box it is also read when the app comes back to the front, at most once every ten minutes. A pull to refresh reads it again. And a box reads it by itself every hour, with nobody looking, so the balance chart keeps going.

  This is the one lookup that identifies something of yours to the service answering it, and the Portfolio's makes it a regular one. If you would rather nobody learned that an address was being watched from your connection, don't add it: a manual account, where you type the amounts, asks no explorer anything.

  Weather, food, prices, market readings and wallet balances are looked up by the app itself whenever the phone is the brain — on its own, or in the "away" mode described above — and so is everything the Portfolio shows on a phone without a box. News, stocks, met.no and price alerts exist only on a box. When your box is answering, it makes all of them, the Portfolio's included.

• The web, when Wollie looks something up in a chat

  With a box, in a chat, Wollie can search the web and open a page, one it found or one you named. The search is run by Anthropic. The page is fetched by the box itself, so that site sees your home connection and the address asked for, as it would if you opened it. Anthropic is told the site's name first, and reads the page's text to answer you. This never happens in a scheduled task, where the box takes both away from Wollie, and never on a child's account. On the phone with your own Anthropic key, a search is run by Anthropic on its side and nothing is fetched from the phone; through the gateway there is no web search at all.

• Your own accounts, only the ones you connect

  Email: your box logs in to your mail provider over IMAP and sends over SMTP, with credentials you gave it. Calendar: if you connect iCloud, it speaks CalDAV to Apple's servers. Telegram: if you set it up, those messages travel through Telegram's servers like any other Telegram chat and their privacy policy applies. All three are optional, and none of them is on until you set it up.

• Your box → Expo → Apple, for push notifications

  If you allow notifications from the app, the box asks Expo's push service (exp.host) to ring your phone through Apple. The notification carries no content — only a generic category such as "New message", "Heads up", "Urgent" or "Reminder", and for a reminder its number on your box, so that its buttons know which one to mark as done. The real text stays on your box and the app fetches it when you open it. The one exception is yours to make: on the Reminders page you can choose to read a reminder's own words in its notification, and for whoever turns that on those words cross Expo and Apple. Whenever the app starts while it is paired to a box and notifications are allowed, it asks Expo for the push address the box will use. That request carries the phone's Apple push token, an install ID the app generates and the app's own identifiers, and nothing you wrote.

• Tailscale, if you set up access from outside your home

  Reaching your box from outside uses Tailscale, which is a third-party company: you log in to them, and their coordination service knows your devices exist and helps them find each other. The traffic between your phone and your box is encrypted end to end and Tailscale cannot read it, but they are a party to the arrangement and this page would be wrong not to name them.

• Analytics, telemetry, crash reports → nobody

  The app contains no analytics SDK, no crash reporter and no tracking of any kind; there is no advertising identifier, no profiling and no third-party measurement. Your box does not phone home to me, and updates are something you fetch from GitHub when you choose to. The brain on a box, and on the gateway, is Anthropic's own Claude command-line tool, which by default reports usage metrics and errors to Anthropic (and to the services it uses for that), as it does on anyone's computer. Wollie switches that off: a box from its update of 26 September 2026 (one set up from an older image once it updates), the gateway from its next restart. The app talking to Anthropic with your own key does not use that tool. As for the gateway described above: it sees the questions it is asked to answer, because it has to in order to answer them, and it is not used to build a profile of you or given to anyone else.

Apple Health

If you choose to connect Apple Health, Wollie reads these specific things, and nothing else:

• Active energy burned and resting energy burned, per day — so the diet feature can show what you ate against what you spent.
• Steps, per day — read in the same request as the two energies, and shown on the activity card.
• Body mass and height — so you don't have to type them.

That is the whole list: five figures, and Wollie asks iOS for exactly those. It does not read your biological sex, your date of birth, your workouts, your heart rate, your sleep or your clinical records.

Wollie never writes anything to Apple Health. This is off until you turn it on, iOS asks you separately before any of it is readable, and you can withdraw it at any time in Settings → Health → Data Access & Devices. These figures are never used for advertising, marketing or profiling, and are never sold or shared with anyone. They are not put in iCloud by Wollie — though, like any app's data, whatever sits on the phone is included in an iPhone backup if you have iCloud Backup switched on, which is Apple's setting and not mine. Where they are kept depends on which shape you are running: with a box, on the box, alongside the rest of your data; without one, on the phone, and nowhere else until you ask about them.

What the app keeps on your phone

In the iOS keychain: the address of whatever answers you, and the credential for it — the token that pairs your phone to your box, or the token the gateway issued you, or the Anthropic key you supplied; without a box, also your CoinGecko Demo key, if you saved one. With a box, also the key the phone signs its requests with, made on the phone and never sent anywhere, and the public half of the box's own key, which the phone uses to recognise its box (see below). Alongside it: your own display preferences, and a cached copy of the recent conversation so the app opens instantly.

With a box, and only if you turn on Keep the chat on this phone in the Me tab: a copy of your whole conversation with Wollie, so you can search it and read it without reaching the box. The box stays the original: whatever is deleted there goes from the phone too, the next time it reaches the box. Photos and files stay on the box. The copy sits in a part of the phone that iOS leaves out of its backups, and turning the switch off deletes it.

If you turn on recall by meaning in the app's memory screen, the phone also downloads a small language model (about 130 MB) from Hugging Face, a public model repository — a plain fetch of two public files, checked against a fingerprint fixed in the app, carrying nothing of yours — and keeps, beside each thing it remembers, a list of numbers derived from its text, so it can find it by what it means. Both stay on the phone; the model never talks to anyone. “Remove the model” on that screen deletes the files and the numbers.

Without a box, the phone is also where your own entries live — what you logged in the diet, your projects, the documents you kept, your Portfolio with its accounts, the wallet addresses in them and the balance it had hour by hour — because there is nowhere else for them to be. Deleting the app deletes that. Keychain entries are the one thing that can outlive a delete on iOS, depending on the version and on whether the phone was restored from a backup, so if you want to be certain, clear the keys in the app before removing it.

“Unpair this device” removes the token from your box. The gateway is less tidy than that, and the honest thing is to lay it out rather than use one word for all of it:

• Revoking your token stops it working immediately. It leaves everything else: the row itself (its id, the phone-model label, the dates) and the running count of what it used.
• Deleting the row removes that record.
• A short usage trace outlives both: how much your token spent today, and when it was last seen. Deleting your row now takes that with it.
• The transcripts described above are not filed under your name — the server has no index from a person to their conversations, and building one would mean knowing more about you, not less. They go on their own clock: seven days after a conversation's last message, or sooner when the server restarts.
• Alongside each one the server keeps a fingerprint used to recognise a conversation it has seen before. That part is hashes, not text. Stored beside it are the instructions the app sends with every question — the app's own preamble and your language setting, not anything you typed. Both go on the same seven days.

Ask, and your token is revoked and your row and its usage trace removed — by hand, there is no self-service button. Conversations are the one thing that cannot be picked out for one person, so those go by the clock above. Saying otherwise would be the easiest lie on this page, and if any of it changes, it changes here first.

What the app asks your phone for

Besides Apple Health, the app asks iOS for five things, each only when you first use the feature that needs it, and each refusable:

• Calendar — so Wollie can answer about your day. It reads events from every calendar account on the phone, because that is how iOS exposes them: iCloud, Google, Exchange, any CalDAV account you added in Settings. An event only leaves the phone when it is part of an answer you asked for.
• Microphone and speech recognition — for the hold-to-talk button. Where the words are made depends on your phone and on a setting in the app: on-device recognition when it is available, otherwise the audio goes to Apple's speech service, the same one the system keyboard's dictation uses. The app tells you which of the two is happening.
• Notifications — asked as soon as the phone is paired with a box, so the box can ring it. Refusing them only means Wollie's messages wait in the app until you open it.
• Camera and photo library — only when you attach a photo or scan a document, and only for the file you pick.
• Location — for two things, and only while the app is open. During setup, iOS requires it before an app may join your box's own Wi-Fi network; nothing is read then. And, only if you turn on "Share where I am" in the app's Me tab (it is off unless you do): the area you are in, snapped to a grid of about a kilometre — a town, never an address — so Wollie can answer "what's the weather here?" or "what's nearby?". The card under the switch shows exactly what Wollie is told. The town's name comes from your phone's own geocoding service (Apple's, on an iPhone), which is asked about that one-kilometre cell, not about your exact position. With a box, the area travels with your messages to the box, which passes it to Claude when it is news — a new conversation, or a different area — as part of that question. No separate record of where you were is written; but what Wollie was told becomes part of that conversation, and is kept and re-read with it like anything else you said, until you clear it. Without a box, the phone reads it only when a question needs it, and the answer becomes part of the conversation in the same way. It goes into Wollie's memories only if you ask, and turning the switch off forgets the last position at once.

How the phone and the box talk

This is the part of the arrangement most likely to be misunderstood, so it gets its own section, with the weak points in it.

• Away from home, the app reaches the box through Tailscale: encrypted end to end, with a real certificate on the box's own name.
• At home, the app talks to the box over your home network in plain HTTP, without encryption. Since the app's build 147 and the box image 0.6.0, every request is signed with a key that is made on the phone and never leaves it; the box keeps only the public half. So someone else on your Wi-Fi can no longer act as you towards the box, nor repeat a request that changes something, and the phone's old access code is refused from its first signed request on. The signature also names the address it was meant for, and the box refuses one meant for somebody else's.
• What that does not do: hide the conversation. On plain HTTP, someone on the same network who sets out to capture its traffic can read what passes between the app and the box. If Tailscale is on on the phone, the app uses the encrypted route at home too, after the box has proved, with a key of its own, that it is your box. If you share your Wi-Fi with people you don't trust, turn Tailscale on.
• The moment of pairing happens over the home network, and the phone trusts the first box that answers its code. Pair while nobody you don't trust is on your network.
• A file you send from the phone is not covered by the signature byte by byte: someone actively in the middle of your home network could swap it on the way.
• The web console asks for your password over that same plain connection at home. Through Tailscale it is encrypted.
• On the box itself, your data and its credentials are stored unencrypted on its card (or on the disk you gave it). Whoever takes the card out can read it.
• A phone still on a build older than 147 keeps using the old access code until it updates; once it has, going back to an older build would leave it unpaired.

Everyone in the household

A Wollie box can serve several people, each with their own data and their own permissions. Whoever set the box up administers it and can see that other members exist, what they are allowed to do, and anything explicitly shared with them — they cannot read another member's private conversations or mail. If a child uses Wollie, the same applies, and the adult who set the box up is responsible for what it is allowed to do.

Changes

If what leaves your house ever changes, this page changes with it and the date below moves. The image you flash and the flashing tool are published in this repository; the application source is not open at the moment, so most of what this page describes you cannot yet check for yourself. That is a reason to hold these statements to a higher standard, not a lower one — if something here turns out to be wrong, say so and it gets corrected.

Contact

Questions about this page, or about something Wollie does that you don't like: open an issue.

Last updated: 3 October 2026.