On your device
Memory, file content, the local inbox copy and logs live in an encrypted file. Credentials belong in the operating system’s keychain.
Security
Trust needs
clarity.
Your device is the starting point. For some tasks, excerpts leave it. Here you can see the paths your data takes.
For your request
For OCTOVO to understand content or write text, required excerpts may pass through our server and the gateway to the model provider.
Data paths in detail
What stays. What travels.
Open a path to read about its stages, participants and limits. The linked legal documents contain the binding details.
The local chain
Everything OCTOVO knows about you sits on your device. This chain has no end outside it.
Your sources
you · your device
Emails, files, contacts, appointments, corrections — only what you give it or allow it.
Encrypted file
OCTOVO · your device
A single file (SQLite with SQLCipher). The key lives in your operating system’s keychain — not with us.
Searching and remembering
OCTOVO · your device
Full-text and meaning search run with a model that installs alongside — no network, no quota.
End of the chain
— · your device
There is no fourth station. Viewing, exporting, deleting is your decision.
The limits of this path
- No copy with us, no third-party cloud, no remote access — technically not provided for.
- Credentials live in the keychain only: never in the database, the log or the model context.
- The flip side: if you lose device and backup, we cannot restore anything either.
The thinking chain
For OCTOVO to understand or write, an excerpt goes out — never your whole mailbox, never your memory as one piece.
Building the excerpt
OCTOVO · your device
For a single question: the matter, the contact, the fitting memories. Nothing more.
Otto server
TCB GmbH · Germany (Hetzner)
Checks licence, quota and spending limit, passes it through. No content is stored — only time, account, model, character count, duration, status code.
Language model
Microsoft (Azure AI Foundry) — model by OpenAI, GPT-5.6 Luna in the fallback case · Azure resource in the EU (Sweden Central); processing itself not restricted to the EU
Microsoft operates the approved OpenAI models on its own Azure infrastructure and answers the question; according to Microsoft’s own documentation, OpenAI itself has no access to it. GPT-5.6 Terra is the immutable default; if that attempt fails, OCTOVO tries GPT-5.6 Luna once. Unlisted providers and model identifiers are rejected before transport.
Back to you
OCTOVO · your device
The answer lands back here. Whatever is meant to go out sits in your approval queue first.
The limits of this path
- No cache, no log with content, no error message with content.
- Only in diagnostic mode, switched on by you, is anything recorded — 7 days at most, deletable at once.
- You are the controller, we are the processor — the contract is concluded with the purchase.
The account chain
Who you are and what you have booked — nothing more travels on this chain.
Sign-up
you · your device
Name, email address, device name, public half of a key pair.
Account database
TCB GmbH · Germany (Hetzner)
Account, licence, devices, counters, invoice references. No content.
Payment
Stripe Payments Europe, Ltd. · Ireland / USA
Purchase, cancellation, invoice, VAT. Card details never reach our servers.
Account emails
Mailgun (EU region) · European Union
Confirmations, invoices and security notices to your email address.
The limits of this path
- No analytics, no ad network, no error-collection service, no third-party fonts.
- Accounts are not linked to each other and not analysed.
- Delete your account and everything goes — except what commercial and tax law requires.
The mail chain
Between your mailbox and your device stands nobody — not even us.
Your device
OCTOVO · your device
Establishes the connection itself — via IMAP/SMTP or your provider’s interface.
Your mailbox
your mail provider · wherever your mailbox happens to be
Fetching, keeping folders tidy, sending. The credentials stay in the keychain.
The limits of this path
- No detour through our server: we see neither sender nor subject nor content of your mail.
- If it is to understand or answer an email, the necessary excerpt goes via the thinking chain — same rules.
- Your provider’s terms apply to your mailbox; your account there stays yours.
The calendar chain
Between your calendar and your device stands nobody — not even us.
Your device
OCTOVO · your device
Establishes the connection itself — via CalDAV or your provider’s interface, with a password or with an access key from a separate sign-in, whichever the provider requires.
Your calendar
your calendar provider · wherever your calendar happens to be
Reading, creating, changing and cancelling appointments. With providers that use an access key, the refresh key lives in your operating system’s keychain and travels nowhere.
The limits of this path
- No detour through our server: we see neither your appointments nor their participants nor the name of your calendar.
- If it is to understand or propose an appointment, the necessary excerpt goes via the thinking chain — same rules.
- Signing in with Google or Microsoft happens in your browser; the way back ends on your device, not with us. OCTOVO never sees a password in the process.
The screen chain
Off by default. Switched on, text is created on your device — an excerpt only leaves when you ask something about it.
Capture
OCTOVO · your device
An image of the screen in working memory. The block list applies first.
Block list
OCTOVO · your device
Password managers, banking and login pages, private windows are never read in the first place.
Reading out text
OCTOVO · your device
Text recognition runs on your device. The very first time it fetches its language data from the network and needs internet once for that; never again after. Text is stored, the image is discarded.
Defusing and filing
OCTOVO · your device
Card numbers, IBANs, keys and codes are thrown out first. The rest expires automatically — after 7 days by default.
When you ask about it
TCB GmbH → Microsoft (Azure AI Foundry) · Germany → EU resource (processing itself may occur worldwide)
Then the excerpt travels the same route as in the thinking chain — this is where screen content leaves your device.
The limits of this path
- No video and no continuous image: from watching, only the read-out text goes out, only the excerpt for the question.
- If you ask “what am I looking at right now?”, it is the other way round — then an image of every screen goes to the model so it really sees what you are pointing at. That never happens by itself, you are asked once for permission, and you see every image small in the conversation. You can take it back under Settings → Screen.
- What arises from screen content requires approval — even on autopilot.
- On a work device, watching is not permitted without a works agreement (§ 87 Abs. 1 Nr. 6 BetrVG). In professions bound to secrecy (§ 203 StGB) it is locked and has to be unlocked individually.
- “Forget the last hour” deletes immediately — what was read as well as its search index.
The location chain
Off by default. Switched on, your iPhone takes one rough measurement of where it is — the point itself stays between your phone and your device, only a place name goes out.
Measurement
your iPhone · your phone
Only the rough level: Apple puts it at one to twenty kilometres. OCTOVO does not even ask for more, and your phone only asks when someone here is waiting.
Way to your device
TCB GmbH · Germany
The same encrypted wire as for every other message from your phone. Our server is a blind letterbox in this: it sees length and time, no content.
Translating and rounding
OCTOVO · your device
The point becomes a place name using the bundled postcode table. The point is rounded to about one kilometre and sits in working memory only — not in the database.
What goes out from it
Open-Meteo · EU (Germany/Switzerland)
For the weather the place name goes out — exactly the one that would sit in your profile without location, at most four times an hour. Travel time OCTOVO calculates entirely on the device and asks nobody for it.
The limits of this path
- No coordinate leaves your device. What goes out is a place name — and no more went out before either.
- No history: a single slot in working memory, overwritten and gone after a restart. Switching off deletes it at once.
- No measurement in advance and none in the background: your phone only asks its operating system when someone here is waiting for a place right now.
- Nothing on the computer itself: the built-in route of the application framework would send the Wi-Fi networks around you to a map service in the USA. It is not used.
Your approvals
Support you control.
You choose the connected content and set how independently OCTOVO works. Approvals follow this level of autonomy; sensitive actions require your consent.
Choose connections
You decide which connected content OCTOVO may work with.
Set autonomy
You choose the level of independence. Action approvals depend on that setting.
Approve sensitive actions
Sensitive actions need your consent. Read the proposed step before deciding.
Security
Screen observation is off by default.
If you turn it on, screen text is initially processed on your device. When you ask about it, a relevant excerpt may travel to the model provider. This is a separate data path, not a fully local feature.
Feature in detailFurther reading
Privacy policy
The product overview explains the workflow. These documents provide details about processing, participants and contractual terms.
The next step
Fits into your day. Starts with a conversation.
Tell us what gets in your way. Together, we can explore how OCTOVO could help.
Start a conversation