Skip to main content
OCTOVO
Download

Two of the five chains end on your device. Three lead out: the thinking request, the account — and the screen text, as soon as you ask something about it.

Data chains

The route your data takes

Not “we take privacy seriously”, but: five chains, station by station — who sits there, where, and what for.

  • 2 chains end on your device
  • 3 lead beyond it
  • 6 service providers, all named
Privacy policy Who is involved
Rand deines Geräts 1 2 3 4 5

The vertical line is the edge of your device. Two of the five paths end before it, three lead beyond it.

In five sentences

Marked red means: this chain leaves your device. That is not a warning, it’s a statement.

  1. The local chain: Everything OCTOVO knows about you sits on your device. This chain has no end outside it.

    stays on the device

  2. The thinking chain: For OCTOVO to understand or write, an excerpt goes out — never your whole mailbox, never your memory as one piece.

    leaves the device

  3. The account chain: Who you are and what you have booked — nothing more travels on this chain.

    leaves the device

  4. The mail chain: Between your mailbox and your device stands nobody — not even us.

    stays on the device

  5. The screen chain: Off by default. Switched on, text is created on your device — an excerpt only leaves when you ask something about it.

    leaves the device

To the diagram with every single station

Station by station

The five chains in detail

Every station names provider, place and purpose. What is expressly not travelling is listed below it.

The local chain stays on the device

Everything OCTOVO knows about you sits on your device. This chain has no end outside it.

The stations

  1. Your sources

    Emails, files, contacts, appointments, corrections — only what you give it or allow it.

    Who
    you
    Where
    your device
    What arrives
    What you give it or allow it: emails, files, contacts, appointments, corrections.
    What is stored
    Nothing here — this station is the start of the chain, not its store.

  2. Encrypted file

    A single file (SQLite with SQLCipher). The key lives in your operating system’s keychain — not with us.

    Who
    OCTOVO
    Where
    your device
    What arrives
    Everything before it, written into a single file.
    What is stored
    Exactly that file on your own disk, encrypted. The key lives in your operating system’s keychain — not with us.

  3. Searching and remembering

    Full-text and meaning search run with a model that installs alongside — no network, no quota.

    Who
    OCTOVO
    Where
    your device
    What arrives
    Your search query. It does not leave the program.
    What is stored
    The search index, in the same encrypted file. No network, no quota.

  4. End of the chain

    There is no fourth station. Viewing, exporting, deleting is your decision.

    Who
    —
    Where
    your device
    What arrives
    Nothing more — there is no fourth station.
    What is stored
    Whatever you keep. Viewing, exporting, deleting is your decision.
?

What expressly does not happen here

  • No copy with us, no third-party cloud, no remote access — technically not provided for.
  • Credentials live in the keychain only: never in the database, the log or the model context.
  • The flip side: if you lose device and backup, we cannot restore anything either.

The thinking chain leaves the device

For OCTOVO to understand or write, an excerpt goes out — never your whole mailbox, never your memory as one piece.

The stations

  1. Building the excerpt

    For a single question: the matter, the contact, the fitting memories. Nothing more.

    Who
    OCTOVO
    Where
    your device
    What arrives
    Your question and the matter it concerns.
    What is stored
    On your device, the log entry for it — which also records which excerpt was needed.

  2. Otto server

    Checks licence, quota and spending limit, passes it through. No content is stored — only time, account, model, character count, duration, status code.

    Who
    TCB GmbH
    Where
    Germany (Hetzner)
    What arrives
    The excerpt and the identifier of your account.
    What is stored
    No content. Only time, account, model used, character count, duration and status code — for billing and operations.

  3. Gateway

    Forwards the request to the language model. A data processing agreement is in place.

    Who
    nixo
    Where
    European Union
    What arrives
    The same excerpt, passed on unchanged.
    What is stored
    We file nothing there; the data processing agreement governs this station.

  4. Language model

    Answers the question. For Anthropic the transfer is secured through standard contractual clauses and non-storage has been requested. If Anthropic does not answer, the same request goes to DeepSeek in China; the basis for that transfer has not yet been finally determined (see the privacy policy, section 6).

    Who
    Anthropic PBC — DeepSeek in the fallback case
    Where
    USA — China in the fallback case
    What arrives
    The excerpt and the question about it — the model gets no more than that.
    What is stored
    Non-storage has been requested from Anthropic; the transfer is safeguarded by standard contractual clauses. In the fallback case this station is DeepSeek in China — what applies there is set out in section 6 of the privacy policy.

  5. Back to you

    The answer lands back here. Whatever is meant to go out sits in your approval queue first.

    Who
    OCTOVO
    Where
    your device
    What arrives
    The answer — and nothing else.
    What is stored
    Whatever you approve. Until then the draft sits in your approval queue, on your device.
Gerät Server nixo Modell die Antwort zurück nur der Ausschnitt

Only the excerpt goes from the device via server and nixo to the model. The answer comes back the same way.

What expressly does not happen here

  • No cache, no log with content, no error message with content.
  • Only in diagnostic mode, switched on by you, is anything recorded — 7 days at most, deletable at once.
  • You are the controller, we are the processor — the contract is concluded with the purchase.

The account chain leaves the device

Who you are and what you have booked — nothing more travels on this chain.

The stations

  1. Sign-up

    Name, email address, device name, public half of a key pair.

    Who
    you
    Where
    your device
    What arrives
    Name, email address, device name, public half of a key pair.
    What is stored
    Your password only as a non-reversible hash (Argon2id) — never in plain text.

  2. Account database

    Account, licence, devices, counters, invoice references. No content.

    Who
    TCB GmbH
    Where
    Germany (Hetzner)
    What arrives
    Account, licence, devices, counters, invoice references.
    What is stored
    Exactly that — plus the record of which terms you agreed to and when. No content.

  3. Payment

    Purchase, cancellation, invoice, VAT. Card details never reach our servers.

    Who
    Stripe Payments Europe, Ltd.
    Where
    Ireland / USA
    What arrives
    What you enter at Stripe. Card details never reach our servers.
    What is stored
    With us: name, billing address, payment status, invoice number. Invoices stay ten years because tax law requires it.

  4. Account emails

    Confirmations, invoices and security notices to your email address.

    Who
    Mailgun (EU region)
    Where
    European Union
    What arrives
    Your email address and the text of the message in question.
    What is stored
    Only whether and when a mail went out. No open tracking, no click tracking.

What expressly does not happen here

  • No analytics, no ad network, no error-collection service, no third-party fonts.
  • Accounts are not linked to each other and not analysed.
  • Delete your account and everything goes — except what commercial and tax law requires.

The mail chain stays on the device

Between your mailbox and your device stands nobody — not even us.

The stations

  1. Your device

    Establishes the connection itself — via IMAP/SMTP or your provider’s interface.

    Who
    OCTOVO
    Where
    your device
    What arrives
    The credentials you enter during setup.
    What is stored
    They live in your operating system’s keychain: never in the database, never in the log, never in the model context.

  2. Your mailbox

    Fetching, keeping folders tidy, sending. The credentials stay in the keychain.

    Who
    your mail provider
    Where
    wherever your mailbox happens to be
    What arrives
    The requests from your device: fetch, keep folders tidy, send.
    What is stored
    Whatever your provider keeps anyway. We see none of it — their terms apply.
rastet ein

The access clicks into the mailbox.

What expressly does not happen here

  • No detour through our server: we see neither sender nor subject nor content of your mail.
  • If it is to understand or answer an email, the necessary excerpt goes via the thinking chain — same rules.
  • Your provider’s terms apply to your mailbox; your account there stays yours.

The screen chain leaves the device

Off by default. Switched on, text is created on your device — an excerpt only leaves when you ask something about it.

The stations

  1. Capture

    An image of the screen in working memory. The block list applies first.

    Who
    OCTOVO
    Where
    your device
    What arrives
    An image of the screen, in working memory only.
    What is stored
    Nothing: the image is discarded once it has been read out.

  2. Block list

    Password managers, banking and login pages, private windows are never read in the first place.

    Who
    OCTOVO
    Where
    your device
    What arrives
    The captured image, before anything of it is read.
    What is stored
    Nothing: blocked areas are never read in the first place.

  3. Reading out text

    Text recognition runs offline. Text is stored, no image.

    Who
    OCTOVO
    Where
    your device
    What arrives
    The areas of the image that are not blocked.
    What is stored
    Text, no image. Text recognition runs on your device, without a network.

  4. Defusing and filing

    Card numbers, IBANs, keys and codes are thrown out first. The rest expires automatically — after 7 days by default.

    Who
    OCTOVO
    Where
    your device
    What arrives
    The text that was read out.
    What is stored
    It — minus card numbers, IBANs, keys and codes, in the same encrypted file, for seven days by default.

  5. When you ask about it

    Then the excerpt travels the same route as in the thinking chain — this is where screen content leaves your device.

    Who
    TCB GmbH → nixo → Anthropic PBC
    Where
    Germany → EU → USA
    What arrives
    The excerpt for your question — no image, no video.
    What is stored
    The same as in the thinking chain: with us only the figures about the request, no content.
7 Tage nie gelesen

What it reads expires after seven days. The password manager it never reads.

What expressly does not happen here

  • No video, no images to the model — only read-out text, only the excerpt for the question.
  • What arises from screen content requires approval — even on autopilot.
  • On a work device, watching is not permitted without a works agreement (§ 87 Abs. 1 Nr. 6 BetrVG). In professions bound to secrecy (§ 203 StGB) it is locked and has to be unlocked individually.
  • “Forget the last hour” deletes immediately — what was read as well as its search index.

The binding version: the privacy policy

The model question

The standard is Anthropic — the fallback sits in China.

Who does the thinking for you is set in our server’s configuration, not in a brochure. So here are both models, with name, provider and location.

In normal operation

Claude Sonnet 5

Provider
Anthropic PBC
Based in
USA
Basis
Standard contractual clauses; non-storage has been requested.

When Anthropic does not answer

DeepSeek V4 Pro

Provider
DeepSeek
Based in
China
Basis
A country outside the EU. What applies legally is set out in the binding texts, not on this page.
When the fallback takes over
Only when Anthropic cannot be reached. The fallback deliberately sits with a different provider: if Anthropic is down, a second Anthropic model is no help.
What is transmitted then
The same excerpt as always — the matter, the contact, the fitting memories. Never your whole mailbox, never your memory as one piece.
What changes about the route
Nothing at the earlier stations: the excerpt still travels via our server in Germany and the gateway in the EU. Only the last station is a different one.

This page explains the facts in everyday language. What is binding is what the legal texts say.

Privacy policy Who is involved The short answer to “Does my data go to China?”

By name

Five service providers, every one of them named.

No “selected partners”, no blanket wording: anyone processing data on behalf of TCB GmbH is listed here with purpose, place and basis.

  • nixo (Gateway)

    Forwarding the thinking requests to the language models

    Where
    European Union
    Basis
    Data processing agreement

  • Anthropic PBC

    Operation of the language models (Claude)

    Where
    USA
    Basis
    Standard contractual clauses, non-storage requested

  • DeepSeek

    Fallback model (DeepSeek V4 Pro): answering a thinking request only when the default model from Anthropic does not respond. What is transmitted is the same excerpt as always — the matter, the contact, the fitting memories; never the entire mailbox, never the memory as one piece.

    Where
    China
    Basis
    Third country without an adequacy decision (Art. 45 DSGVO does not apply to China). The basis for the transfer under Chapter V DSGVO has not yet been finally determined; it will be established by a lawyer before the sales launch and entered here. We state this openly rather than assert a basis we cannot evidence.

  • Hetzner Online GmbH

    Hosting of server and website

    Where
    Germany
    Basis
    Data processing agreement

  • Stripe Payments Europe, Ltd.

    Payment processing, invoices, tax calculation

    Where
    Ireland / USA
    Basis
    Acting on its own responsibility, supplemented by standard contractual clauses

  • Mailgun Technologies (EU region)

    Sending account and system emails

    Where
    European Union
    Basis
    Data processing agreement

The complete list with every detail

Without us

Connections your device makes itself

These parties do not work on our behalf: there is no contractual relationship, they do not act on our instructions, and the connection arises on your device without us learning of it.

  • Open-Meteo

    Weather forecast for the “Today” board and the “wetter” tool

    Where: Germany and Switzerland

    No contractual relationship: what is transmitted is solely the place name you entered yourself, or its coordinates — no account, no key, no identifier. The request runs directly from your device, your IP address is visible to Open-Meteo; at most four times per hour. Without a place entered, no request takes place.

  • The provider of your mailbox

    Fetching and sending your mail, and finding the right settings during setup

    Where: wherever your provider is located

    No contractual relationship between us and it: your device talks directly to the mail server, the credentials sit in your operating system’s keychain. Your provider’s terms apply.

  • The platforms of your connected channels

    Cloud storage, Facebook pages, Instagram business accounts, LinkedIn and the other networks

    Where: depending on the platform

    No contractual relationship between us and them: you connect your own account, your device talks directly to the platform. Their terms and privacy notices apply.

  • Tavily (AlphaAI Technologies Inc.)

    Web search — only if you have stored your own access under Settings → “Web search” and chosen Tavily. What is transmitted is your search query in plain text and your key.

    Where: New York, USA

    No contractual relationship between us and it: you open the account yourself, the request runs from your device, your IP address is visible to Tavily. Third country without an adequacy decision; according to its own privacy policy Tavily bases transfers on standard contractual clauses and is not certified under the EU-US Data Privacy Framework (checked on 22 August 2026). Without stored access, no request takes place.

  • Brave Search (Brave Software, Inc.)

    Web search — only if you have stored your own access under Settings → “Web search” and chosen Brave. What is transmitted is your search query in plain text and your key.

    Where: San Francisco, USA

    No contractual relationship between us and it: you open the account yourself, the request runs from your device, your IP address is visible to Brave. Third country without an adequacy decision; under its own data processing agreement Brave bases transfers on standard contractual clauses and is not certified under the EU-US Data Privacy Framework (checked on 22 August 2026). A representative in the Union under Art. 27 DSGVO has been designated. Without stored access, no request takes place.

  • Google News (Google Ireland Limited)

    News feed (RSS) for questions about news and for a “News” board tile you created yourself. What is transmitted is your search query in plain text as part of the address.

    Where: Ireland (Dublin)

    No contractual relationship between us and it, no account and no key: the feed is public, the request runs from your device, your IP address is visible to Google. This route is the only one of the three that can run without any action on your part — it needs no stored access and is used when you ask about news or have created a “News” tile. According to Google’s privacy policy, the controller for users in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4.

  • GitHub (GitHub, Inc. / GitHub B.V.)

    Looking at the issues, pull requests and workflow runs of a repository when you ask for it. What is transmitted is the repository name as part of the address — and, if you have stored your own GitHub access token under Settings, that token. OCTOVO only reads there; nothing is written.

    Where: San Francisco, USA / Amsterdam, Netherlands

    No contractual relationship between us and it: the request runs from your device, your IP address is visible to GitHub. Public repositories need no token — so this route runs without any setup, but only when you ask for it; nothing happens here on its own. According to GitHub’s own privacy statement the controller is GitHub, Inc. (88 Colin P. Kelly Jr. St., San Francisco) or GitHub B.V. (Prins Bernhardplein 200, 1097 JB Amsterdam). GitHub is certified under the EU-U.S. Data Privacy Framework (entry “GitHub”, Non-HR Data, checked on 23 August 2026) and additionally bases transfers on the Commission’s standard contractual clauses (Implementing Decision 2021/914). No separate representative under Art. 27 GDPR is designated; GitHub B.V. constitutes an establishment in the Union.

  • Pages OCTOVO looks up for you

    Research on the web when you ask it to — and opening the best hits of a search

    Where: wherever the respective page is located

    No contractual relationship: the request goes out from your device and looks to the other side like a visit with your browser. The operator of the page sees your IP address and the address requested.

How this is classified legally

No sugar-coating

The sentence we don’t leave out

Screen watching is this program’s biggest intrusion. Off by default; switched on, the read text stays here until you ask something about it. Whoever keeps quiet about this chain is selling you calm instead of truth.

What we protect against
Text from outside is data to the model, never an instruction. Anything that comes of it goes to approval — even on autopilot.
What we give up for it
Our support sees timestamp and error code, nothing else. No restore through us, no usage statistics.
When something goes wrong
A stolen computer gives nothing away: encrypted database, key tied to your login. If we are broken into, there is no content to find.
What you decide
Watching on or off, retention 1–90 days, blocked areas — and the emergency stop.

The honest answers, all on one page

For reference

The binding versions

This page explains. Legally, what counts is what these texts say.