Skip to main content
Docs

Search documentation

0 articles

    Contents

    Privacy and permissions

    Review the data and action, not only the product name. A local interface can call a hosted service when you choose a cloud-backed feature; a saved local file can also be synchronized by a separate service.

    Local files and execution​

    Ouros X notes are saved as local Markdown. Reveal the actual saved file before relying on it. A synced folder can send that file through another service, while a cloud-only file may need downloading before a local tool can read it.

    File-search folder selection determines search scope. It does not sandbox shell commands or agent tools. Those tools can change files within the permissions of their execution environment. A prompt, task brief or workflow instruction is not operating-system enforcement.

    Grant permission for the specific action​

    Grant only the macOS access needed for the feature you are using. Check which app is asking and which action caused the prompt. Do not enable unrelated permissions to fix a sign-in, provider or paid-access error.

    Hosted processing and source material​

    Hosted loop building and running use their own account access and explicit cloud-processing consent. Review the exact version and inputs. Zilch hosted extraction receives the submitted public URL; avoid addresses containing secrets or private identifiers.

    Extracted content remains untrusted input. Copying it into a note or agent request does not turn embedded instructions into your instructions. OWASP's prompt-injection guidance provides background on this risk; a warning in a prompt is not a complete defense.

    Follow the local and hosted data paths before sending sensitive material.

    Redact before sharing​

    Remove provider keys, API keys, cookies, device codes and private document text from reports. Check screenshots, URLs and request headers as well as the visible error. Retain only identifiers that are safe to disclose.

    A useful report explains what failed without including full private files. Use the support checklist for the minimum context.

    This guide explains workflow boundaries, not a retention policy or legal guarantee. Read the service's notices and consent before submitting sensitive data. Use account guidance to distinguish access problems from device permissions.