Every AI feature tells you where it is sending your work.

Your vault, search and embeddings, recordings, and Local Whisper transcription stay local. Generative AI and optional sync have separate cloud boundaries. Interactive HTML previews can contact HTTPS services and send page data, but they cannot read sibling files or other vault content.

Assistant and voice-analysis Auto use the most recently connected or verified eligible AI provider, then OpenAI, then Anthropic, with that provider's reviewed default model. Auto never picks Wrengle AI. The clean-install Wrengle AI Fast assistant route is a concrete saved default, not Auto, and upgrades preserve their existing route. With no usable Auto route, Wrengle asks for setup instead of sending anything.

Keys are stored in the macOS keychain — never in your notes, settings, or logs. Wrengle only checks a key is there at startup; whether it actually works is not tested until you make a request.

The text-only prepaid alternative to holding a key yourself. Prompts and replies are uploaded through Wrengle to OpenAI for generation, then return through Wrengle; that content is not retained in the account ledger or application logs, while OpenAI's service handling still applies. Fast, Balanced, and Deep have published mappings, signing in includes no free credit, and the route never falls back.

If reports are enabled, the complete transcript goes to the route shown in the app in bounded contiguous shards, along with bounded meeting-note and title context — text only, never meeting audio. Long reports can make multiple sequential provider calls; on Wrengle AI they are reserved together, so a report either runs or never starts.

The note you are in, the text you selected, wider workspace context, or supported images you attach — but only what the request you made actually needs.

In Assistant and Inline Assist, external agents run as normal programs with your permissions and talk to their own providers. Plugin Builder supports only its exact reviewed Claude Code 0.70.0 route: an existing Assistant account sign-in is reused through an app-scoped secure-store identity. The reviewed runtime preserves native HOME for macOS Keychain discovery while keeping configuration and workspace state in scratch. Builder excludes ambient API keys, ADC, and service-account credentials, exposes MCP-only tools, and requires its macOS sandbox. Gemini CLI and Codex fail closed as unsupported in Builder and remain Assistant-only.

App diagnostics are on by default and switchable off in Settings. Basic cookieless analytics counts page views, leaves, and fixed download-intent, installer-click, account-intent, and pricing-action outcomes on successfully rendered, reviewed public routes unless you object. It sends canonical paths without query strings or fragments, referring origin, coarse browser, OS, and device details, and closed surface/action values plus public installer version, name, and size through t.wrengle.com to PostHog EU; it sends no page content, link destinations, labels, form values, or arbitrary interaction data and leaves no PostHog identity in browser storage. PostHog assigns cookieless sessions during ingestion when the required server-hash mode is enabled. Enhanced analytics can add Web Vitals and strictly allowlisted structural interactions only on those same routes after opt-in: metric name/value/delta/rating and interaction event type/tag/bounded sibling positions. Structural interaction text, attributes, classes, IDs, selectors, link destinations, and custom augmentation are removed. Named events separately record approved canonical navigation destinations, documentation filter usage without search text, and scroll milestones. Auth, account, callback, admin, API, error, unknown, and failed routes remain excluded from PostHog browser analytics and replay. Separate public-page replay starts automatically after a successful render on reviewed public routes while Basic analytics is allowed. Visitors with earlier saved choices must reconfirm the revised privacy notice before replay starts. Previous objections remain off. It records only successfully rendered, reviewed public routes while Basic analytics is allowed; objection, Required only, GPC, or DNT stops it. Text stays masked by default; explicitly reviewed public text and controls are readable. Inputs, editable content, attributes, account controls, reflected filter queries, and sensitive containers remain masked or blocked; replay URLs omit query strings and fragments, and network bodies and headers, console logs, and canvas content are excluded. Replay identity stays in memory, a full reload starts a new recording, and PostHog EU retains recordings for no more than 30 days. The desktop app has no replay. Public cumulative GitHub installer asset counts are imported hourly as a separate aggregate stream, including direct GitHub traffic, repeat downloads, and automated checks; they do not prove completed transfers, installations, unique people, or website attribution. A successfully rendered signed-in account dashboard can separately send a content-free visit event through an authenticated server request while Basic analytics is allowed; a Basic objection, Required only, GPC, or DNT stops this signal. The server derives an HMAC-pseudonymous account ID and deduplicates the visit; no account content or browser identity is sent. Website hashes, desktop installations, and accounts remain separate and are never joined. Both analytics lanes and replay disable Beacon and use credentialless fetch. The project must enable Cookieless server hash mode, discard IP data, and retain analytics for no more than 12 months. Diagnostics is a separate Sentry choice. Global Privacy Control, Do Not Track, a basic objection, or Required only stops every website telemetry lane.