Privacy draft
Draft for review. Not legal advice. Sign this off before a public ship.
What this app reads
AIOS Agent is a localhost Windows board. It samples CPU, memory, disk space and disk busy, process names, and chat you type on this machine. Those sensors stay in per-uid SQLite on this PC unless a billed agent turn sends a snapshot to the hosted model.
Account
Google sign-in identifies who pays. Your Firebase uid is the billing customer id. Name and email come from Google. We do not use Firestore.
Credits
Agent turns and What’s wrong hold credits on aido-billing through the hosted cloud. A failed model call does not keep the hold. Deleting the local account wipes this PC’s database; the billing wallet remains until support refunds.
Where data lives
App data is under this Windows user’s AppData at users/{uid}/app.db. Activity is also copied to aido-billing Postgres when the cloud is configured. The OpenRouter key does not sit on this PC. The board is served on localhost. Anyone who can read this user’s AppData or the WebView profile can still act as you. There is no device-key, and the local database is not encrypted.