Privacy Policy

Last updated 23 September 2026 (draft)

00 is a local-first Mac app. Local agents run on your machine, and their data stays there. Some features you can choose — AI credits, cloud agents, Overblast channels and the phone app — send data to our servers; this policy says which data, and why.

Who we are

00, the headless engine, the 0-0 phone app and this website are provided by Yumankind OÜ, a private limited company registered in Estonia, which is the data controller for the personal data described here:

Yumankind OÜ
Sepapaja 6, 15551 Tallinn, Estonia (Harju maakond, Lasnamäe linnaosa)
Registry code 16232402 · VAT number EE102378229
[email protected]

AI credits, cloud agents and Overblast channels are provided through Overblast, also operated by Yumankind OÜ; the Overblast privacy policy covers that service in full. The two policies refer to each other: this one covers the 00 apps, and Overblast's covers AI credits, cloud agents and channels.

We have not appointed a data protection officer, because the GDPR does not require one for our processing: we are not a public body, and our core activities involve neither large-scale regular and systematic monitoring of people nor large-scale processing of special categories of data. For any privacy question or request, email [email protected].

Local agents: what stays on your Mac

Local agents need no account. Agents you run on a local model, and their conversations, files, memory and settings, live in a folder on your Mac (~/00) or on a server you run the headless engine on. We do not receive them. 00 has no built-in tracking.

Your account

An account is needed only for AI credits, cloud agents and Overblast channels, and to use the 0-0 phone app with them. When you create one we process your name, email address and sign-in details, the workspace you belong to, your plan and credit balance, and your billing history. Payments are handled by Stripe, the Apple App Store or Google Play; we never see or store your full card details.

Prompts sent through AI credits

When an agent thinks on a workspace's AI credits (the default for new agents, instead of your own keys), the prompt, the conversation context and any files the agent includes are sent through our servers to the model model you picked: through OpenRouter, which routes it to the provider that serves that model (for example Anthropic, OpenAI, Google or xAI), or, for video generation, to fal.ai. The reply comes back the same way. We do not keep AI prompts: requests to AI models are processed to produce the answer and are not stored by us. We record only what each request cost, which model served it and when, so we can bill it and show your balance. No retention and no training: every request we send through OpenRouter requires providers that do not retain prompts or completions (zero data retention) and do not use them for training. These providers are listed, with where each one processes data, in the Overblast privacy policy.

Cloud agents

If you move an agent to the cloud, its folder — identity, memory, skills, files and conversations — is stored and run on our infrastructure so it can keep working while your Mac is off, and is synced back to your Mac when it is available. It runs in a Cloudflare container, and its saved state is kept in Cloudflare R2 storage in Western Europe. For a temporary cloud run, the bundles that carry the agent there and its work back are kept for 7 days after the run ends, so the result can still be brought home, and are then deleted.

When you bring an agent home or remove it from the cloud, its cloud copy is deleted. Deleting the workspace or your account deletes its cloud storage.

Overblast channels

Social inboxes, email, web chat and phone calls route through Overblast. Messages, comments, call transcripts and the contact details of the people who write to you pass through and are stored by Overblast so your agent can read and answer them, and are shared with the platform concerned (for example Instagram or X) to send replies. How long they are kept is set out under Keeping and deleting your data. Native channels (Signal, iMessage, WhatsApp, Telegram, Slack, Discord) connect from your own device and do not pass through us.

The 0-0 phone app and the relay

The 0-0 phone app (coming soon) lets you chat with agents on your Mac, your phone or the cloud, answer an auto-reply inbox, approve what agents want to do, and buy the Overblast Plan and AI credits.

  • Pairing with your Mac. You pair the phone with the 00 Mac app by scanning a QR code, or reach it through your account. Messages between the 0-0 app and your Mac are end-to-end encrypted when both apps are up to date: they pass through our relay sealed with keys that only your Mac and your phone hold, so we cannot read them. Every message is also signed by the device that sends it, so we cannot forge or change it. If one side runs an older version, messages are still signed end to end but not end-to-end encrypted; they are then protected by encryption in transit (TLS) and at rest in our database. The relay does see what it needs to route them — device identifiers, the pairing, timestamps and message sizes — and the push token used to notify your phone. Notifications name the agent, not the message.
  • How long the relay keeps things. Relayed messages and ended relay sessions are deleted after 30 days. Files sent through a QR pairing are deleted three days after they are uploaded, and a QR pairing whose Mac has not been seen for 90 days is forgotten.
  • On-device AI. Models you run on the phone process your prompts on the phone; those prompts are not sent to us.
  • Agents in the cloud and AI credits on the phone work as described above.
  • App analytics. The phone app uses Google Analytics for Firebase. It records app opens and sessions, time spent in the app, in-app purchases and app updates, with your device model, operating system, app version, language and approximate country, under a random app-instance ID. In the European Union, the European Economic Area, the United Kingdom and Switzerland it stays off until you agree on the consent screen the app shows; elsewhere it is on. Wherever you are, you can turn it on or off at any time in the app's settings. The phone app does not use crash reporting.
  • Permissions. Each is asked for only when you first use the feature that needs it, and you can turn it off in your phone's settings: the camera for photos and to scan the QR code that pairs the phone with your Mac; the microphone for voice messages; speech recognition (iPhone) for meeting mode, transcribed on the phone; photos to attach pictures and save the ones your agent makes; contacts, calendars and reminders so your agent can look someone up and add events and reminders when you ask; location, only while you use the app, so your agent can answer questions about where you are; the local network to reach your Mac on the same Wi-Fi; and notifications. The full list is in the Overblast privacy policy, which also covers the phone app.
  • Health (iPhone only, read-only): used only when you turn on the Health tool for an agent, so it can answer questions about your steps, sleep and workouts. It reads only the types you allow and never writes to Health. Health data reaches an AI model provider only if that agent uses a cloud model, and then under the no-retention, no-training rule above. For sensitive data such as health, we recommend a local, on-device model. Health data is never used for advertising and never sold.

Your keys and secrets

API keys and channel tokens you add in the Mac app are stored in an encrypted vault (AES-256-GCM) on your device. Agents can see that a key exists, never its value, and the vault is never transmitted to us. When you send an agent to the cloud, the keys it needs travel inside an encrypted bundle (AES-256-GCM) and are kept in the cloud agent's own encrypted vault, on our infrastructure rather than on your Mac.

Your own providers

When you connect a model provider (e.g. Anthropic, OpenAI, OpenRouter) with your own key, 00 sends the requests you initiate directly from your Mac to that provider. Those services process that data under their own privacy policies. Local models (Ollama, LM Studio, Jan) run on your machine and make no external calls.

Optional analytics & updates

The Mac app has no crash reporting and no product analytics. If it will not start, you can export a diagnostics file yourself; it stays on your Mac until you choose to send it. The app checks a small public file on our website (updates.json) to tell you when a new version is available; that request contains no personal information.

Cookies

This website (0-0.chat) stores or loads the following in your browser, and nothing else. It shows no ads and does not track you across other sites.

Strictly necessary

  • Your cookie choice: 00.cookieConsent in your browser's local storage remembers whether you accepted or declined, so we do not ask on every page.
  • Your country, for this visit: to know whether to ask, the page asks our host, Cloudflare, which country the visit comes from (/cdn-cgi/trace on our own address) and keeps the two-letter answer in session storage (00.country) until you close the browser.

Analytics, only with your consent

Google Analytics 4 (Google's web measurement for the 00 app's Firebase project) counts which pages are viewed, which downloads and install commands are chosen, your approximate region, and your device and browser type. It sets the _ga and _ga_8BVYYGZ2DH cookies, which last up to two years, and sends this to Google. It covers only your visits to this website.

If you visit from the European Union, the European Economic Area, the United Kingdom or Switzerland, or if we cannot tell where you are, a small card asks first, and the analytics script is not loaded at all until you choose Accept. Elsewhere it loads with the page. Wherever you are, you can change your choice at any time with "Cookies" at the bottom of every page (); if you decline after accepting, we remove the analytics cookies and reload the page.

Loaded from other providers

Fonts come from Google Fonts and icons from jsDelivr. These set no cookies, but like any request they reach those providers with your IP address. Our host, Cloudflare, processes the technical data of each request (such as IP address and browser) to deliver and protect the site.

Who we share data with

We do not sell your personal data. We share it only with the service providers that run the features above — hosting and storage, sign-in and notifications, payments (Stripe, Apple, Google), the model providers that serve AI-credit requests, and the social platforms you connect — or when the law requires it. These services are provided through Overblast, so the full list of those providers, with where each one processes data, is the one in the Overblast privacy policy. Where personal data is transferred outside the European Economic Area, the transfer relies on the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU-US Data Privacy Framework.

Keeping and deleting your data

We keep account data while your account is active, except for the following:

  • AI prompts: we do not keep them. Requests to AI models are processed to produce the answer and are not stored by us.
  • Messaging data (the conversations and messages in a workspace's inbox, from social DMs, email, calls and web chat): kept while the workspace exists. Archiving a conversation hides it but does not delete it, and a message deleted on a social network stays in the workspace's history, marked as deleted. When the workspace or your account is deleted, its messages are removed from our live systems straight away and from our backups within 30 days.
  • Payment records (invoices, receipts and refunds): kept for as long as tax and accounting law requires, up to 7 years, and used only for accounting, refunds and disputes.

You can delete your account and its data at any time from Settings in the 00 Mac app or the 0-0 phone app, or at overblast.app/delete-account. Local agents on your Mac are yours to delete; we never had them.

Your rights

Depending on where you live (including under the GDPR), you may have the right to access, correct, delete, restrict or object to the processing of your personal data, to data portability, and to withdraw consent. To exercise them, email [email protected]. You may also complain to your data protection authority; ours, in Estonia, is the Andmekaitse Inspektsioon (Data Protection Inspectorate).

Children

00 and the 0-0 phone app are for people aged 16 or older. We do not knowingly collect personal data from children under the age of 16, and if we learn that we have, we delete it. Buying a plan, AI credits or add-ons, or owning a workspace, requires you to be 18 (the age of majority) or to have the consent of a parent or guardian.

Changes

We may update this policy; material changes will be reflected here with a new date.

Contact

Questions? Email [email protected] or visit overblast.app/support.