Stays local by default
Personal memory, raw private chats, local databases, model paths, tokens, and API keys stay on the user's device unless explicitly exported.
Shared only after review
Bug reports, release checksums, hardware summaries, and lessons can go to the beta hub after redaction and user approval.
Permissions are tool-based
Camera, mic, location, watch, and file access should be requested only when the user taps that tool and understands what will be stored.
Sessions have boundaries
Stella and the phone sidekick can talk inside a user-started room. When the room ends, model-to-model chat stops.