o8 is open source and local-first. Your repositories, worktrees, sessions, approvals, and memory use your Mac as the system of record; model requests leave only through the provider path you choose.
o8 stores its local state under ~/.o8. Your repositories and agent worktrees remain on your machine, and o8 does not upload a copy of your codebase to a central project cloud. The app and its operating rules are public under the MIT license, so you can inspect the implementation or run your own build.
The model route you select receives the prompts and context needed to answer the request. That can be a provider subscription or key you control, or o8’s hosted model when you invoke the install-scoped allowance or use Pro. Local repositories, installed or bring-your-own model tools, and the limited hosted allowance do not require an o8 account. On first allowance use, an install-scoped credential and the hosted request’s usage record reach o8. Account records require portable, account-backed paths such as sync, the web console, mobile relay, or Pro, while enabled coarse usage reporting follows the separate policy below. o8 does not claim a request is local when it is sent to a model provider.
Product analytics and crash reporting are two separate choices in the app. Both start off. If you enable product analytics, a strict allowlist permits coarse product events while excluding code, prompts, file contents, repository names, paths, diffs, transcripts, credentials, and personal identity. Turning crash reporting off prevents packaged builds from sending crash events.
Read the exact event policy in the telemetry and privacy document, or read the site’s privacy policy.
Each dispatched worker gets an isolated Git worktree, and every change passes through review and merge gates before it reaches your branch. Workers run as your current operating-system user by default, so they can reach what that account can reach. An optional operating-system sandbox is available for tighter execution and fails closed when enabled; it is not silently presented as the default.
Public macOS releases are signed and notarized. The in-app updater validates the replacement bundle’s code signature and Gatekeeper acceptance before it launches the new build. Windows and Linux previews publish checksums and GitHub build attestations; release AppImages also contain an embedded GPG signature. Windows publisher signing and preview update channels remain open.
Please do not open a public issue for a security vulnerability. Use GitHub’s private vulnerability report so the maintainers can investigate before details are disclosed.