Data and privacy

This page explains what Headmaster stores, where it lives, who can see it, and what leaves your device when you chat. It also covers how to keep sensitive work safe and how to remove your data.

The short version

• Your account, your Cloud chats and your memory belong to your account. Other accounts cannot see them.
• Work mode runs on your own PC. Your local files and terminal stay there.
• Whatever goes into a chat is sent to the model you picked, so that it can answer.
• Keys you save are stored encrypted and are never shown in full again.
• You choose how much the agent can do without asking. The default is Manual, which asks first.

What is stored where

Data	Where it lives	Who can see it
Account details (email, name)	Your Headmaster account	You, and us when we support you
Cloud chats, and files the Cloud agent creates	Your own hosted Cloud workspace	Only your account
Memory	Your account. One memory bank, shared by Cloud, Work and web chat	Only your account
Work mode files, terminal and local previews	Your PC, in the folders you work in	Only you, on that PC
Provider keys saved to your account	Encrypted, tied to your account	Never shown in full again
Work mode sign-ins and keys	On the PC where you entered them	Only that PC
Local model server details and messaging app tokens	The device where you entered them	Only that device
Desktop app settings (theme, sounds, tray)	The PC you set them on	Only that PC

Cloud workspace

When your account is approved for Cloud, Headmaster sets up a private workspace for you. Your Cloud agent runs there. It keeps your Cloud chats, the files the agent writes while it works, and your scheduled tasks. It is separate from every other account's workspace.

Cloud mode cannot see the files or terminal on your PC. If you need the agent to work with local files, use Work mode. See Cloud and Work modes.

Work mode on your PC

Work mode runs a local engine on your computer. The agent reads and edits files and runs commands there, inside the folder you choose, under your approval settings. Settings shown under Work Mode and This computer in the desktop app apply only to that PC.

Work mode keeps its own model sign-ins. Connecting ChatGPT in Work mode does not connect it in Cloud, and the other way round.

Memory

You have one memory for your account. Cloud mode, Work mode and web chat all read from and save to it, so a preference you share in one place is available in the others. Saving happens in the background, so a new memory can take a short while to show up elsewhere.

Memory is private to your account. When you search memory, results come only from your own memory. To browse it, open Memory in the desktop app while in Cloud mode. See Memory for the details.

What is sent to model providers

To answer you, the model has to see the conversation. When you send a message, Headmaster sends the model:

• your message and the earlier messages in that chat,
• relevant memories it recalled for you,
• any files, images or tool results the agent includes,
• the instructions that tell the model how to behave as Headmaster.

Where that goes depends on the model you picked:

Model	Where your messages go
Headmaster Lite or Headmaster Pro	Our model service, which passes them to the model that powers that tier
Your ChatGPT or Claude sign-in	That provider, under your account with them and their terms
Your own API key	That provider, under their terms
A local model server	The server you configured, often on your own machine

If you do not want something to reach a provider, do not paste it into the chat and do not point the agent at it.

Some providers refuse to route requests under certain account privacy settings. If that happens, Headmaster shows This model is blocked by your account settings. Choose another model or change the setting with your provider.

Keys and sign-ins

• Keys you save are encrypted before they are stored. After you save one, Headmaster never shows it in full again.
• If a saved key can no longer be read, the model shows Re-enter your key. Open Settings → Providers and replace it.
• To stop using a key, remove it from Settings → Providers. You can also revoke it in your provider's own dashboard, which is the surest way to cut it off.
• Headmaster never needs your provider password. Sign-ins with ChatGPT or Claude happen on the provider's own page.

Approvals: keeping the agent in check

The agent can act, not only talk. Approvals decide when it must ask you first.

Mode	What happens
Manual (default)	Asks before actions that require approval
Smart	Assesses each action and asks when needed
Off	Runs without approval prompts

In Cloud mode, actions run in your Cloud workspace, never on your PC. In Work mode, actions run on your PC. Keep Manual for anything sensitive, especially in Work mode. See Approvals and safety.

Good habits for sensitive work

• Use Work mode for private files. They stay on your PC. Only the parts the agent reads into the chat go to the model.
• Point Work mode at a dedicated folder. Choose a project folder, not your whole home folder.
• Keep approvals on Manual when the agent touches anything you care about.
• Do not paste secrets into chats. Save keys in Settings → Providers instead, where they are encrypted.
• Review connections. MCP servers and messaging apps you connect can see what the agent sends them. Only connect ones you trust. See Connections and MCP servers.
• Sign out on shared computers.

Diagnostics and support

Headmaster does not upload your logs on its own. When you ask for help, you can use Copy diagnostics where it is offered. It copies a report to your clipboard. Nothing is sent until you paste it somewhere yourself.

The report includes system details and which providers have keys configured, never the keys. It also includes the local desktop log, which can contain parts of conversations, tool output and file paths. Secrets are redacted before copying. Read it before you share it.

Deleting your data

What	How
One chat	Delete it from the chat list. See Conversations
A memory	Ask the agent to forget it. See Memory
A saved key	Remove it in Settings → Providers
The desktop app	Settings → Version & updates → Uninstall
Your whole account	Contact us

Uninstalling the desktop app

The uninstall screen lets you choose how much to remove:

• Uninstall Chat GUI only removes the desktop app. The local agent, your config and chats stay.
• Uninstall GUI + agent, keep my data removes the app and the local agent but keeps config, chats and secrets for a future reinstall.
• Uninstall everything removes the app, the agent and all local data: config, chats, scheduled jobs, secrets and logs. This cannot be undone.

Uninstalling only affects your PC. Your account, Cloud workspace and memory are not touched.

Deleting your account

Contact us from the email on your account. Deleting your account removes your Cloud workspace and your memory. Data that lives only on your PC is not reachable by us, so remove it with Uninstall everything.

See also the Privacy policy and Terms.