Cyrano.

Network traffic

Every byte,
accounted for.

Cyrano touches a lot of your Mac: the mic, the screen, other apps. Touching is not sending. This is the complete map of what crosses the wire, drawn from the code, and the same map the app computes live under Settings, Where your data goes.

How you run it
Opt-ins, all off by default

Audio and transcript both stay on this Mac. The only traffic is an update check and a license check, and neither carries a word you said. Audio stays on this Mac. Transcript text goes to a backend you run, or straight to your own model account. Cyrano is not in the loop. Audio stays on this Mac. Transcript text transits Cyrano’s server to the model, is never logged, and is deleted when the session ends unless you keep it. Audio stays on this Mac, and so does analysis. With a remote assistant paired, live session text transits Cyrano’s server while the session runs, then is deleted within the hour. Fast transcription is on: your audio, both sides of the call, streams to ElevenLabs under your own key. That is the one way audio ever leaves. Transcript text still follows the plan you picked.

Your Mac Nothing here has a route out unless an arrow says so Mic and system audio only while a session runs On-device transcription Apple Speech · no network Transcript text in memory · on disk only if kept On-device analysis Pro · a local model, no network Analysis comes back results, whispers · text only Voice signature memory only · never saved or sent Assistant apps on this Mac Claude Desktop · Claude Code Codex · Cursor · Zed 127.0.0.1:42617 only · bearer token · text nothing off this Mac can reach it leaves your Mac Update manifest one public file · no identifiers hourly · version.json Cyrano server Cloudflare Worker · no user database trial / license check no content transcript text · TLS · never logged deleted at session end unless you keep it The model OpenAI · Cyrano’s key Your own backend or key your Worker · Anthropic · OpenRouter transcript text · your key Cyrano never receives it claude.ai · ChatGPT OAuth 2.1 · revocable text only · never audio live session text, only while it runs deleted within the hour, even if pinned past sessions: from this Mac, stored nowhere ElevenLabs your own API key · your account terms raw audio · both sides · the only path audio ever takes Your iCloud ciphertext Apple cannot read ciphertext only keys never leave Stripe checkout in your browser · no content subscription only Never: raw audio to a Cyrano server · analytics or crash SDK Contacts · Location · a port open to the internet · voiceprints
Arrows appear only in the mode or opt-in that creates them. The protocol between the app and any backend has no audio field, so no Cyrano server can receive audio even by mistake.

How an assistant reads a session

Three routes. The first never leaves the Mac. The other two go through Cyrano’s server, and this is exactly what the server holds on each.

On this Mac Free on every plan · off until you connect an app · nothing leaves Claude Desktop, Codexor any MCP client stdio cyrano-mcp helperdumb translator · no files 127.0.0.1 · bearer Cyrano appscope and mute gates reads Session in memory or disktext, never audio Remote assistant, live session Opt-in · pair with a one-time code · revoke any time claude.ai · ChatGPTOAuth 2.1 · 1 h access token asks for context Cyrano servercopy lives only while the session runs streams live text Your Mactranscribes on device Deleted at session end. Hard ceiling of one hour after, even for a pinned session. Remote assistant, past session Opt-in · your Mac answers each request itself · the server stores nothing but titles claude.ai · ChatGPTasks for one session which session? Cyrano serverrelays the reply · keeps no copy asks your Mac · 8 s timeout answers from disk Your Macre-checks consent per request Kept on the server: an index of session titles, times, and tags, for 30 days. Not the transcript.
What the assistant receives is always text, never audio. Speaker names stay on the Mac; a remote assistant sees numbered speaker slots.

The ledger

Every connection the Mac app can make, with what it carries and what is kept on the other end. If it is not on this list, the app does not do it.

ConnectionWhat crossesWhenKept on the other end
On every plan
Update checkA request for one public file. No identifiers, no cookies.Hourly, and on wake.Nothing about you.
Trial or license checkYour license key or a one-way hash of the hardware id, a random device id, this Mac’s name, the app version. No session content.Hourly on the free trial, weekly with a Pro license.A license record, so the key works on your Macs and not on someone else’s.
Apple speech modelAn OS-managed download from Apple. No content.First run, and on model updates.Nothing.
Bug reportWhat you typed, an optional reply address, and app and OS versions if you leave that switch on. The report has no field for transcripts or audio.Only when you press send.The report, until answered and pruned.
Hosted copilot only
Session socketTranscript text, one line at a time, plus the watch categories you named and your retention choice. Never audio: the protocol has no audio field.While a session runs.Deleted when the session ends. Or 24 hours, or pinned until you delete it. Never written to logs; content logging is switched off in the production build.
The modelWindows of transcript text, forwarded from Cyrano’s server on Cyrano’s key. Sessions go to OpenAI; dictation polish and day refinement go to Anthropic.As the session is analysed.Not stored by Cyrano. The provider’s own API terms apply.
Re-analyse, Ask, Polish, RefineThe text you point at: a finished transcript, a question with its context, a dictation, or one section of your day document.Only when you ask.Nothing. These routes pass through and store nothing.
BillingCheckout happens on Stripe, in your browser. Cyrano holds a subscriber id, the subscription status, and a spend meter. No card, no transcript.On subscribe, on renewal.The subscription record.
Your own key or backend only
Your Worker, or your model accountTranscript text, to a backend you run, or straight to Anthropic or OpenRouter under your key.While a session runs.Whatever your deployment and your provider keep. Cyrano is not in the loop and cannot read, disclose, or delete it.
Opt-ins, off by default
Assistant on this MacSession text over 127.0.0.1, port 42617, with a bearer token in a file only your user can read. The listener binds loopback only; nothing off this Mac can reach it.When you connect an app.Nothing leaves the Mac.
Remote assistantLive session text through Cyrano’s server while the session runs; an index of session titles, times, and tags; past sessions pulled from this Mac on demand and relayed without storage.When you pair claude.ai or ChatGPT.The live copy, at most one hour after session end, even when pinned. The title index, 30 days. Transcripts of past sessions, nowhere.
Device syncSession ciphertext through your own iCloud. Keys exist only on your paired devices. Record ids are blinded so even the id is not readable.When you pair a device.Ciphertext in your iCloud account. Cyrano’s servers are not involved.
Fast transcriptionRaw 16 kHz audio of the whole session, both sides, streamed to ElevenLabs under your own key. The single way audio ever leaves.While a session runs, if enabled.Per your ElevenLabs account terms.
Fast voiceThe text of a whisper cue, to ElevenLabs under your own key, for speech synthesis.Per whisper, if enabled.Per your ElevenLabs account terms.
Context sharingYour clipboard, or a single window read on this Mac and turned into text. The app name and window title travel with it. The image itself leaves only if you send it to your agent.At the moment you press attach.With the session, per its retention. Discarded after use unless you keep it.
DeliveriesThe session export, to a webhook, Google Drive, Google Calendar, or Arepo destination you created.When a session ends, per your rules.At the destination you chose.
Never
Analytics, crash, or ad SDKNone in the app. No taps, no screens, no advertising identifier.
Contacts, LocationNot requested. Not used.
Screen, clipboardRead only when you press attach, or for naming a call from its window title if you switch that on. Nothing from either leaves without a deliberate action.
VoiceprintsSpeaker grouping uses an in-memory signature that is discarded at session end. Nothing acoustic is saved or uploaded.
An inbound portNo listener reachable from the internet. Remote reads arrive over a connection your Mac opened, and the Mac decides whether to answer.