Your data is stored on your machine.
What we collect and what we do not — written to match how Anvil is actually built. XrossWarden, a sole proprietorship. In force from publication.
The short version
- Your memory stays on your computer. Your memories, skills, tasks and Secrets Vault are stored and encrypted on your own computer. They are never sent to us.
- When Anvil reasons, it uses your own AI account. To answer, Anvil sends what the task needs to the AI service you set up, such as your Claude or ChatGPT account, under your own agreement with that company. Choose a local model instead and nothing leaves your computer.
- We keep the bare minimum to sell and validate a licence — nothing more.
- We never sell our customer base or any customer data, to anyone, for any purpose.
- We cannot hand over what we do not hold — including to other companies or to government or law-enforcement requests.
1. What is stored on your device (we never receive it)
Anvil is a local-first memory layer. Everything that makes up your "brain" — memories, skills, conversations with Anvil, reasoning history, code, file paths, project data, and your Secrets Vault — is stored on your own machine. We do not store, forward, or process it, we claim no ownership of it, and we have no technical means of reaching it. Sensitive on-device data is encrypted at rest.
2. When Anvil reasons, and the assistants you connect
Anvil stores and organises your memory on your computer, but it does not run a large AI model of its own. When you ask it to reason, for example in a chat or a Crucible, it sends your request and the part of your memory that the task needs to the AI service you have set up:
- your Claude subscription (Anthropic), through Anthropic's own Claude app on your computer;
- your ChatGPT subscription (OpenAI), through OpenAI's own Codex app on your computer;
- a provider whose API key you added; or
- a local model on your computer (Ollama, MLX or llama.cpp). Then nothing leaves your computer.
That company handles it under its own terms and privacy policy, between you and them. It does not pass through XrossWarden, and we never see it. Before Anvil sends anything, it removes credentials it recognises, such as API keys, tokens and private keys, and by default personal details such as email addresses. Your Secrets Vault is never sent to an AI model.
Assistants you connect, such as Claude Code, Claude Desktop, ChatGPT, Codex or GitHub Copilot, read from and write to Anvil on your computer. What they recall from Anvil becomes part of your conversation with that assistant and goes to its company, like everything else in that conversation. Anvil removes credentials from everything it hands them. You choose which assistants to connect, and you can disconnect them at any time.
Small models that run entirely on your computer do Anvil's background housekeeping, such as indexing your memories for search. Work Anvil does on its own in the background never uses your subscription. It only uses a cloud service if you added your own API key for it.
3. What we do collect
To provide accounts, licensing, and payments we hold only the minimum data needed to purchase and validate a licence:
- your name and email address;
- your country (for tax and compliance on a purchase);
- licence and purchase records (which plan, when, and its status).
Apart from bug reports you choose to send (below), that is the complete list of personal data we hold. We do not build profiles, and we do not collect your content to do so.
Anvil also talks to us in these cases, and only these:
- Licence checks. With a paid licence, Anvil checks it with our licence server at least every 72 hours (see the licence agreement, section 2.3). It sends your licence key and a random device identifier created when Anvil was installed.
- Updates and built-in skills. Anvil asks our update server whether a new version exists, and downloads its built-in skills from us. These requests carry only what any web request does: your IP address, the app version and your platform.
- Bug reports you choose to send. If you use Report a bug in the app or
anvil report-bug, the report contains what you write, the Anvil version, your operating system and processor type, a health-check summary of which parts of Anvil are working, and a diagnostics recording only if you tick to include it. If you are signed in to a paid plan, it is also filed with the email address and plan of your XrossWarden account, so we know whose report it is; the app proves the account with a one-way fingerprint of your licence, and the licence itself is never sent. It never contains your memories, prompts, code or API keys, and you can read the whole report before you send it; a copy stays on your computer. Reports travel over an encrypted connection and are kept in a private issue tracker, hosted by GitHub, that only XrossWarden can see. We use them only to fix problems. We do not store the network address a report came from: it is held briefly in memory to stop abuse and then discarded. Please do not put personal or confidential details in a report; if you did by mistake, email us and we will delete it.
4. Payments
Payments are handled by our third-party merchant of record, Lemon Squeezy, which processes the transaction and handles tax. We never receive or store your full payment-card details. Lemon Squeezy's handling of payment data is governed by its own privacy policy.
5. Telemetry — limited, consent-based, never your content
Any product telemetry is limited to your identity (name, email, country) and aggregate counts and averages — for example the number of memories written, sessions per day, and the app version and platform for compatibility. It never includes the content of any memory, skill, prompt, or code. It exists mostly for performance monitoring, so we can improve the software — for example how quickly your memories surface, and the accuracy of what is recalled. Telemetry is consent-based; you can review, adjust, or export what we hold about you.
6. The website
xrosswarden.com uses privacy-preserving, server-side analytics to understand traffic in aggregate. The site does not set advertising or cross-site tracking cookies, and we do not sell or share site-visitor data.
7. How your data is protected
All of our network traffic is encrypted in transit, and the limited data we hold is fully encrypted at rest. Credentials such as account passwords are salted and hashed and are never stored in a recoverable form. No customer data is held in cleartext anywhere. Our services sit behind a Cloudflare Web Application Firewall (WAF) for additional protection against common web attacks.
8. We do not sell, and cannot hand over, your data
We do not, and will never, sell our customer base or any customer data as a data source. Because your private data lives on your device and we have no access to it — and will not design a means of gaining access — we cannot provide it to any third party, including upstream AI providers, other bodies, or government or law-enforcement requests. We can only ever produce the limited transactional data in section 3.
Your vault passphrase is never stored by us and never leaves your machine. Because we do not hold it, we cannot unlock, recover, or provide access to your protected data — for any reason, to anyone, including you. Keep your passphrase safe; if it is lost, the data it protects cannot be recovered by us or by anyone else.
9. Your choices and your rights
- Access and export. You can review and export the data we hold about you.
- Deletion ("right to be forgotten"). If you cancel and delete your account, your purchase history and other account records are permanently and unrecoverably removed, subject only to records we are legally required to retain (for example, tax records held by our merchant of record).
- Your on-device data is always yours and is never gated: it remains with you on every plan, and uninstalling offers you an encrypted or plain backup before anything is removed.
10. Data breaches
If a breach affects the limited data we hold, we will handle it in accordance with applicable law and notify affected users without undue delay.
11. Children
Anvil and our services are not directed at children, and we do not knowingly collect data from them.
12. Changes to this policy
We may update this policy from time to time. When a change is material we will make the updated policy available here and, where appropriate, notify you in-product. Continued use after a change takes effect constitutes acceptance for future use.