Reference
Privacy and safety
Understand local storage, encrypted credentials, aggregate signals, and the full-access agent model.
Local-first storage
Motriz has no hosted project backend and no required Motriz account. The following data is stored on your Mac:
- Projects, ventures, threads, messages, runs, task queues, and local settings in SQLite.
- Uploaded files and generated artifacts in app-managed local directories.
- Downloaded voice models.
- Provider keys, CLI paths, endpoints, and integration authorization.
Repositories remain in their original folders. Removing a project from Motriz does not delete the directory on disk.
Encryption at rest
Provider secrets and integration authorization are encrypted with AES-256-GCM before they are stored in the local database. The encryption key lives beside the database with restrictive file permissions.
This protects against accidental plaintext database dumps. It does not protect secrets from someone who already controls your logged-in Mac or can read both the database and its local key.
When data leaves the Mac
Local-first does not mean every task is offline. Data crosses the machine boundary when you deliberately use:
- An AI provider, including a local CLI that sends prompts to its provider service.
- Linear or Notion integration tools.
- Embedded web search or webpage fetch.
- A Git remote or GitHub pull request action.
- The website download service.
Background network traffic is narrower but not zero: installed builds check the Motriz update manifest at most about once per hour, and the aggregate-only signals described below are sent automatically after qualifying actions. The provider, remote workspace, search engine, and website you invoke apply their own data handling and account permissions.
Repository access by mode
| Mode | Repository access | Other side effects |
|---|---|---|
| Build | Full read, write, create, execute, and command access. No per-command approval prompt. | Can use configured web and integration tools. |
| Chat | Read and search only; it does not edit repository files. | Can create Motriz artifacts and use uploads, web, deep research, and integrations. |
| Product Design | Repository is read-only reference. | Writes designs and documents to the Motriz artifact workspace. |
| Co-founder | Works primarily with venture state, evidence, documents, and the selected provider tools. | Can invoke founder specialist research and configured integrations. |
There is no permission toggle inside a Build run. Choose Chat or Product Design when you want repository context without code mutation, and choose Build only when repository changes are intended.
Anonymous aggregate signals
Motriz does not send general product telemetry. It sends only the following aggregate-only product signals:
First entry
When you answer the first-run question, Motriz sends one payload:
{ "app_version": "<version>", "first_entry_mode": "idea" | "feature" | "repo" }The answer is stored once locally and never overwritten. If you choose Skip, nothing is sent.
Project and venture creation
After successfully adding a code project or starting a venture, Motriz sends one of:
{ "event": "project_created" }
{ "event": "venture_started" }These signals do not include project or venture names, repository paths, prompts, timestamps in the JSON body, version, identifiers, or machine information. Sends are fire-and-forget; failures are silent.
Safe operating practices
- Commit or stash unrelated changes before broad Build work.
- Do not point Build at folders containing secrets or personal data the selected provider should not receive.
- Review diffs and validation before committing or pushing.
- Keep parallel tasks independent, then integrate their branches manually.
- Use narrow integration prompts when agents can modify Linear or Notion.
- Rotate a credential if you believe the Mac or provider session was compromised.
- Use repository-native tests and version control as the recovery boundary for agent mistakes.
No silent hosted workspace
Motriz does not sync your project database, threads, or artifacts to a Motriz cloud account. If you move to another Mac, the app does not automatically reproduce that local state. Repository data remains portable through the repository itself; Motriz-specific state requires your own machine backup strategy.