opayaDesktop: local-first workspace
Without optional cloud features, the desktop app stores sessions, chats and configuration locally. Eligible Vault secrets use OS encryption. Local transcripts and terminal logs can still contain sensitive information.
SECURITY & DATA
Security & data boundaries.
Know what stays on your machine, what reaches a provider and what changes when you use the web app.
Web: remote-agent access
The web app connects to remote environments, not agents on your laptop. Account services process authentication and subscription information. Remote features require the relevant server-side connection data.
DATA FLOW
Local-first does not mean nothing leaves.
Your chosen AI provider receives the prompts, files or other data you send to it. Connected tools receive data when you invoke them. Those services have their own privacy policies and retention settings.
Desktop-to-web sync is optional. Selected remote-host records, agent records, chats and explicitly selected keys may be transferred for cloud functionality. A key you choose to sync is stored by the web service in encrypted form.
Full privacy policy
Keep control at each boundary.
Use the narrowest access
Use a dedicated SSH user and environment-specific API keys. Check the destination machine before an install, clone or update.
Review consequential actions
Agents can edit files and run commands. Review permissions and diffs; a management interface is not a sandbox or a guarantee that every command is safe.
Keep a recovery path
Back up before changing a production agent. Test restores and cloned configurations in staging, and avoid duplicate scheduled jobs.
Keep secrets out of support
Do not send private keys, API tokens, credentials or conversation content in a report. Automatic redaction is not guaranteed to catch everything.
This is a plain-language overview of the published Privacy Policy and Terms, not a security certification or audit claim. Reviewed October 22, 2026.
WATCH / CONTROL & RECOVERY
Pause a runaway support agent
Pause first. Find the change. Test the fix.
Watch the storyReport a security concern privately.
Email support@opaya.dev with the affected version, a description and safe reproduction steps. Do not include live credentials or disclose an exploitable issue in a public discussion.