Short enough to actually read.

• Your messages. Cozy reads the Messages database that is already on your Mac. It is never uploaded, mirrored, or backed up anywhere by Cozy.
• The search index. Cozy builds its own local copy to answer questions quickly. It lives in your user library, on the Mac, and only you can delete it (how: section 05).
• Contact names. If you allow Contacts access, the name-to-number mapping is used locally so you can ask about "Sarah" instead of a phone number. It stays on the Mac.

Your question, and the few message excerpts Cozy's local search selects as relevant to it, are sent to be answered by an AI model. That traffic goes through ModelRelay (the billing and routing platform Cozy is built on) to the model provider, over TLS. Cozy stores none of it — not the question, not the excerpts, not the answer. Model providers process requests under API terms that exclude using them to train their models.

Everything else — the other hundred thousand messages — never leaves the machine. The answer comes back to your Mac and lives only there.

• Sign-in. You sign in with Google; Cozy keeps your email address to identify your account. No password is ever seen or stored by Cozy.
• Payments. Subscriptions are processed by ModelRelay through Stripe. Your card number never touches Cozy's or ModelRelay's servers — it goes straight to Stripe. Your card statement will read MODELRELAY.
• Usage records. ModelRelay keeps the billing ledger (tokens used, amounts charged) needed to run your balance and subscription — numbers, not message content.

• No ads, and no selling or sharing your data with anyone.
• No training AI models on your messages.
• No analytics inside your conversations. What you ask Cozy is between you, your Mac, and the model that answers.

Signing out removes Cozy's credentials from your keychain. To erase the local index too, delete the app and the ~/Library/Application Support/Cozy folder — and, if you installed before the Cozy rename, ~/Library/Application Support/CozyRLM as well. macOS leaves app data behind when you trash an app. Cancel a subscription any time from your account page — it takes two clicks. Billing records are retained by Stripe as payment regulations require.

Questions about any of this: ask directly. If this page and the product ever disagree, that's a bug — tell us and we'll fix whichever one is wrong.