Privacy

Updated October 24, 2026

Toryo is a Mac app. Toryo’s service at toryo.app does not receive your workspace, your conversations with agents or your files. This page says what the service does receive and keep: your Toryo account, your subscription if you subscribe to the beta, and the usage data and error reports the app sends. It also says what the app on your Mac sends elsewhere, which never passes through Toryo’s service, and what happens when you join Toryo’s email list on www.toryo.app.

Your Toryo account

When you sign in, Toryo’s service keeps:

• your email address, and your name when Google sends one;
• your Google account identifier;
• a session for each Mac you sign in on, which ends when you sign out on that Mac or a year after you signed in;
• your place on the waiting list, if you join it, with any note you add;
• a record that your account has beta access, if Toryo invites you or you subscribe;
• if you subscribe, what Stripe tells it about your subscription, listed under “Paying for the beta”;
• your consent to product news, if you gave it.

The waiting list is used only to tell you about your access. Joining it never signs you up for product news, which has its own box on the sign-in page, unticked until you tick it.

Toryo’s team can see your account’s email address and how many Macs are signed in on it, to run the beta. Usage data and error reports cannot be joined to it.

What Toryo receives from Google

When you sign in, Toryo asks Google only for your basic profile and email address (the openid, email and profile permissions), and nothing else: no Gmail, Drive, Calendar or contacts. Of what Google sends, Toryo keeps only your name, your email address and your Google account identifier. Google also sends a link to your profile picture; Toryo does not keep it, or anything else Google sends.

Toryo uses them to sign you in, to tell your account apart from others, and to write to you about your access to the beta and, only if you ticked its box, about product news. If you subscribe to the beta, Toryo sends your email address to Stripe so the subscription is tied to your account. In the app, your first name is offered as a one-tap answer when your agent asks what to call you; if you choose it, it becomes part of your conversation, which goes to your AI provider as anything you type does. Toryo does not sell them or use them for advertising, and shares them with no one beyond the services that run Toryo, named below, and Stripe when you subscribe. Toryo’s use of information received from Google follows the Google API Services User Data Policy.

Paying for the beta

When you subscribe to the beta, you do it on Stripe’s own page, never in Toryo. Toryo sends Stripe your email address and a reference to your Toryo account, so the subscription is tied to your account. Stripe collects your card and billing details, keeps them under its own privacy policy and charges your card when a payment is due; Toryo never receives or keeps your card. Toryo’s service keeps what Stripe tells it about your subscription: Stripe’s references to it, to the checkout that started it, to its price and to you as its customer; its plan; its state, such as in its trial, active, waiting on a payment Stripe is retrying, or ended, and once it has ended, why: a cancellation, a payment that didn’t go through or a disputed payment; the dates its trial ends, it renews and it ends; and which of Stripe’s notices about it the service has acted on. In Toryo’s Settings, Manage subscription opens Stripe’s page, where you can cancel, change your card or get your invoices. Your account has beta access while your subscription is in its trial or active, and while Stripe retries a payment that didn’t go through. When the subscription ends, your account can no longer set Toryo up on a Mac. On a Mac where Toryo is already set up, your agents stop taking new work, and your conversations and what they made stay there for you to read.

Toryo’s email list

When you join Toryo’s email list on www.toryo.app, the page sends your email address to Kit, the service Toryo uses for its emails. The form asks for nothing else; as with any web request, Kit also receives your internet address and browser. Kit first emails you to confirm the address, and sends you nothing else until you do. Toryo uses the list only to tell you when Toryo is ready to try and to send occasional news about it. Kit records whether Toryo’s emails are opened and which of their links are clicked, as mailing services do. Every email has a link to unsubscribe, which stops them at once. Joining the list doesn’t create a Toryo account, and the list is kept apart from your account. Kit keeps the list under its own privacy policy.

What the app sends elsewhere

What you and your agent say goes from your Mac to Anthropic, under your own Claude or Anthropic account, so Claude can answer; Anthropic’s terms and privacy policy apply to it. On a Claude plan, whether Anthropic uses your conversations to train Claude follows your privacy settings on claude.ai; on an Anthropic Console account, Anthropic doesn’t by default. When your agent searches the web, what it searches for goes to Anthropic too, under the same account, and Anthropic runs the search with its search provider; the results become part of your conversation. When your agent opens a web page, your Mac asks the site for it: Anthropic first checks the site’s name against its list of unsafe sites, the site receives the page’s address and your Mac’s internet address, as it would from your browser, and the page’s text goes to Anthropic under the same account so Claude can read it. Before your agent opens a page, Toryo checks that you gave its address or a search found it, and refuses an address that leads to your Mac or your local network; a site that changes its answer at that very moment could still reach your local network, though nothing comes back over the encrypted connection. If your Claude account’s organization turns that check off, your agent may first open one of the documentation sites Claude Code trusts, and then Toryo stops it reading pages on that account. When you connect a service such as Notion, your agent works there through Toryo on your Mac: requests go between your Mac and that service, and what your agent reads there becomes part of your conversation, so it goes to Anthropic too. The key each service gives Toryo stays in your Mac’s Keychain. Passwords and keys you type into Toryo’s secure field also stay in your Keychain and are sent only to the service they are for; your agent never sees them. When you talk to your agent, your voice is turned into text on your Mac and isn’t sent anywhere; the text goes to Anthropic as typed words do. Your agent’s spoken replies are made on your Mac too. The app also downloads what it needs on your Mac: Claude Code, which Toryo uses to work with Claude, from Anthropic; and, while your agent’s voice is on, its voices, each once, from Hugging Face at huggingface.co: Kokoro for English (about 220 MB) and, the first time your agent replies in Portuguese, Chatterbox for Brazilian Portuguese (about 3.2 GB). The first time Toryo listens for a language your Mac doesn’t have yet, it asks macOS to download Apple’s speech recognition for it, once, from Apple: for Portuguese, about 350 MB. These downloads carry nothing of yours, only what any download carries, such as your Mac’s internet address.

Usage data

Usage data is off until you turn it on, during setup or in Settings. When it is on, the app sends counts of what you use: setup steps, work, replies, artifacts and appearance. Each comes with the minute it happened, the app’s version, the macOS version and a random installation number.

The installation number is made on your Mac, is derived from nothing and is never tied to your Toryo account. Usage data never includes your conversations, files, names or folder names.

Turning usage data off stops sending, deletes what your Mac has not sent yet and forgets the installation number. If you turn it on again, your Mac gets a new number. What the service has already received stays until its 90 days end.

Error reports

When something in Toryo fails, the app sends an error report: the error’s code, the part of Toryo where it happened, how serious it is, whether trying again could help, how many times it happened and the first and last minute it did, with the app’s and macOS versions.

Error reports have no content and no identifier that links them to you or your Mac: no account and no installation number. Each has a random number of its own, used only to store it once. They are sent whether or not usage data is on. Something you chose, such as canceling or a file Toryo refused, is never an error report.

How long it is kept

Your Mac keeps usage data and error reports only until the service has received them, then deletes them. If your Mac cannot reach the service for a while, it keeps only a bounded amount and discards the oldest; nothing of your work is affected. The service keeps each usage event and each error report for 90 days after it receives it. After that only daily totals remain, per kind of event and per error code, with no installation number.

Where it is kept

Toryo’s service runs on Vercel, with its database on Neon; payments are Stripe’s, and Toryo’s email list is Kit’s. Vercel keeps a record of each request to toryo.app and www.toryo.app, with the caller’s internet address, the address requested and the browser used, for at most a day; Toryo turns on nothing that keeps them longer. To limit abuse, the service counts requests per caller for up to ten minutes, keeping a keyed hash of the address and never the address itself. The service itself writes no email address, name, token or request address to its logs.

Everyone who signs in gets one cookie, which ties the sign-in to the browser you started it in and expires an hour after you last use the sign-in pages. Toryo’s team gets a second, which keeps a team member signed in to the team’s own page for at most twelve hours. Neither site has analytics.

Questions and deleting your account

To ask about your data, to take back your consent to product news, to have your address removed from Toryo’s email list or to have your Toryo account deleted, write to toryoapp@gmail.com.