Privacy policy.
Silo Systems collects nothing. Silo Tidy sends file content off your Mac only if you turn on Bring Your Own Key.
The short version
Silo Systems operates no server for Silo Tidy and receives nothing from it.
No analytics. No telemetry. No Silo Tidy account. No personal data. No usage metrics. No error beacons. No advertising IDs. No fingerprinting. No crash reports. No data about you, your device, or your content is ever collected by Silo Systems, and the app never sends any of it to us. Product data stays in the app's local container; the optional outbound paths are disclosed below.
By default, everything Silo Tidy does runs on your Mac using a bundled local runtime. Any optional model is stored and executed locally after consent. Silo Systems operates no remote processing service and there is no Silo Tidy account. The one exception is the optional Bring Your Own Key mode described below, which is off until you enable it and sends data only to a provider you choose and pay for directly.
What the app never sends
The app sends none of the following to Silo Systems: your name, email, phone, or address; your IP address, device identifier, or any hardware fingerprint; your content and anything derived from it; session timing, feature usage, or behavioural data; crash reports. The app never contacts Silo Systems; its only outbound paths are the optional model downloads you approve, links you open, App Store traffic handled by Apple, and Bring Your Own Key requests sent directly to the provider you choose. If you contact support by email, we receive your email address and whatever you choose to send.
The local backend is not a network service
Silo Tidy runs a small local process to perform its on-device work. It binds strictly to the loopback interface (127.0.0.1:8767), never to a public or network-facing address. The SwiftUI host renders the UI in a WKWebViewloaded from that same loopback origin. This is on-device inter-process communication only — it accepts no external connections and is not reachable from your network or the internet.
Outbound network traffic
Apart from the Bring Your Own Key requests described in the next section, the only outbound network traffic is listed below, and the app sends none of it to Silo Systems:
- Optional model downloads. No file content is included in a model request. You can choose the pinned Current Gemma 4 E2B snapshot at roughly 3.58 GB or the pinned Compact Ternary Bonsai 4B snapshot at roughly 1.14 GB. Before consent, Silo Tidy shows the exact Hugging Face host and immutable revision, license and NOTICE, storage requirement, integrity policy, and device-fit report. Filename rules remain available without either model.
- Apple and the App Store. Apple's operating system and App Store may contact Apple automatically, for example to verify your purchase or to deliver updates. This traffic is between your Mac and Apple's servers.
- Links you click. If you click an external link inside the app, your default browser handles the request. Silo Tidy is not involved.
Optional Bring Your Own Key (off by default)
This is the only way Silo Tidy sends your content off your Mac, and it stays off until you enable it. If you enable cloud inference in Settings and supply your own API key (Anthropic, OpenAI, Google Gemini, or OpenRouter), then for each file you classify with that feature, its name, type, size, and metadata such as archive entry names and Apple Vision image labels, up to 1,200 characters of extracted or OCR text, and your category names and descriptions are sent over the internet to the provider you selected, under your own account. What you send is then subject to that provider's privacy policy and data-retention practices, not ours.
Turning it on requires an explicit in-app confirmation, Silo Tidy shows a Cloud badge in the Tidy workspace whenever a cloud provider is active, and you can return to on-device processing at any time. Nothing is ever sent to Silo Systems. We never see your content or your key, and we run no server, proxy, or relay in this path — traffic goes directly from your Mac to the provider you configured. Your key is stored only in the macOS Keychain on this Mac, never in a file, a database, or a log. You can also point Silo Tidy at Ollama running on this Mac, in which case the request goes to 127.0.0.1, and whether that server processes it locally or forwards it to a cloud provider depends on its configuration.
Permissions we request, and why
- Folders you choose. Read and write only the source and target folders you explicitly select through the macOS file picker. Remembered across launches with security-scoped bookmarks. Silo Tidy never touches a folder you didn't pick.
Silo Tidy does not request Camera, Contacts, Location, or Full Disk Access beyond what is listed above. If you grant nothing, it can read nothing.
On-device data you create
Categories live under ~/Library/Containers/com.silosystems.silotidy/Data/Library/Application Support/SiloTidy/. Learned rules, local Workspace Audit snapshots, run history, reviewed decisions, and undo receipts live in that same container, as does the optional practice sample folder the first-run tour can create; removing it deletes only that sample. Source files and organized outputs remain in folders you choose. They are yours. We do not have access to them. Deleting Silo Tidy removes the app; your work remains under its container until you delete it manually.
Component inventory
Silo Tidy uses these open-source components and public services. Local components do not transmit your content. Hugging Face receives an ordinary download request only when you approve a model download; a Bring Your Own Key provider receives the content you send with that mode and ordinary request metadata, including your IP address, and handles them under its own privacy policy, retention practices and age requirements.
- mlx-lm — runs locally on-device.
- gemma-4-e2b-it-4bit — runs locally on-device.
- Apple Vision image classification and OCR — run locally on-device.
- Gemma 4 E2B content and image-label classifier (Hugging Face) — optional, downloaded only after consent, and run locally.
- Ternary Bonsai 4B compact classifier (Hugging Face) — optional, downloaded only after consent, and run locally.
- FastAPI — the bundled local backend, bound to loopback only.
- Hugging Face Hub — contacted only when you choose to download one of the optional pinned models.
- OpenAI, Anthropic, Google Gemini, or OpenRouter — contacted only when you enable Bring Your Own Key, select that provider, and submit a request directly under your own account.
Children's privacy
Silo Tidy is rated 4+. Silo Systems collects no personal data from any user, at any age. Bring Your Own Key is optional and off by default; a provider you connect with it receives what you send and applies its own data practices and age requirements.
Changes
If we ever materially change how Silo Tidy handles data, we will publish an updated version of this page, announce the change prominently in the release notes, and require explicit consent in-app before any new collection begins. The current policy is: Silo Systems collects nothing.
2026-10-27: corrected the section on what the app never sends. A support email reaches us; the app itself still sends Silo Systems none of the data listed there.
2026-11-05: corrected the policy to describe the optional own-key provider path and other outbound traffic accurately.
Contact
Questions about this policy: admin@ohmslaw.net