The short version.

What lives on your computer only

• Your task list, priority rankings, and check-in history — all stored at ~/.naggler/naggler.db (or C:\Users\you\.naggler\naggler.db on Windows).
• Your settings — cadence, quiet hours, snooze rules, theme.
• Your Naggy conversations, notes, memories, and per-task observations. These are stored locally regardless of which AI option you choose.

Core task tracking works offline. When you use a network AI option, Naggler sends a bounded copy of relevant local context for that request, as described next; it does not sync the database itself.

What happens when you use an AI feature

Each AI request can send the current request content (a typed message, or an app-generated heartbeat/title prompt) plus recent conversation, and a bounded context copy. Some AI requests are not typed chats: periodic post-check-in heartbeats (default on; use Settings → Proactive Nudges to disable) and optional thread-title summaries. When revising an action, it can also send the proposal you opened for revision.

Depending on the request and your context settings, that copy can include current date and local time; active and snoozed tasks; focus score, tracked totals, and recent check-ins or focus activity; current session status and task durations; Naggy's notes and memories; and relevant task notes and dependencies. Naggler caps the context size, but it does not redact task titles or note text.

You choose one of three modes in Settings:

1. Naggler Cloud (default for new installs). Naggler does not train on your conversations and the Cloud relay does not keep a server-side chat history. Every supported app version now sends Cloud requests through Cloudflare and OpenRouter to a selected hosted model endpoint. Each request requires an OpenRouter Zero Data Retention endpoint, denies provider data collection, and excludes endpoints that ignore requested parameters. Earlier beta requests used TokenRouter; it is not a current serving route. Naggler Cloud includes 100 successful Cloud model calls per install per day (soft counter) including chat, optional Deeper Thinking retries, background focus nudges, and thread titles. To share this allowance, Cloudflare KV holds soft, best-effort daily fairness counters tied to an anonymous install identifier and a purpose-scoped daily network-address hash for about 36 hours. These eventually consistent counters are not atomic billing limits and concurrent requests can overshoot them.
2. Your own API key. We hand your request directly to the provider you choose — Anthropic, OpenAI, or OpenRouter — using the key you provided. We don't see it.
3. Ollama. Naggler sends each AI request to the Ollama server URL you configure. It stays on this device only when that server runs on this device.

Current Naggler Cloud requests are subject to Cloudflare's, OpenRouter's, and the selected model endpoint's data terms. Earlier beta requests were also subject to TokenRouter's terms. For BYOK, your chosen provider's terms apply.

What happens when you enter an email on naggler.com

During the beta, the email form on the download page is how you get Naggler. Submitting it does three things:

• Stores your email address, form source, Cloudflare country code, signup/send timestamps, and resend count in Cloudflare KV. We do not retain your raw network address or browser user-agent in the signup record. A purpose-scoped hash is kept for about two hours to rate-limit the form.
• Sends the download email through Resend, which processes your address for delivery. The page shows success only after Resend accepts the message. Re-submitting can resend the links after a short cooldown. A first signup may also trigger an internal notification that contains country and source, not your address.
• Keeps you on the beta list for download access and important build, security, and launch updates. It is not a marketing newsletter. We retain the record until you ask us to remove it; reply "stop" or email us and we will delete it.

We do not sell or rent the list. We share the address only with processors needed to operate the form and deliver those messages.

Other optional network activity

• Returning installs make a short request to GitHub Releases to check whether a newer public build exists. No task or conversation content is included.
• Product analytics is not enabled in this beta. Naggler does not ask you for an analytics account, project key, or host.
• Choosing Help → Share Aggregate Stats opens an editable email draft addressed to feedback@naggler.com; it does not send automatically. The draft summarizes app version and platform, first local activity date, task-state counts, prompt check-ins, recorded focus sessions and time, Naggy conversation/message and suggestion counts, and Battle Mode counts and modes. It includes no task names, message text, email addresses, or install identifiers. You can remove any line before sending.
• Third-party integrations and MCP tools contact only the services you configure. Their data handling is governed by those services.

What we don't have

• No user accounts. No password to steal.
• No crash-reporting service and no product analytics in this beta.
• No cookies on naggler.com beyond what's strictly needed to serve the page. (GitHub Pages may log standard HTTP request data on their side — that's outside our control.)
• No advertising, ever.

Your data, your move

You can export the local ledger from Settings. To remove all local Naggler data, quit the app, remove ~/.naggler (or C:\Users\you\.naggler), remove Naggler entries from your operating-system keyring if you saved API or integration secrets (if a keyring is unavailable, these secrets are stored in the local SQLite settings file), and disable Launch at startup before uninstalling (or remove its startup entry manually). Conversation deletion is version-specific: in v1.10.31, it removes the thread from view but does not erase its stored transcript. Starting with v1.10.32, Delete Conversation removes that thread's active transcript records from the current local database, but it does not remove tasks, proposed actions, or separate Naggy notes and memories derived from earlier chats. Older Naggler diagnostic logs, SQLite storage pages or journal files, and operating-system backups may still retain earlier copies or bytes; conversation deletion is not a forensic-erasure guarantee. Removing the entire local data directory remains the most complete way to remove Naggler data under the app's control.

If you signed up on naggler.com and want your email removed from the KV store, write to feedback@naggler.com — we'll confirm the delete within a couple of days.

When this changes

If we add a new thing (an account system, built-in analytics destination, or a paid tier with payment records), we'll update this page and tell people who signed up for the download email. We won't quietly slide something in.