Privacy and safety

Motriz combines a desktop workspace with a Motriz account and cloud services. Signing in establishes your identity and plan; it does not upload your repositories or local product history. This page covers where the app keeps data, how credentials are protected, what leaves your machine and when, what agents can do, and how updates are verified.

Where your data lives

Everything Motriz records lives in one folder: ~/Library/Application Support/Motriz/.

Your repositories are not copied into this folder. They stay in their original locations, and work runs edit them in place. Removing a product deletes its work, messages, and run history from Motriz; the confirmation dialog states the boundary plainly: "Repository files on disk are not touched." The database and the artifact and upload folders can be relocated with MOTRIZ_* environment variables — see Reference.

How credentials are stored

Motriz does not use the macOS Keychain. Provider API keys and CLI path overrides, ChatGPT sign-in tokens, integration authorization, the Brave Search API key, and analytics connector credentials are encrypted with AES-256-GCM before they are written to the local database. The key is generated once and kept in secret.key next to the database, with file permissions restricted to your user. Settings never echoes a stored secret back to the screen — once a key exists, its field only shows "configured — enter a new key to replace". See Providers and models for how each credential is entered.

What leaves your Mac, and when

The app's embedded webview cannot reach the internet at all — its content-security policy allows only the app itself — so every network call goes through the app's native backend. That backend talks to the outside world only for things you configured or asked for:

• Model providers. Prompts, conversation context, and whatever repository content a run reads go to the provider running your agent. The Claude Code and Codex CLIs talk to their own vendors' services; API providers use the endpoints shown in Providers and models.
• Motriz account and cloud capabilities. Identity and plan-entitlement requests go to Motriz Cloud. Managed AI and other cloud capabilities receive the scoped request data needed to perform the job when you explicitly invoke them — a First Decision, for example, sends only your question, the optional starting point, and the assumptions and evidence summaries you listed, and the desktop review step shows each line before anything is sent: "Nothing else leaves this Mac — no files, no repository contents, no conversation history." Signing in alone does not upload local journeys, repositories, Build state, provider credentials, or BYOK configuration.
• Integrations. Tool calls go to the provider-hosted MCP services for Linear, Notion, Atlassian, AWS, and Stitch. Authorization stays encrypted on this machine; your account and workspace permissions remain the source of truth. See Integrations and web search.
• Web search and fetch. Queries go directly from your Mac to the enabled engines, and fetched pages come from the sites themselves — there is no Motriz proxy in between.
• Git and GitHub. Pushes, pulls, and pull-request actions reach your Git remotes and api.github.com using your existing gh or Git credentials. Choosing GitHub as your Motriz account sign-in establishes identity only; it does not grant the desktop app repository access. See Git, worktrees, and GitHub.
• Analytics connectors. If you connect Amplitude or PostHog to a product's evidence, Motriz runs read-only aggregate queries against your account. It reads numbers in; it does not write to the account.
• Voice model downloads. Installing a dictation model downloads it once from Hugging Face. After that, dictation runs entirely on your Mac — in the setting's own words, "Audio never leaves this machine."
• Update checks. An installed build fetches the release manifest from motriz.ai at most once per hour.

Plus the anonymous signals described below — and that is the complete list. There is no analytics SDK, crash reporter, or tracking library in the app.

Codex runs in an isolated home

Codex does not run against your real ~/.codex. Motriz maintains its own codex-home/ folder with a minimal config.toml, copies only auth.json in from your Codex home so your existing sign-in works, and removes any inherited CODEX_HOME variable so nothing can redirect the run. Your personal Codex configuration is read for that one file and otherwise left alone.

What agents can do

Every agent and model can use the full tool surface available to a run: read, modify, create, and execute in the selected repository, with no per-command approval prompts. A role may be instructed to analyze without editing or to write only to the artifact workspace, but that is expected behavior, not an access-control boundary. Connected integrations can also expose write operations permitted by the external workspace. This trade buys speed, and it puts the safety boundary in your hands.

Anonymous usage signals

Motriz sends no general telemetry. The only product signals are anonymous, aggregate-only counters posted to api.motriz.ai, and the collector stores counts — nothing else. The code that sends them opens with a comment the team treats as binding: "Privacy contract (do not regress)".

The first-run answer

When you click an answer to the welcome screen's question, Motriz sends one payload with exactly two keys: the app version and which answer you chose (idea, feature, or repo). The answer is recorded once, locally, and is not sent again or overwritten. Choosing "Skip" sends nothing and stores nothing.

Three app events

Each event is a single-key payload — { "event": "<name>" } — sent only after the local action has already succeeded:

No product names, repository paths, prompts, content, identifiers, machine information, or timestamps ride along. Sends are fire-and-forget: failures are silent, and nothing retries or queues.

Updates are verified before install

When you click the sidebar's update pill, Motriz first refuses to proceed while agents are running — "Stop all active agents before installing an update" — then downloads the release archive and verifies it twice before touching your installation:

1. Checksum

   The download's SHA-256 hash must match the checksum published in the release manifest. A mismatch stops the install — usually a release still propagating; try again in a few minutes.

2. Code signature

   The new app bundle must pass codesign --verify --deep --strict and carry the Motriz Developer ID team identifier.

An archive that fails either check is not installed. After both pass, Motriz swaps the app bundle — keeping the previous version aside so a failure rolls back instead of leaving you without an app — and relaunches. If an install fails, the pill reports it in place: "Update failed: {message}".

Account identity without implicit upload

Your Motriz account carries identity, plan entitlements, and managed-service usage. Your repositories, local journeys, conversations, decisions, provider credentials, and BYOK configuration remain in the desktop app unless an explicitly used cloud capability sends scoped data for that job. Signing in is not repository sync. Moving to a new Mac therefore does not carry the local data folder with it — repositories travel through Git as usual, but the Motriz data folder above is yours to back up like any other application data.

Cloud retention, export, and deletion

• Research-artifact retention. Research artifacts created with managed services — including First Decision artifacts — are kept for the retention period attached to the account plan. Free keeps them for up to 30 days. Settings → Your cloud data shows the period currently applied to the account; paid-plan retention periods will be published before those plans launch.
• Account export. Export currently produces a machine-readable JSON bundle containing account identity, product references, research artifacts, and managed-usage receipts. The download remains available for seven days. It is not a backup of repositories or other data that stays on your devices, and it does not yet include every Cloud control record.
• Device revocation. Revoking a device marks it revoked and invalidates existing Motriz identity sessions. It does not remove repositories or Motriz data stored on the device.
• Hosted connector credentials. Amplitude and PostHog credentials added in Motriz Cloud are encrypted with AES-256-GCM under a Cloud-held key and are never returned by the API. Disconnecting removes the stored credential while retaining non-secret connector history; account deletion removes the connector records as well.
• Account deletion. Only the account owner can request deletion, and a recent sign-in is required. The request immediately revokes sessions and registered devices, then queues Cloud deletion for the next maintenance run; Motriz does not currently promise a fixed completion interval. Processing cancels active managed work and removes memberships, invitations, connectors and their credentials, product references, synchronized product data, managed jobs, research artifacts, hosted-source records, snapshots, watches, exports, and notification registrations. Minimal deletion markers and billing/usage records are retained where required. Nothing stored on your devices is touched.