docs(privacy): bring PRIVACY.md up to date with what shipped on 13 October

Merged
DA
6d ago
+415-323

Summary

Dean approved this PRIVACY.md update. I checked every change merged since the last full pass (#2287, 2026-10-13 03:13Z) against the code and corrected what the policy says. The PR changes no code.

  • Commands on your Mac (#2359/#2374/#2376/#2388):
    • Fixed: a queued command and its answer stay in the database until the agent's call reads the answer or gives up waiting. They do not go when the Mac answers. A row left by a service failure mid-wait stays until account deletion.
    • Fixed: a command no Mac takes within 30 s is not run.
    • Fixed: the "last read" record is one timestamp per account, naming no Mac.
    • Fixed: the switch is kept on each Mac and is on by default on every one.
    • Fixed: switching off is not instant everywhere. Running commands stop within about 20 s, and for up to 45 s an agent hears "not run / no answer" before "no Mac".
    • Added: commands run with Luke's environment; quitting kills them; output shows as "On your Mac" rows on every signed-in Mac; output is not logged, counted, or traced.
  • The planning conversation / Call tab (#2378, #2411/#2419 9b/9c, #2436/#2437/#2449/#2453):
    • The retired Transcript and Work tabs are now the Call tab.
    • Added what it reads: newest 60 parts a turn, text cut to 4,000 characters, a page's HTML and the board picture stripped.
    • A worker's tab reads the worker's session uncut.
    • "Held in the panel's memory" became "held in Luke's memory, never on disk", and the planning turns never reach the voice or call window (#2464).
  • Inbox (#2312/#2327/#2392/#2422/#2442): the account read carries every waiting item in brief and every plan holding an item. Opening the Inbox reads those plans' items whole, settled ones included. Notifications can be turned off.
  • Agent runtime:
    • Added (new bullet, "OpenAI, for web search"): every role searches through OpenAI on Luke's key with store: false, whatever model or key the agent runs on; page reads are fetched by our service without cookies (#2372).
    • Daily meter: now counts every call on Luke's key, coding agents' and titles included, as one number a day (#2367).
    • Fast: coding agents only, Claude only, always on Luke's key, and not offered to an account with its own Anthropic key (#2366).
    • Repository skills: new paragraph (#2325/#2334/#2337/#2375/#2394).
    • Changes tab: new paragraph (#2307).
    • File tab: opens at the checkout's commit (#2316).
    • Working memory: described as the Workflow session history.
    • Wording: "research worker" became "workers".
  • Integrations (#2329/#2358/#2363):
    • Per-agent MCP switch, stored with the agent.
    • Tools-list request (cached 5 minutes).
    • The connection record's extra fields.
    • "Told to change only when asked" applies to workers.
    • Slack: marked as not offered: Settings shows it unavailable and calls fail before any token is read. Its read scope (private channels, DMs, email addresses) is stated.
  • Updates and pictures: the update check runs at launch, every 4 h, and from the menu or Settings, signed in or not; it auto-downloads and installs at quit. The Mac fetches your profile picture from Google or GitHub directly.
  • Plan template: it now keeps a version history (#2315/#2324/#2331), deleted with the account.
  • Removed as no longer true:
    • the prompt cache key (nothing sets one);
    • "one model call per request";
    • "request to count a call's tokens";
    • the "server you connect to" runtime;
    • "a count made before sign-in is not sent" (it is held and sent if you sign in);
    • the earlier-version leftovers dropped by #2356. Only the legacy conversations remain.
  • Smaller fixes: the screen-recording exclusion list matches the ph-no-capture surfaces; window layout in localStorage is disclosed; crash-report breadcrumbs and IP address are stated; the website's PostHog behaviour is described as the code does it (sign-in pages unrecorded, identify at consent).
  • The LiveAvatar work was reverted (#2455), so the policy does not describe it.

Voice window: #2464 now strips planning.conversation from the voice and call windows' state, as it already stripped planning.work. The policy says so: the planning turns are never sent to Luke's voice window or call window.

Evidence

  • Platform-independent checks: ./scripts/check.sh exit 0
  • macOS Electron verification (./scripts/verify.sh): not run. This PR changes only docs, and this Linux VM cannot run it. CI cannot verify the Mac either. LUKE-159 is the manual Mac pass.

Visual evidence

  • Fixture screenshots inspected: not attached (no UI change)

Physical-device evidence

  • Screenshot or screen recording: not attached
  • Device/display configuration: not recorded

Invariants

  • ./scripts/check.sh green; no renderer/UI change. (CI)
  • JSON Schema goldens unchanged. (CI)
  • No behavior change, so no test is owed; no change-detector test added.
  • Gateway envelope goldens unchanged. (CI)
  • No new as type assertion. (CI via anti-slop)
  • No Effect.runPromise/runSync/runFork added. (CI)
  • No new raw async primitives. (CI)
  • No discarded Effect. (CI)
  • Test count unchanged.
  • No hand-rolled file replaced.
  • No CLAUDE.md/AGENTS.md sentence names a changed part.
  • PRIVACY.md changed: a product decision Dean approved, called out above.
  • No dependency change. (CI)
  • No barrel change. (CI)

Notes

  • Blockers or follow-up verification: None (the voice-window fix landed as #2464).

🤖 Generated with Claude Code