legal · privacy

your notes stay yours.
here's what leaves your device.

outl is local-first. your markdown lives on disk. three things can leave your device: first, sync traffic, encrypted end-to-end, between the devices you pair. second, crash reports from official builds, on by default and without note content, which you can turn off. and third, whatever you expose to an AI tool over MCP, which that tool then sends to its own provider. this page covers all three, plus what the website collects, so you can audit all of it.

last updated: 2026-11-07

tl;dr
  • your notes are stored on your devices and are never sent to us. we don't run a server that reads them.
  • sync, when you turn it on, is peer-to-peer and end-to-end encrypted between devices you pair. no account needed. when devices can't connect directly, a relay forwards the encrypted data: it sees which devices connect, when, how much data moves and their IP addresses, not your notes.
  • official release builds (CLI, desktop, iOS, Android) report crashes to Sentry by default. self-compiled builds never do. you can turn it off, see below.
  • there is no usage analytics in the apps: no feature tracking, no behavioral data.
  • the website uses Google Analytics for aggregate traffic stats. nothing personal.
  • TestFlight (Apple) collects crash and install data on Apple's side. that's Apple's policy, not ours.
  • no accounts. no ads. no sale of data. ever.

who runs outl

outl is an open-source project maintained by Thiago Avelino (@avelino on GitHub). the source code lives at github.com/outlmd/outl under the MIT license. there is no company behind it.

the CLI, TUI and desktop app

the outl binary you install via brew install outl-beta (or build from source), and the outl.app desktop app you install via brew install --cask outl-desktop-beta or from the download page (macOS, Linux, Windows), run entirely on your machine.

  • no usage analytics, no feature tracking.
  • official release builds report crashes to Sentry by default: client, version, OS, arch, panic location in outl's source, and a cleaned panic message, with no note text, page names or paths in it. self-compiled builds never report. turn it off in Settings > Privacy, or run outl telemetry off (also outl telemetry status, or OUTL_TELEMETRY=0 for one run). stored locally under [telemetry] in ~/.config/outl/config.toml.
  • network calls happen when you turn on sync (peer-to-peer, see below), when a release build sends a crash report, when you fetch a URL in an executable code block, or when you run outl import from a remote source. nothing else reaches the network on its own.
  • your .md files and the .outl sidecar live in the workspace folder you chose. we never read them.
  • the macOS desktop dmg is currently unsigned. on first launch Gatekeeper will block it, right-click outl.app and choose "Open", or run xattr -dr com.apple.quarantine /Applications/outl.app. signing and notarisation are planned. the Windows installer is unsigned too, so SmartScreen asks you to confirm: More info, then Run anyway.

if you don't believe us, the source is public, grep for it.

the iOS app (TestFlight beta)

the iOS app stores your notes locally on the device. sync is peer-to-peer over iroh: your devices talk directly to each other, end-to-end encrypted, with no account. when a direct connection isn't possible, a relay helps devices find each other and forwards that already-encrypted data. it can see device IDs, IP addresses, timing and traffic volume, not your note content. see /docs/relay for detail. (if you opt into the advanced file transport and point it at a folder synced by some other service, that service sees those files, but that's your choice, not the default.)

what the iOS app does not do:

  • run usage analytics or feature tracking.
  • no advertising identifiers.
  • no contact list, photo library or location access (unless you explicitly grant it for a feature that needs it, and we tell you why at the prompt).
  • no account creation. no login.

like the other official release builds, the iOS app reports crashes to Sentry by default, with no note text or page names in the report. turn it off in Settings > Privacy.

because the beta is distributed through Apple's TestFlight, Apple collects crash reports, install/uninstall events and basic device info on their side. that data is governed by Apple's privacy policy, not by us — we only see the aggregate counts Apple shows in App Store Connect.

the MCP server (second brain)

when you point an LLM client like Claude Desktop, Cursor or ChatGPT at outl's MCP server, the server runs on your machine and reads your local workspace. outl itself does not send your notes anywhere.

be aware though: the LLM client you connect to (Claude, Cursor, ChatGPT, etc.) will see the note content that gets returned through MCP. that data goes to their servers under their privacy policy. if you don't want a particular note to be visible to the LLM, don't query it.

the website (outl.app)

outl.app is a static site (Astro) hosted on Netlify. when you visit it:

  • hosting (Netlify) records standard server logs: IP address, user-agent, requested URL, timestamp. these are retained for a short window for abuse prevention. see Netlify's privacy policy.
  • Google Analytics measures aggregate traffic (pages viewed, country, browser, referrer). IP addresses are anonymized by Google. we do not have any custom identifier that links a visit back to a person. see Google's privacy policy.
  • fonts (Google Fonts) are loaded from Google's CDN, which means your browser hits Google. if you want to avoid that, block the request — the site still works.
  • local storage is used for one thing only: remembering your dark/light theme choice (outl-theme). it never leaves your browser.

we do not set any tracking cookies of our own. we do not run ad networks. we do not sell any of this data, nor share it for marketing.

contact (email / support)

if you email us or open a GitHub issue, we get whatever you wrote and the address/handle you sent it from. we use it to reply, and that's it. issues are public on GitHub by design — don't paste secrets in them.

your rights (GDPR / LGPD)

since outl doesn't hold a copy of your notes, there is almost nothing for us to access, export or delete on your behalf — that data lives on your device. for the limited data described above (Google Analytics aggregates, Netlify logs, email correspondence), you can ask us to delete what we control or to clarify what we have. write to the address below.

children

outl is not directed at children under 13. we don't knowingly collect data from them.

changes to this policy

if anything material changes — a new SDK, a sync server, a real backend — we'll update this page and bump the "last updated" date at the top. the history lives in git at github.com/outlmd/outl-site, so you can diff it.

outl contact
$ outl whoami
maintainer: Thiago Avelino
hint: security reports? mention "security" in the subject.