How Orchestrator protects your work

It runs on your machine

There is no account to make and nothing to sign in to. The board runs on your Mac, at an address only your Mac can reach, and your work stays in ordinary files in your own folders.

• No account, no password, no AruiQ server between you and your work.
• Your notes are plain text files in your own folders, readable without this or any other app, with a full history if you want one.
• It reads the sessions your agents already write on this Mac. Nothing is copied anywhere to make that work.

Nothing leaves unless you choose it

The board makes no request of its own. Three things can send anything out, and you decide each one.

• A feedback report, only when you press Send. You are shown the whole report first: what you wrote, the versions, and the last lines of the board's log, with your home folder written as a tilde and anything shaped like a password or a key removed. It travels over a protected connection or not at all.
• A shared vault, if you connect one. It exchanges with your team's own repository and nothing else; there is no AruiQ service in the middle.
• An agent you start, which talks to its own service as it always did. The board does not stand between you and it.

Updating

There are two ways you might have this, and they update differently. Neither does anything on a timer that you have not agreed to.

If you installed the board yourself, with Homebrew

• The timed check makes no request at all. On starting, on waking and every few hours, it reads that listing on your Mac and compares the version there with yours. You can switch it off, and switched off it does not even read the file.
• Check now fetches that listing again from where releases are published, and nothing else. Update and restart installs the new version and restarts the board. Each one shows you exactly what it will run before it runs, and nothing installs without your press.
• Because the release is not public, those two presses sign in as you, with the credentials your Mac already has for it. The board adds nothing of its own: no identifier, no note of which version you are on, and it never signs in on a timer.
• Offline, it tells you and changes nothing. A failed update leaves you on the version you had. Nothing retries quietly in the background.

If you have the Mac app

• The Mac app can look for a new version, and it asks you first. The first time you open it, it says which address it would check and lets you say no. Said no, it never looks on its own; you can still press Check for updates now, and that one press is the only request it makes.
• Said yes, it is at most one check a day, and one more each time you press the button. A check that fails, offline or otherwise, is not retried: it waits the whole day like one that worked. On a Mac you have marked as a work Mac it never checks on its own at all, whatever you answered, and you can change your mind in the settings in one click.
• Nothing about you goes with the request: not who you are, not which version you have, not that you looked. It is a small file fetched from an address on aruiq.com, and that is the whole of it.
• Nothing installs until you press Install and restart. What it downloads is signed, and the app checks that signature against a key built into it before it installs anything, so a file that is not ours is refused rather than run.

The AI asks first

Aru can think on Apple's on-device model, which runs on this Mac at no cost. Whatever it proposes, and whatever an agent proposes, is shown to you before anything happens.

• A plan is a proposal. It says who made it and what it cost, and nothing in it runs until you accept it.
• Create with AI writes nothing until you press Create: you rename, remove, move and re-level the preview first.
• The on-device model needs a Mac with Apple silicon, macOS 27 and Apple Intelligence turned on. Where it cannot run, the board says so and offers an agent instead, with the cost shown before you send anything.

Nothing is lost by accident

Deleting is not destroying, and a move you regret is one step back.

• Deleted things go to a Recycle Bin and are kept for thirty days by default, which you can set from one day to a year, or to never empty.
• An action can be undone. If something else changed it in the meantime, the undo is refused rather than overwriting what changed.

The CRM keeps your clients where your work is Labs

The CRM is being built in Labs. It is written here with everything else so you can hold it to the same promises; when it ships, each line below is checked against the code like the rest of this page.

• Contacts, deals and their notes are plain files in your own folders, beside the projects they belong to. There is no separate database and nothing to export.
• A link to a chat, a drive or a listing opens the app you already use. The board does not send a message, place a call or reach any of those services for you.
• Bringing a spreadsheet in reads the file on your Mac and shows you what it would create. Nothing about it leaves the machine.