Information Axiom handles
- Account details such as your email address, user identifier, authentication method, and account status.
- Device and connection metadata such as a machine label, device public keys, app version, connection state, and capability declarations.
- Content you choose to create or synchronize, including chats, Notes, attachments, settings, commands, and keyboard learning data.
- Requests and selected context you send to Axiom’s hosted AI, cloud dictation or cloud voices, or to your own AI provider account when you choose one. See AI features.
- Billing records if you buy Axiom Plus or AI credits: your plan, payment status, amounts and Stripe reference numbers. Never your full card number.
- Axiom staff see account usage numbers (plan, spend, storage, activity), never content.
- To operate the service, Axiom also records your devices’ macOS version and Mac model, a coarse country (the country code of the sign-in connection, never the IP address), daily counts of sync errors by type (kept per account, for 90 days), service-wide counts of refused requests by type (not linked to your account), and aggregate share-link statistics (links created, expired and viewed, and their storage). These usage counts are part of operating the service, so they are always on. They never contain content.
Encrypted sync and account recovery
Private synchronized records are encrypted on your device before upload. The account service stores encrypted records and the metadata needed to synchronize them. Your password or sign-in method is not the encryption key.
Axiom provides server-assisted account recovery. It sets up each new device you sign in to, and it restores your data if you lose every device. Our private recovery service runs on Cloudflare and uses software-managed recovery keys. That service, and operators with sufficient administrative access to it, can access those keys and could decrypt synchronized data. Axiom therefore cannot promise that it can never decrypt your synced data. This is not end-to-end encryption that prevents the service operator from accessing your data.
New devices are set up automatically. When a device signs in with an email link, Google or Apple, the recovery service releases your account key to that device through server-assisted recovery. It does this only right after that sign-in (within 30 minutes), only to the keys that device presented when it signed in, and only a limited number of times. Each release is recorded, and we email you that a new device signed in, with a "This wasn't me" button that removes the device and ends its sessions. This means anyone who controls your email account, or your Google or Apple account, can sign in to Axiom and reach your synced data. Protect those accounts accordingly.
These controls reduce risk; they do not remove the recovery service's access to keys. Recovery keys are not hardware-isolated. Cloudflare is an infrastructure provider for this service.
When you use a cloud AI feature, the request and the context selected for it leave your device as described in AI features. A cloud fallback cannot control an offline machine.
AI features
Axiom works with a few kinds of AI services. Which of them handle a request depends on the features and models you choose:
- AI model companies you choose. Axiom’s hosted AI (cloud models in chat and commands) sends your request to the AI model company behind the model you pick. You can also connect your own AI provider account or key. You can pick or change your AI provider at any time.
- On-device models. Local AI, on-device dictation and on-device voices run on your Mac.
- A speech-recognition provider, for cloud dictation.
- A voice provider, for cloud voices.
- A decision and routing service, for paid Axiom AI accounts only.
Axiom’s hosted AI, cloud dictation and cloud voices are processed by AI service providers acting on Axiom’s behalf. They process your requests only to produce results for you, under their agreements with Axiom.
What is sent, and why
- Hosted AI: your message, the conversation so far, and the context selected for that request, such as attachments, a Note, selected text, or a screenshot when a task needs one. It is sent so that a model can answer or carry out your request.
- Cloud dictation: the audio you record while dictating, so that it can be turned into text. It is sent only when cloud dictation is on and you are dictating.
- Cloud voices: the text of each spoken answer, so that it can be read aloud. It is sent only while you use a cloud voice.
- Turn routing (paid Axiom AI accounts only): when you are on a paid Axiom plan and the answer comes from Axiom’s hosted AI, the text of the message you type or say (up to 2,000 characters) and up to two short previous turns of the conversation are sent through Axiom’s service to its decision and routing service, which an AI service provider runs, together with the names and one-line descriptions of Axiom’s built-in tools. The service answers how much work the request needs, whether the result should be checked, and which tools may help. Only these labels and scores come back. Your audio, attached files and screenshots are not sent for routing; dictation is turned into text first. Free accounts, your own AI provider accounts and models that run on your Mac never send anything to the decision and routing service for routing; your Mac decides on its own. If routing is unavailable, your Mac also decides on its own.
- Quick decisions (paid plans): on a paid plan, when the answer comes from a cloud model, Axiom may also ask the decision and routing service small yes-or-no or pick-one questions to work faster: which app action a request means, whether a task has stopped making progress, which web results look worth reading, whether a scheduled check found something that matters, which button or menu item on screen matches what you asked for, whether an action finished or ran into a problem, whether a web page Axiom cites supports a sentence of its answer, which earlier result a follow-up such as “make that shorter” means, and which controls on a web page matter for the task. What is sent is limited to your request, the task, the names of the tools Axiom used, public search results and web passages, what a scheduled check observed, the names and kinds of on-screen and web page controls, a short description of what the screen or page shows after an action, the sentences of Axiom’s answer being checked, and short labels of your recent results and tasks. Your memory, clipboard, passwords and anything typed into forms are never sent: password, payment and one-time-code fields are left out entirely, and passwords, keys, card and bank numbers, ID and health numbers, one-time codes, email addresses and phone numbers are removed from everything else first. Only labels and scores come back. These questions are never sent when the answering model runs on your Mac, and their cost counts toward your plan’s AI allowance.
- Memory suggestions (paid plans): the short memory suggestions Axiom drafts from a conversation (for example “prefers metric units”) are checked by Axiom’s decision service, which an AI service provider runs, so that one-off details and repeats are not saved. It sees only the suggestion text, and only after Axiom’s sensitive-data scrubber has run on your Mac: a suggestion that contains a password, key, card, bank, ID or health number, or that mentions health, religion, sexuality, politics, immigration, a criminal matter or money owed, is never sent, and your Mac handles it as before. Nothing else from the conversation and none of your saved memories are sent, and only a label comes back. This is on by default when you use Axiom AI on a paid plan, and off when you use your own AI provider account unless you turn it on. It is never used when a model on your Mac answers or handles memory, or when Axiom’s optional on-device decision model is installed (your Mac then decides on its own and nothing is sent). Turn it on or off in Settings › Memory › “Use Axiom’s decision service for memory suggestions”; the setting applies to that Mac. Axiom still saves a memory only with its source in the conversation and under your learning settings, and the cost counts toward your plan’s AI allowance.
- Requests are sent under Axiom’s own account with each provider. Axiom does not add your name or email address to them.
What Axiom keeps
- Axiom’s service passes each request to a provider and returns the result. It does not store your prompts, recordings, the text of spoken answers, or the results. Your chats and Notes stay on your devices and in encrypted sync, as described above.
- For each request, Axiom keeps a usage record: the time, the device, the model or voice used, the amount used (such as tokens, seconds of audio or characters), the result status, a one-way fingerprint of the request that stops duplicates, and, for spoken answers, the detected language code. We use it for your allowance meter, AI credits, limits, abuse prevention and billing, and keep it with your account’s billing and usage records.
What providers keep
The decision and routing service for paid Axiom AI accounts, which provides turn routing, quick decisions and memory suggestion checks (Axiom’s decision service), processes requests in the United States, does not use them to train its models, and keeps them only as long as reasonably necessary to provide its service.
Every other AI provider, whether it is an AI model company, a speech-recognition provider or a voice provider, keeps and uses your data under its own terms. When you pick or change your AI provider, your requests go to that provider under its own terms and its own retention. Axiom does not control how long a provider keeps a request or what it uses it for. Read a provider’s terms before you choose it.
Local AI and your own provider
- Local AI, on-device dictation and on-device voices run on your Mac. They do not send your requests to Axiom’s AI service providers.
- If you connect your own AI provider account, requests you send to it go to that provider under your own agreement with it, not through Axiom’s AI service providers.
- When a local model on your Mac answers, turn routing is never sent: your Mac decides on its own and nothing leaves it for routing. When your own AI provider answers, turn routing is not sent either: your Mac decides on its own.
Payments, Stripe and Link
When you buy Axiom Plus or AI credits, the payment is processed by Stripe through Stripe Managed Payments. Link, a payment service of Stripe, acts as the merchant of record: it sells the purchase to you, charges your payment method, and calculates, collects and pays the applicable tax.
What Stripe and Link process
At checkout you give your payment details directly to Stripe and Link, not to Axiom. They process your card or other payment method, your name, email address, billing address or country, and the device and fraud-prevention signals they use to secure the payment. Link decides how that information is used under its own privacy policy, as an independent controller of it. Read Stripe’s privacy policy and Link’s terms.
What Axiom receives and keeps
- Axiom never sees or stores your full card number or security code.
- We send Stripe your account email address and an internal account identifier, so a payment can be matched to your Axiom account.
- We keep the Stripe reference numbers for your customer record, checkout, subscription, invoices, payments and refunds, along with your plan, payment status, paid-through dates, and the amounts and currency you paid.
- Stripe sends us notices about payments, renewals, refunds and disputes. We use them only to keep your plan, AI allowance and AI credits correct. We do not keep your billing address or payment-method details from these notices.
Tax information
To calculate tax, Link uses your billing location and, where you give one, a tax or VAT number. Link keeps the tax records it needs as the seller. Axiom may receive the tax amount charged on a purchase, and keeps billing records for as long as tax and accounting laws require.
Where it is processed
Stripe and Link may process payment information in the United States and other countries where they operate, under their own safeguards for international transfers.
Machine access and approvals
The Axiom daemon runs on a computer or server you control. Actions requested from iPhone, iPad, Mac, web, or another approved entry point are executed under the daemon’s configured permissions, hooks, access tier, and confirmation rules. Axiom does not bypass operating-system permissions.
When an action requires confirmation, approval state is synchronized to the requesting client. Eligible iOS approvals use the device’s Local Authentication system.
Axiom Keyboard
The keyboard provides offline typing without Full Access. Full Access enables account-backed features such as encrypted learning sync and assistant entry points. Axiom does not require Full Access for basic typing, and secure fields or host-app restrictions may replace Axiom with the system keyboard.
Keyboard learning data follows the same device encryption boundary as other synchronized private records.
Crash reports
When Axiom crashes or stops responding, the Mac app sends a short, anonymous crash report automatically. Crash reports are on by default, and you can turn them off at any time in Settings › Privacy & Access.
A report contains the app and macOS version, your Mac’s model, the type of crash, when it happened, a random identifier for this installation, and a technical stack trace that identifies places in Axiom’s own code. It never contains your chats, Notes, files, clipboard, window titles, or any error message text.
A report does not contain your IP address, and we do not store it. Axiom removes personal details such as home folder paths before sending, and our server refuses any report that still contains a home folder path or an email address. To prevent abuse, the server briefly keeps a one-way scrambled form of the network address in a short-lived rate-limit table; it is not stored with the report.
A report is linked to your account only if you are signed in and have chosen to include your account. Otherwise it stays anonymous. We keep crash reports for 90 days and then delete them.
Diagnostics
Optional diagnostics are opt-in: they are sent only if you turn them on. They may include structural connection timing, failure categories, app and operating-system versions, keyboard latency, layout measurements, and acceptance results. Diagnostic events are designed not to include chat text, Note text, tool arguments, tool results, filenames, credentials, tokens, encryption keys, or keyboard content.
Optional diagnostics are separate from the usage counts and from crash reports listed under Information Axiom handles. Those counts are part of operating the service, are always on, and contain no content.
Retention and deletion
Account data is retained while your account is active and as needed to provide synchronization, security, fraud prevention, and recovery. Deleted records use bounded tombstones so an old offline device cannot silently restore them. Operational and security records may be retained for a limited period where reasonably necessary or legally required.
You can export or delete your account from Axiom’s account settings. Ordinary sign-out does not erase local data; removing local data is a separate, explicit action.
Your choices
You can control paired devices, revoke a device, choose between local and cloud AI, turn off cloud dictation and cloud voices, connect your own AI provider, change daemon safety settings, turn off optional diagnostics, turn off crash reports, disable keyboard Full Access, export your data, and delete your account. Device and operating-system settings provide additional controls for notifications, microphone, speech recognition, camera, network, and Local Authentication access.
Questions or requests
For privacy questions, access or deletion requests, or concerns about this policy, contact us. We may need to verify that a request belongs to the account holder before acting on it.
privacy@aiaxiom.app