A card. Then your yes.
Calendar, Mail, reminders, tasks — she drafts. She does not save until you confirm. That’s the habit, not a setting buried in a menu.
Nothing leaves unless you flip it on.
Nova is a companion on your Mac — not a recorder in the cloud. You choose the model. You confirm the write.
Privacy Lock
One switch cuts the cloud. Ollama keeps talking. The room stays quiet.
Local if you want it.
Run a model on the Mac. No tokens, no vendor in the loop. Cloud brains are an opt-in — your keys, your bill.
Your keys stay yours.
OpenAI, Claude, ElevenLabs, Tavily — accounts you already have. We sell the surface, not the tokens. Keys don’t ride along when two Macs sync.
She doesn’t film the desk.
No always-on screen capture. No silent archive of what you saw. She waits for a wake, a hotkey, or a typed line.
Mute exists.
Need the room still? Mute her. The pebble can sit there without listening.
What actually leaves.
Only what you turned on. And only after you said so.
If you stay local
Speech and text stay on the Mac. Ollama answers here. Nothing is sent to us. We don’t run a Nova cloud that stores your Tuesday.
If you bring a key
The prompt goes to the provider you chose — OpenAI, Anthropic, and the rest. That’s their privacy policy, not a hidden Nova server. Privacy Lock turns that path off.
If you connect an app
Notion, Asana, Morgen, Paperless, Hue — your account. Writes still wait for the card.
If you sync two Macs
iCloud can carry the companion’s state. API keys stay off that ride.
What this page does not claim.
Trust is easier when the gaps are named.
No badge wall.
No SOC 2, no HIPAA packet, no trust-center PDF. This is a Mac companion, not an enterprise recorder. When those papers exist, they’ll live here — not before.
You still confirm.
A local model can be wrong. A cloud model can be wrong. The card is how you stay in charge either way.
Apple Silicon. Local if you want it quiet. Your own keys if you don’t.