← Back to Outlier

Privacy Policy

Last updated: 2026-09-29 · Kerr & Company LLC, Grand Rapids, MI

2026-09-29: the list of what leaves your Mac was incomplete. Added three things the app already did: the price check when you open an upgrade window, the daily license re-check, and the services you connect yourself (an MCP server, a Google Custom Search key, a Gist import). None of them is new.

Outlier is a Mac-native local AI app. The privacy story is short because the design choice is to keep things on your Mac unless you opt in.

What never leaves your Mac

• Your prompts, chat history, memory, personas, projects, and uploaded files.
• Anything Outlier's local models generate. Inference runs on Apple Silicon via MLX, on-device.
• License keys after activation. Stored at ~/.outlier/license.json with 0600 perms.
• Bug reports created via Help & Diagnostics. Saved to ~/.outlier/bug_reports/ locally. You decide whether to email them.

What does leave your Mac (only when you opt in)

• The mailing list, if you type an address into a form on outlier.host — most pages here carry a “new models worth running” form. It sends nothing on page load; it posts once, when you press the button. What is stored is the address you typed and which of our sites you sent it from, on our own Cloudflare Worker and D1 database at kerr-subscribe.kerrco.workers.dev — not a marketing SaaS, because dropping one of those onto a site that sells “nothing leaves your machine” would make the claim false in order to collect an email address. No IP address, no user agent, no referer, no fingerprint. That is a statement about the code: the insert binds the address and the source and nothing else, and the worker reads no client header beyond the ones a browser needs to make the request at all. Consent is per site, not per page — every form on outlier.host records the same source, so subscribing from two of our pages is one entry and one email, while the same address given on another of our products is a separate row, and leaving one does not leave the other. Every email carries a one-click unsubscribe. The desktop app never sends this; there is no mailing-list code in the app at all.
• Model downloads from HuggingFace — when you activate a tier for the first time, the weights download from huggingface.co/Outlier-Ai. HuggingFace sees your IP and which repo you fetched. No prompts, no chats, no model output is sent. After the download, the model runs locally forever.
• Cloud API providers (OpenAI / Anthropic / OpenAI-compatible) — only when you explicitly switch to a cloud model in the picker AND provide your own API key. Your prompts and conversation history are sent to that provider per their terms. Your API key is stored locally; we never see it.
• Anything you connect yourself — an MCP server, a Google Custom Search key, a chat you import from a Gist link: each one receives the requests that feature makes. None of them is set up by default.
• Web search — only when you toggle 🌐 search on for a turn. Sends your search query (not your full prompt history) to DuckDuckGo, Mojeek, and Wikipedia (and, during Deep Research only, additionally Crossref, OpenAlex, StackExchange, and Hacker News / Algolia). Results are then fed back into the local model.
• App update check — Outlier periodically polls a public GitHub URL for new release metadata. HTTP GET only. Update payloads are cryptographically signed (minisign) and verified before install.
• The price in an upgrade window — when you open a window that offers Pro, the app asks kerr-lead-agent.kerrco.workers.dev whether founding seats are left, so it can show the right price. The request names the site and nothing else: no license key, no device id, nothing you typed. It is never sent on a timer.
• Founders / Pro license activation — when you paste your license key into Settings → license, the key is sent to the vendor that issued it: live.dodopayments.com for keys bought now, or api.polar.sh for keys bought before 23 August 2026. The app decides from the key itself and sends it to one vendor only, along with a device name so the seat can be counted against your three activations. After that the app re-checks the key with the same vendor at startup and once a day; if the vendor can't be reached, Pro keeps working.

The in-app Privacy Ledger (Settings → Privacy → Privacy ledger) lists the app’s built-in destinations, the license check and the upgrade-window price check included (from version 1.11.866). It is kept by hand from the app’s own network calls, and a test checks it against the hosts the app’s code actually contacts.

What Outlier does NOT do

• No inference telemetry. We do not log your prompts, model outputs, or which questions you ask.
• No analytics SDK in the desktop app. (The marketing site at outlier.host runs scripts from other hosts, and this is the whole list: Plausible, which sets no cookies and stores no IP addresses; Sled, for affiliate attribution; the Meta pixel, which does track across sites; our own affiliate-referral script, served from a Kerr & Company worker, which only reads a partner code off the link you arrived by; our own mailing-list form script, from the same kind of worker, which sends nothing unless you type an address into a form (described above); and, on the home page only, our own assistant widget and founding-seats banner, from a Kerr & Company worker: the assistant sends only the messages you type into it, and the banner fetches how many founding seats remain and remembers in your browser's local storage (key kc-founding-dismissed) that you closed it. None of them are in the app.
• Cookies, and exactly what sets them. Sled sets a single ta_ref cookie only if you arrive through an affiliate link, so that affiliate is credited if you buy; it never records who you are. The Meta pixel sets its own _fbp cookie on every visit, however you arrived, and that identifier is what lets Meta connect this visit to your activity on their platforms. Neither is requested by the desktop app — the shipping bundle contains no reference to either host.
• Affiliate referrals. If you arrive from an affiliate or partner link, the link's referral code is kept in your browser's local storage on this site (key kc_aff) for 30 days and is attached to the checkout link if you buy, so the partner who referred you is credited. This is first-party: it is stored only by this site, is not a cookie, is not sent to any third party by this site, and is not read by any other site. Dodo Payments, the checkout, receives the code as order metadata only when you buy. Clearing your browser's site data removes it.
• No third-party assets on this site except the scripts listed above. The typefaces are served from outlier.host itself. They used to be requested from Google Fonts (fonts.googleapis.com, fonts.gstatic.com) and Fontshare (api.fontshare.com), which meant simply opening this page exposed your IP address to three servers we do not control. It no longer does: the font files are in this site's own repository and are downloaded from the same host as the page. The desktop app never requested them either — the shipping bundle contains no reference to any of those hosts.
• No account required to use Free Nano + Lite or BYOK cloud.
• No automatic crash reporting. Crash logs are saved locally to ~/.outlier/crashes/. You decide whether to email them via the Bug Report flow.
• No reading your filesystem outside what you explicitly mount as a Project, attach as a file, or grant via macOS file/screen permissions.

Payments

Paid tiers (Pro, Founders Lifetime $249) are processed by Dodo Payments, which handles payment, licence issuance and the customer portal. Purchases made before 23 August 2026 were processed by Polar and those licences remain valid. We never see your card details. If Dodo offers an instalment option at checkout — Klarna or Afterpay, where they operate — that agreement is between you and the provider, who will run their own checks; Outlier is not party to it and receives only confirmation that the order was paid.

Children

Outlier is not directed at children under 13.

Changes

If we change this policy materially, we will note the change at the top of this page and bump the "Last updated" date. We won't make a change that suddenly enables cloud telemetry on existing installs.

Contact

Questions: matt@outlier.host

---

This policy is plain English. If a lawyer reading it tells you something is missing, email and I'll add it.