What stays, what goes, and to whom
Ovillo is built so that we never receive your family's records. This page explains the app and this website separately, in plain words.
Last updated: [date of publication].
The app
What stays on your Mac
Your documents, the record built from them, the search index and everything Ovillo reads. They are encrypted on your Mac with your passphrase (AES-256-GCM, with a key derived from the passphrase) before they are saved. Ovillo has no account, no server of ours and no analytics. We cannot see, recover or delete your record. The code is public, so you can check all of this yourself: github.com/BraedenBDev/ovillo.
Encryption protects the saved files. It cannot protect against malware on your Mac, someone using the app while it is unlocked, or files you download in plain form, such as an appointment brief.
The one connection the app always makes
The Mac app checks github.com/BraedenBDev/ovillo-releases for updates when it opens and every six hours. GitHub sees the app version and your internet address. Nothing from your record is sent.
If you connect the assistant
The assistant is off until you connect it. You choose the service: OpenAI through Sign in with ChatGPT, or your own API key for OpenAI, OpenRouter, Anthropic or another compatible service you name. When you use it:
- Your question and the parts of the record and documents it reads are sent to that service, under your own account and that service's terms. If you use OpenRouter, it passes the text on to the maker of the model you picked.
- Before text is sent, Ovillo replaces names, birth dates, ID numbers, phone numbers, email addresses and street addresses with placeholders such as [PATIENT], on your Mac. Replies are restored on your Mac. This is careful but not complete: some details, such as ages, places and hospital names, are not replaced.
- Original files are not sent. When a document could not be read as text, or the assistant needs to see its layout, Ovillo asks you first, one document at a time. Only a file you allow is sent (a PDF up to 20 MB, or a photo), and it goes as it is, with nothing replaced. No answer within two minutes counts as no. Ovillo asks every time, and never during automatic reviews.
- You agree to this in a tick box before connecting, and the privacy panel in the app shows exactly what was last sent.
The sign-in for ChatGPT happens on OpenAI's own page; Ovillo never sees your password. The sign-in is kept only inside your encrypted vault.
This website
This site sets no cookies, runs no analytics and loads nothing from other companies: no fonts, trackers or embedded players. [Our hosting provider, name, keeps standard server logs (internet address, time, page requested) for N days for security.] The download link takes you to GitHub, which has its own privacy policy.
If you write to us, we use your email only to answer you and delete it when the conversation is over, unless you ask us to keep it. Please never send medical documents or your passphrase.
Who we are and your rights
Ovillo is made by Almost a Lab S.L., [registered address], [NIF]. Contact: possible@almostimpossible.agency.
Because your record never reaches us, we hold no data about it. For anything we do hold, such as an email you sent us, you can ask to see, correct or delete it, and you can complain to the Spanish data protection authority (Agencia Española de Protección de Datos, aepd.es).