Security & Privacy

Local-First Processing

WindOp runs entirely on your Windows PC as a native application. Your data stays on your machine — no cloud processing, no third-party servers (except the AI model APIs you choose to connect to).

• •Conversations are stored in a local SQLite database on your machine
• •Files are read/written directly on your machine — no cloud intermediary
• •Terminal commands execute in your local PowerShell/CMD/WSL
• •Screenshots are captured locally and sent directly to the AI model — not stored on any server
• •Memory (MEMORY.md and daily logs) lives on your filesystem

Telemetry Policy

API Key Storage

Your OpenRouter API key is stored in Windows Credential Manager, the same secure storage used by Windows itself. This means:

• •The key is encrypted at rest by Windows — it's not in a plain text file
• •Only your Windows user account can decrypt it
• •Other apps on your PC cannot read it without your credentials
• •The key is never sent to WindOp's servers (on the free tier)

Pro users:WindOp manages API keys server-side. Your OpenRouter key is stored in WindOp's encrypted infrastructure — you never handle it directly.

Confirmation Dialogs

WindOp shows confirmation dialogs before destructive actions. These can be configured in Settings → Security:

• •File deletion — deleting files or directories
• •Destructive terminal commands — rm -rf, format, del /s, etc.
• •Git force push — overwriting remote history
• •Registry modifications — Windows registry changes
• •Service management — starting/stopping Windows services
• •Network operations — firewall changes, port binding

Automatic backups are created before file edits. If something goes wrong, WindOp can restore the original file.