Yaochi Desktop
Privacy
Last updated · 2026-08-19
Two parts: how this website handles data, and how Yaochi Desktop handles data.
This website
- There is no account and no form here, and nothing on this site collects personal information about you.
- No analytics, statistics or advertising services are used, and no tracking cookies are set.
- The only cookie is
lang, written when you switch language by hand, and used for nothing but remembering that choice on your next visit. You can delete it in your browser at any time. - The site is hosted on Cloudflare Pages, and the host records access logs (IP address, request time and similar) under its own policy. That data is controlled by the host; we extract no profile from it and retain none of it.
Yaochi Desktop
What follows applies to the first Windows version. That version has not been distributed; this notice takes effect with the first distributed build, and the copy shipped with it governs.
Data sovereignty
Yaochi is a local-first application. Tasks, conversations, workspace evidence, approval records, model exchanges and local settings are all stored in a SQLite database on your own device, under %LOCALAPPDATA%\Yaochi. Yaochi runs no cloud service that stores or processes any of it.
When data leaves your device
| Destination | Contents | Trigger | Your control |
|---|---|---|---|
| The model endpoint you configured | Task context, workspace file excerpts, your messages | While a task runs | You choose the provider and enter the endpoint; change or delete it at any time |
| A search engine (Bing by default; DuckDuckGo or a self-hosted SearXNG instead) | The search terms, composed by the model for the task at hand — they may contain fragments of your task | Proposed by the model, approved by you | Approved each time; pointing it at your own SearXNG keeps the terms on your own server |
| A local MCP server you reviewed and enabled | Arguments and results of MCP tool calls | Proposed by the model, approved by you | Disabled by default; requires explicit install, digest check and enablement |
| A web address you approved | The address itself, and nothing else. Yaochi fetches the page text; it submits no forms, signs in nowhere, and uploads none of your content | Proposed by the model, approved by you | HTTPS only; direct IPs, downloads and sign-ins are refused |
What Yaochi does not do
- Send your data, usage statistics or crash reports to us — we run nothing that could receive them.
- Reach the network without your knowledge. Every row above is something you switch on and approve each time.
- Pass an API key from the OS vault to a model, an MCP environment, logs, artifacts or the browser.
- Submit a web form, sign in to a site, or upload your files to a page on your behalf — the built-in web capability only fetches text back.
Protections
- Secret isolation
- API keys are held in Windows Credential Manager and referenced from the database. The raw value is never persisted to SQLite, the interface, logs or artifacts.
- Outbound inspection
- Content is scanned a second time for suspected credentials before a model call, and is blocked or held for a one-time confirmation of that destination.
- Workspace trust
- An untrusted directory does not flow into model context on its own; writes, command execution and network actions are each approved individually.
- Redacted diagnostics
- A diagnostic export contains platform, version and aggregate counts only — no messages, task content, file paths, identifiers or secrets.
- Backups without keys
- A local backup includes database contents, but API keys in the OS vault are never exported.
What you can do
- Delete a provider, which deletes its credential reference with it.
- Grant or revoke trust on any workspace at any time.
- Export a diagnostic bundle and read exactly what is in it.
- Create or restore a local backup.
- Remove everything: uninstall, then delete
%LOCALAPPDATA%\Yaochi. Keys in the OS vault are deleted by hand in Credential Manager.
Scope
This notice covers the first local Windows x86_64 version. Enterprise control planes, remote MCP and later collaboration features will each carry their own privacy and compliance documentation.
Questions about this notice
Write to hello@yaochi.tech