Privacy & safety
Asyncat asks before risky steps, keeps the agent's commands in a sandbox, and keeps your data on your computer. Most of it is set in Settings → Privacy & safety.
Approvals
Before a risky tool runs, the agent asks with an approval card in the chat:
| Choice | What it does |
|---|---|
| Approve once | Runs this one step. |
| Trust this run | Lets the same tool run without asking for the rest of this run. |
| Always allow | Lets the tool run without asking from now on, in Action mode. |
| Deny | Skips the step. The agent carries on without it. |
A file edit shows its diff before you decide: open View changes on the card.
- Plan uses read-only tools only. It reads, searches and suggests, and changes nothing.
- Action uses every tool and asks before risky ones.
- Yolo is Action with every tool approved for you. Use it only for work you trust.
Where new chats start, in Plan or in Action, is set in Settings → General.
Always allowed
Settings → Privacy & safety → Always allowed lists every tool that runs without asking: the ones you allowed in chats, and those of each agent and each Cat. Remove one and it asks again next time.
When nobody can answer
A Cat works without you watching, so it asks in your inbox and waits. See Cats. A run started through the API has nobody to ask, so risky tools are refused unless they were approved beforehand.
Copies
To try something risky, the agent can work in a copy of the project: a git worktree, or a plain copy for a folder without git. You review the changes as a unified diff, then bring them back, discard them, or commit them to a branch. The chat's Code panel lists them under Copies.
The command sandbox
Commands the agent runs (the shell, tests, builds, linters, package managers and the programs it starts) go through the sandbox your operating system already has: bubblewrap (bwrap) on Linux and sandbox-exec on macOS. Claude Code and Codex use the same approach. There is no virtual machine, so nothing extra downloads, and commands run at full speed with the tools you have installed.
Settings → Privacy & safety → Commands the agent runs shows whether it is working. The switch is Sandbox the agent's commands.
- What commands can change: the project folder, temporary folders and package caches. Folders that hold programs, such as
~/.cargo/bin, stay read-only, so a command can't leave a program there for later. A project's git settings and hooks stay read-only too. - What commands can't read: sign-ins, keys, browser profiles and Asyncat's own data look empty to them. That includes
~/.ssh,~/.gnupg,~/.aws,~/.kube,~/.docker,~/.config/gh, saved Git and package registry logins, and the Docker engine's socket. Allow gives one back when a tool needs it, such as~/.sshfor Git over SSH, and Hide again takes it away. - Your saved keys: API keys you saved in Asyncat are never passed to programs the agent starts, nor is anything in the environment whose name says it is a secret, such as
GITHUB_TOKEN.
When commands ask
Commands skip approval only when a parser proves them read-only: every program in the command must be on an allow-list, and its options are checked against what that program can do. ls and git status run straight away; find -delete or git branch -D ask. Anything the parser can't prove read-only asks first. In Plan mode, only proven read-only commands run.
Turning the sandbox off asks you to confirm. Commands can then read and change any file your account can.
Network for commands
| Setting | What commands can reach |
|---|---|
| Open (default) | The network, like any other program, including services on this computer such as Asyncat itself. |
| Package registries only | Package downloads only: npm, PyPI, crates.io, the Go proxy, RubyGems, Maven, NuGet and GitHub downloads. Add your own under Other registries. |
| Off | No network. A model server on this computer stays reachable, so your local model still works. |
With the two limited settings, dev servers that commands start can't be opened in your browser.
The two limited settings need socat. Without it, commands get no network at all and can't reach your local model either, and Settings says so. Install socat from your package manager.
Outside text, keys and sites
Outside text is information
Text from web pages, search results, email, feeds, the clipboard and connectors is marked as information, not instructions. The agent is told never to follow instructions written inside it, and to mention them to you instead.
Saved keys
API keys, passwords and connector sign-ins are stored encrypted. The key that opens them is locked by your system's keychain. If no keychain is available, it is kept in a file only your account can read; on Linux, GNOME Keyring or KWallet provides a keychain.
Sites agents never open
Add sites under Settings → Privacy & safety → Browsing. Every agent's and Cat's web tools refuse them, and so does the built-in browser in the tabs agents use. bank.example covers its subdomains too. Always, whatever the list says:
- agents open web pages only: never files on your computer, Asyncat itself, or the hidden addresses cloud machines use for their settings;
- before typing a password or card number, choosing a file, or pressing a button like Buy, Delete or Send, an agent asks you;
- each Cat browses in a profile of its own, and only on the sites on its list;
- incognito tabs are never shared with agents.
Claude Code, Codex and ACP agents use their own web tools, so these rules don't reach them. See Coding agents.
Learning from chats
Settings → Privacy & safety → Learning from chats has two switches:
| Switch | Starts | What it does |
|---|---|---|
| Remember things from chats | On | Lasting facts and preferences become memories, and corrections are kept as feedback. Off, the agent saves a memory only when you ask. |
| Suggest skills from my chats | Off | After the agent works through a task, the chat asks Save this as a skill? Nothing is written until you pick Save. Each offer is one more request to your model. |
Temporary chats never teach Asyncat anything. See Learning you control and Memory.
Your data
Everything stays on this computer, except what you send to an online model or service. Where your things are kept → Open in Files shows Asyncat's folders and files.
Bring your chats
Under Bring your chats from ChatGPT or Claude, press Pick the export and choose the data export (the .zip, or the conversations.json inside it). The chats keep their titles and dates, and a chat brought over once is skipped the next time. Memories come along when the export has them; otherwise paste ChatGPT's memories in, one per line.
Export everything
Export everything saves one zip file in your Downloads folder with your chats, projects, notes, agents, Cats, memories, settings, uploads, generated pictures, skills and your edited instructions file. Downloaded models are left out, and saved keys stay encrypted in it.
Delete everything
Delete everything… starts over as if Asyncat were new: your chats, projects, notes, agents, Cats, memories, settings, saved keys and sign-ins, uploads, generated pictures, skills and edited instructions file go, and the built-in browser forgets its sign-ins and tabs. Type “delete everything” to confirm. Downloaded models and engines stay unless you tick Also delete downloaded models and engines. Asyncat restarts to do it. Project folders elsewhere on your computer are left alone. It can't be undone, so export first if you might want anything back.
Updates
Installed builds contact GitHub Releases to check for updates, after launch and every six hours. A download is checked against the release's checksums before it installs. Nothing else leaves your computer unless you use an online model or service.