Privacy Policy

Kowork is an open-source desktop application that lets you hand real work to AI agents. It is published by Grégoire Hertault ("we", "us"). This policy explains what happens to your data when you use the Kowork app and the getkowork.com website.

The short version: Kowork collects nothing. No account, no analytics, no telemetry, no cookies. Your files and conversations stay on your device. The app talks only to the AI providers you choose, directly from your device. If web search is enabled, search queries also go to Exa.

The Kowork app

Your data stays on your device

Kowork runs locally on your computer. Your folders, files, conversations, and settings are stored on your device and are never sent to us. We operate no servers that receive your content.

AI providers

To work, Kowork sends your requests — and the files you allow agents to read — to the AI provider you configure (for example Anthropic or OpenAI), directly from your device, using your own account or API key. That exchange is governed by your provider's privacy policy, which you should read. We never see or store this data.

Connectors

Kowork can connect to third-party services you choose (for example Google Calendar). When you connect a service:

• You sign in with the provider directly (OAuth 2.0) in your browser. Your password is never shared with Kowork.
• Sign-in tokens are stored on your device, not on our servers.
• Data is exchanged directly between your device and the provider. It does not pass through us.
• You can revoke access at any time from the provider's settings (for Google, at myaccount.google.com/permissions) or by disconnecting the connector in Kowork.

For a few connectors whose providers do not allow local sign-in redirects, the sign-in flow briefly passes through a Kowork-operated redirect endpoint (api.kowork.dev) that forwards you back to the app. It stores nothing and request logging is disabled on it.

Google user data and Limited Use

Kowork's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Kowork uses AI models to carry out your requests, and data from Google services you connect (such as Google Calendar) may be included in those requests. The use of raw or derived user data received from Google Workspace APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• Google user data is sent only from your device to the AI provider you configure, and only to carry out the task you asked for.
• Google user data is never used to develop, improve, or train generalized AI or machine-learning models.
• Google user data is never sold, used for advertising, or shared with anyone other than your chosen AI provider as needed for your request. One exception: when web search is enabled, the queries the agent writes may draw on the task's context — including data from Google services you connected — and those queries go to Exa.
• No human at Kowork ever sees or reads your Google user data; we operate no servers that receive it.

Update checks

If enabled in settings, Kowork checks GitHub for new versions when it starts; you can also trigger a check from the menu, or turn the setting off. That request goes to GitHub, which processes your IP address and standard request data under the GitHub Privacy Statement.

Web search

When an agent needs current information, Kowork can search the web. The agent writes the search queries itself, based on your request. Queries are sent from your device directly to Exa, without an account or API key, under the Exa Privacy Policy. Web search is enabled by default; you can turn it off in Settings → General.

The website

getkowork.com is a static website hosted on Cloudflare. Like any web host, Cloudflare processes standard technical logs (IP address, browser type, time of request) to deliver and secure the site, under the Cloudflare Privacy Policy. We run no analytics, no advertising, and no tracking on the website, and it sets no cookies.

App downloads are served by GitHub Releases, so downloading the app is a request to GitHub covered by the GitHub Privacy Statement linked above.

What we don't collect

Because the app is local-first and the website is static, we do not collect or store your name, email address, files, conversations, prompts, connector data, usage statistics, or device identifiers.

Your rights

Since we collect no personal data, there is generally nothing held by us to access, correct, or delete: data created by the app lives on your device and disappears when you delete it there. If you are in the European Economic Area, you nevertheless keep all your rights under the GDPR, including the right to lodge a complaint with your supervisory authority (in France, the CNIL). For any privacy question or request, contact us as described below.

Changes to this policy

If this policy changes, the new version is published on this page and in the Kowork repository. Significant changes are announced in the release notes.

Contact

Kowork is an open-source project published by Grégoire Hertault. For privacy questions, open an issue or discussion on GitHub. To report a security vulnerability, use GitHub Security Advisories.