MetisDownload
Menu

Privacy and terms

What Metis is

Metis is an assistant that runs on your own computer. You talk to it in your browser or on your phone, and it uses an AI model to answer and to do jobs in folders you pick. In this beta, “the author” means the person who runs Metis and the small server (the “node”) that this policy talks about.

The short version: Metis works on your computer, with your files and your model. It sends nothing to the author unless you say Yes to a question that asks. You can say No and keep using everything.

What stays on your computer

Everything stays here unless a section below says otherwise:

  • Your chats, your files and folders, and the memory Metis keeps about you.
  • Your keys and passwords (for example a Hugging Face token or an API key for a hosted model service). Metis keeps them in its own folder on your computer. It never puts them in a page or a log, and it cuts them out of anything it sends the author.
  • Your model files and the programs that run them.
  • Your answers to Metis’s set-up questions (the profile).

Metis does not have accounts, and it does not ask for your name, email address or location. The daily question and the report form are free text, so if you type your name or an email address into one of them, it goes with that message. That is your choice, and Metis does not look for it.

The two opt-ins

These exist only in the beta (“trial”) builds. A build without the trial flag has none of this and sends nothing; the flag is baked into the build when it is made. The release after the beta is made without it.

Each opt-in is a question Metis asks you once. Not answering is the same as No. No is a full answer and is not asked again, unless its question changes. You can turn either off later on the Updates page, in the card “The daily count”: the switch “The daily digest of counts goes to the author” turns the count off and the records with it, and the switch for the records turns off only the records. Either one stops everything after that. Records start from the moment you say Yes; nothing you did before that is in them. Both stop when your Metis is updated to a release that is not a beta build.

Opt-in 1: the daily count

What is sent, once a day. Numbers and a few plain words, nothing you wrote:

  • how many chats, turns (replies) and tool calls there were, and how many were runs your schedules started;
  • the tokens the model’s server counted;
  • how many errors there were;
  • the name of the model that answered (see below) and the version of Metis;
  • whether Metis’s services are running (the words “registered” or “running”, not their file paths).

It also carries your computer’s name as a label, so the author can tell which friend’s copy a count came from. The first count covers the day before you said Yes, as numbers only.

What is removed first, and what never goes. It never contains what you or Metis wrote, a file’s name or a folder. A model’s name can include a folder path on your computer (the server names its model by its file), so any path under your home folder is written ~, which keeps your Windows or Linux user name out. You can read the next count, figure by figure, before it goes: Updates page, “See the next one before it goes”.

Why. So the author can see whether Metis works on real computers: whether it crashes, how often, with which models.

The daily question. Once a day Metis may also ask “How did Metis do today?” with a text box. It sends only what you type there, when you press Send. “Not today” sends nothing.

Opt-in 2: what Metis did (the run records)

This is a second question, asked only after you say Yes to the daily count. It cannot be on while the count is off. It sends more, and it is the one to read carefully.

What is sent, each day, together with the count. Records of what Metis did while you used it, after the moment you said Yes:

  • what Metis sent the model at the start of each reply: its instructions, your message, and the list of tools it offered;
  • each tool call with its arguments and what it returned (this includes text Metis read from your files);
  • the model’s replies and its reasoning;
  • the exact text of every request Metis sent the model and every reply it gave, with the tokens the model wrote and their log-probabilities (how likely the model found each one), each request without the chat’s earlier turns it repeats to the model (they go with their own turns, or not at all). A request or reply that carried a tool’s call or its answer, or a file’s text (a review of Metis’s edits, notes on part of a long file), goes as its counts only, and so does every request of a reply whose first message carried a document you attached or a block from Metis’s memory (its standing answers, a thing’s rules, the facts you told it); and one whose text held something the cut below removed goes without its tokens, as their number only, and without the reply’s text;
  • what Metis’s memory offered for each reply;
  • the model, server and folder the work ran on;
  • your answers when Metis asked before acting, and the time they took;
  • your thumbs up and thumbs down;
  • every change Metis made to its memory, by the memory’s number only, never its words;
  • who saved each memory (you, on the Memory page; the model; or one of Metis’s own passes), and which remembered things each reply used, by their numbers only;
  • each Undo you press, by the chat and the turn it undid, never a file’s name;
  • the buttons you press in Settings, Models, Setup, your calendar, notes, contacts and mail, and each Ask Metis you open: the page, the button and whether it worked, never what you typed there (a button pressed from a phone on your Wi-Fi or through Tailscale is not recorded);
  • the day each turn ended on your computer’s clock.

Because this includes text from your files and your chats, anything you put in a chat or let Metis read while this is on may reach the author. Turn it off before working with anything private.

What is removed first. Before anything leaves, Metis cuts out, in two passes:

  1. every secret Metis itself stores, by its exact value (the Hugging Face token, the keys of your model servers, the push-notification and forward keys, the relay secret, the second-step secrets), and any path under your home folder is written ~;
  2. then every secret it can recognise by its shape in what Metis read from your files: private-key blocks, passwords in web addresses, values under names like password, token, api_key or secret, bearer and basic credentials, and keys with well-known prefixes from common services. This second pass cuts more than it needs to, on purpose.

Cutting by shape cannot be perfect. It does not find a password you typed in an ordinary sentence, or a value that has been scrambled, written in another encoding or split across lines.

If a record cannot be read or cut safely, it is not sent, and if a place Metis keeps secrets cannot be read, no records are sent that day. A turn that was still open waits for the next day’s send.

Why. To learn what goes wrong and to build better models and skills of the author’s own from real use. The author may use the run records to train the author’s own models, such as the small model that helps run Metis. The author does not sell them, give them to anyone else, or publish them.

A report you send yourself

Separate from the opt-ins, “Send a report” on the Report screen sends a bug report only when you press the button. It contains Metis’s version, the state of its services, your computer as Metis reads it, the set-up log and a recent part of Metis’s records. Your conversation goes in only if you tick “include the conversation” (off by default); otherwise every piece of text in the records is replaced by its length. You can attach one file. Keys and tokens are cut out of it the same way as above. Your chats’ store, your keys and your set-up answers are never read for it.

Where it goes and who can see it

Counts, records, the daily answer and reports are sent as one zipped file to one place: the node’s report mailbox, at a web address baked into the build.

  • The mailbox accepts uploads and nothing else. Nobody can read, list or download from the public address.
  • It reaches the node through Cloudflare’s network, the same path the author’s code server uses. Cloudflare ends the encrypted connection at its own edge and starts a new one to the node, so Cloudflare handles the upload in the clear while it passes and could read it. The author accepted that.
  • What is stored is read from the node’s home network, which is the author’s: anyone on that network can list, read and delete it (the mailbox asks for no key there). The stored files sit on the author’s own server.
  • The mailbox limits a source to 12 uploads an hour, counted by the address Cloudflare reports for the sender. That count is kept in the mailbox’s memory only. No sender address is stored with a report, and the mailbox’s log shows only the local address of the tunnel.
  • Each file carries a name made from your computer’s name and the time it was sent, and the mailbox adds the time it arrived and a short random code. Anything you type into the daily question or a report goes in the same zip.
  • If your computer is linked to a metis.wtf account (below), the count, the records and the daily answer are named by your account’s donor id and the time instead, so you can see and delete them yourself. A report you send with the button is never named by it.
  • If a send fails, or no mailbox is named, the zip is saved on your Desktop and Metis says “send this file”. That file stays on your computer until you delete it.
  • The author does not sell what you send, and does not send it to anyone else.

How long it is kept

The author keeps the daily counts and the run records for one year from the day they arrive, then deletes them.

How to see or delete what you sent

To see it before it goes: the Updates page shows the next daily count, every figure as it will go. Metis also shows when the last count and the last records went. There is no preview of the run records before they go; to stop them, turn the records off.

To stop sending: Updates page, card “The daily count”. Turning off the count switch turns the count and the records off together. The records switch turns off only the records. Both take effect for everything after that.

To see and delete what went under your account: if your computer is linked to a metis.wtf account, your account’s page lists every file that went under its donor id (its name, size and when it arrived) and deletes them all when you ask, and your account stays. Deleting your account deletes them first (below).

To delete anything else you sent: files sent before your computer held the donor id, from a computer with no account, and reports sent with the button are named by computer name and time and are not tied to an account. For those, tell the author your computer’s name and roughly when you sent it, and it is deleted by hand within 30 days. Contact: the contact page.

Your metis.wtf account

You never need an account. Metis works whole on your computer with no sign-in, no internet and nothing sent. An account is for what needs the node, and you choose to make one.

What the account holds: your email address, a display name, your relay name once it is set, your billing state (nothing is sold yet, so it says none), the browsers you are signed in on (a name, when each signed in and was last seen; the name is the browser's own description of itself, its User-Agent, unless the page gives one), your account passkeys (a name, when each was added, and its public key) and your donor id (below). If the author made your account an admin, it says so.

Your donor id. Each account has one donor id: 32 random characters, each a digit or a letter from a to f, made when the account is made. It is not your email and is not made from it. It is handed only to a computer that claimed or linked its name into your account, and only once the account service is connected to the report mailbox; your account's page shows it too, in the names of the files stored under it. While your computer holds it, the opt-ins you said Yes to (the daily count, the run records and the daily answer) go to the mailbox under it. The mailbox learns the donor id and never your email, your name or your account. The account service on the node, though, keeps your email and your donor id together, so what went under it is tied to your account there. Records sent before your computer held it, and records from a computer with no account, stay named by computer name, and the author deletes those when you ask (“How to see or delete what you sent”, above).

What went under it. Signed in, your account’s page lists what is stored under your donor id and deletes it all when you ask; your account stays. The mailbox answers the node’s home network alone, and the account service asks it for you. That network is the author's. The mailbox's own list of reports, which anyone on it can open, shows every file's name and so every donor id, so anyone there can list or delete what went under yours without signing in, or mark your donor id as deleted, after which your computers send as ones with no account.

What it never holds: your chats, your files, your memory, or a password (there are none). It does not keep the session in your browser's cookie, the links it mails you, or your add-a-passkey links: for each it keeps only a one-way fingerprint (a SHA-256 hash) that cannot be turned back into the cookie or the link.

Two kinds of passkey. An account passkey signs you in to your metis.wtf account. The account service checks it with the passkey's public key, which it keeps; a public key is not a secret and opens nothing by itself. The passkeys at your own computer's door, the ones that open your Metis, its chats and files, stay on your computer and are checked there alone. The account service never sees or holds them, and signing in to your account does not open your computer.

The emailed link. If you have no passkey with you, you can ask for a link by email. It works once, for 10 minutes, and only when the page you open it on sends it back; opening it alone does nothing, so a mail scanner that follows links cannot use it. Following it signs you in, and makes your account if you have none: an email address that never followed its link has no account, and the address is dropped from the node at the account service's next change after the link has expired. The page says the same thing for every address, so it never shows whether an account exists. The link alone signs you in; there is no second step at the account yet. Until the author sets up the sender, the emailed link is not offered, and the page says so.

Claiming your computer's name. A computer that joined by an invite already has its relay name, and it works with no account, forever. When you choose, once its Settings row arrives, your computer can claim that name for an account: it sends the name, the email you typed, the time, and a proof made with the computer's relay key. The key itself never leaves your computer. If you are signed in, the name goes to your account. If you are not, and no account has that email, an account is made for it holding the name, and you get a one-time link to add a passkey (it works once, for 10 minutes). That email is not confirmed: no mail is sent to it, since the service has no mail sender yet, so the account holds the address as it was typed (trimmed and lower-cased), unconfirmed. If the email already has an account, nothing is made, and you are asked to sign in to that account first; that answer tells whoever holds a computer's valid proof that the address has an account, and the service counts claims per network address and per name to bound it. An account holds one name. If the answer with the passkey link is lost on its way, the account holds the name with no passkey and no way to sign in until the node's operator makes you a new link.

Signing in to metis.wtf from Metis. In Settings, "Sign in to metis.wtf" links your computer and its relay name to your account. Your computer sends its relay name, its display name (the name you see for it in Metis), the time, and a proof made with its relay key; the key itself never leaves your computer. The account service keeps these as a waiting link that works for 10 minutes, with a one-time code and a fingerprint (a SHA-256 hash) of the check-back token your computer holds, never the token itself. Metis opens the account's page, which shows that code, your computer's display name and your email; you check the code is the one Metis shows, then link it or not. Only someone signed in who has that code sees that page, and it never shows your relay name. Press Link only for a code your own Metis shows you: a link someone sends you may be for their computer, which would then learn your email (and your donor id). While the code works, this browser keeps it too, so you come back to it after signing in. Once you link it, your account holds the relay name (the same rules as claiming: one name per account, and a name another account holds is refused); when your computer next checks, it is told your email and the relay name (and your donor id, once the account service is connected to the report mailbox), and keeps them on the computer. The waiting link, with your computer's display name and its code, is deleted then, or when you say Not now; once its 10 minutes are over it stops working and is deleted with the account service's next change. The account never keeps the display name. "Sign out of metis.wtf" sends the relay name, the time and a proof again: a link still waiting for it is deleted, and your account lets the name go. Your relay name keeps working with no account either way: the relay itself is never changed by signing in or out. On your computer, while a code waits, Metis keeps the code and the check-back token in account_pending.json in its folder (the token is never shown on a page or written to a log); once linked, it keeps your email, the relay name, the computer's display name and the day it was linked in account.json, and the donor id beside the opt-ins. Stop and "Sign out of metis.wtf" ask the account service first; only once it answers does Metis delete those files and the donor id. If it cannot be reached, nothing is deleted and Metis says so.

Delete. Type your email to confirm, and the whole account is deleted at once: your email, name, relay name, signed-in browsers, account passkeys, and any emailed link still waiting to be followed. Every browser signed in to it is signed out. What is on your computers stays there. First, what went under your donor id is deleted at the mailbox and the mailbox remembers the donor id as deleted; only then is the account deleted. If the mailbox cannot be reached, nothing is deleted and the page says so, so you can try again. After that, a computer still holding the old donor id is told it is gone, forgets it, and sends as a computer with no account.

What the node logs: one line per request, with the time, which page of the account was asked for and whether it worked. Never your email, a link, a cookie or a key. To limit abuse, the service counts in its memory how often each network address and each email asks for sign-ins and links, and how often each network address and each name is claimed; the counts are lost when it restarts.

Other accounts on this computer (Linux)

On Linux, a metis:// link you open on this computer and the Metis window reach Metis through a door of its own: a socket with a name and no file. Only one account is let in, the account that owns this Metis. That is the account that installed it with sudo or pkexec; for an install from the software centre, the person signed in at the screen who asked for it, on a desktop or a text console, on the first install only (an update never changes it); and for a Metis you run as yourself, you.

What Metis checks. When a program connects to the door, Linux itself says which account the program was running as when it connected, by the account’s number (SO_PEERCRED). The program cannot choose what Linux says. Metis answers that account if it is the owner and refuses every account but the owner's (root too, unless root is the recorded owner). Before your link hands anything over, it checks the same way that the program holding the door is Metis’s own account or root.

What Metis does not check: a known limit. The account number is all Metis checks. It does not check which program connected, its process or its group, and it does not check whether the program runs inside a container:

  • Linux gives the number as Metis’s own side counts accounts (SO_PEERCRED reports the account as mapped into the user namespace Metis runs in). An account with no number on Metis’s side is reported as “nobody” and refused.
  • The door’s name can be reached by every program that shares this computer’s network (the network namespace). A container started on this computer’s own network shares it, so a program in such a container that Linux reports as the owner’s account is answered as the owner. A container with a network of its own cannot reach the door at all.

Linux lets only your own account, or the computer’s administrator, start a program it reports as your account, and either could already reach Metis as you. The author ruled this is recorded here and not checked for now.

This section is about Linux. On Windows, Metis has no such door, and nothing here describes what another account on a Windows computer can reach.

Changes to this policy

If the author changes what Metis sends or how it is used, this page changes and Metis will ask you again before it sends anything new. The date at the top says when the policy last changed.

Contact

Write to the author on the contact page.

Terms (short)

  1. As is. Metis is beta software, given to you as is, with no promise that it works, keeps working, or is free of mistakes. It can be wrong, and an assistant that acts on your files can damage them. Keep a copy of anything that matters. To the extent the law allows, the author is not liable for loss or damage from using it.
  2. Your models, files and keys are yours. The model files you bring, the keys you add, your chats and your files belong to you. The author does not claim them. A model you run is under its own licence, and a hosted service is under its own terms.
  3. Use it lawfully. Do not use Metis to break the law or to harm other people. Do not use the relay or the report mailbox to attack, overload or probe them; the author may switch off a name or refuse uploads that do.
  4. The beta can stop. The trial, the relay, the mailbox and invite links are run by one person, and may change or end. Sent data is covered by the sections above.
  5. Source. Metis is free software under the GNU Affero General Public License, version 3 or later. You are entitled to its source code: the source of each release is published beside it on the releases page.
  6. Contact: the contact page.