Privacy & data boundaries

The station is local-first. Studio is a session-gated local interface, and Chat stores conversations locally. Local execution does not make every feature offline: model providers, collaborators, web tools, integrations, account services, and telemetry have different data paths.

Reasoning routes

A model running on this computer can reason locally. With an authorized cloud route, the provider receives the conversation context selected for the request, potentially including attachments or tool results. Your key is used for provider authentication. A collaborator receives permitted context on their machine; sealed team transport protects that context from the relay, not from the receiving host.

Auto can use configured remote routes under your station's policy. It is not an offline switch. Use the Local-only routing setting and a model host on this device when reasoning must remain local. Data-egress checks can block or transform supported sensitive data, but are not a guarantee that every secret or identifier will be recognized.

Actions and network tools

Approving a send authorizes the reviewed destination and payload. Research fetches contact external sites. Integration reads may contact the configured service even when they do not modify it. Inspect module capabilities and credentials before enabling them. A local PDF export is distinct from emailing or posting the PDF.

The airlock enforces action policy. Some permitted read-only or reversible work can run under configured policy; irreversible, unclassified, and policy-changing actions retain their hard approval floors. A draft, dry-run, or model answer is not evidence that a live action succeeded.

Hosted Assistant is a different boundary

Choosing RailCall Assistant submits permitted content to RailHub and its host station. External reasoning providers may also process it. This hosted gateway is not the blind relay used for sealed teammate messages.

The preview implementation clears request content after execution and expires ordinary results within 24 hours of admission. Optional improvement sharing retains submitted content and results for up to seven days. Operational metadata, including usage and execution status, is separate from content retention. Provider-side retention follows the provider's terms. Read the current service disclosure before use; deleting a local Chat conversation does not itself delete remote copies.

Beta telemetry

The released installer and station include opt-out beta telemetry: installation metadata and coarse action events, such as command or module identifiers. It is separate from conversation-content sharing. To disable it, set the environment variable before installation and in the environment that launches the station and CLI:

export RAILCALL_NO_TELEMETRY=1
curl -fsSL https://railcall.ai/install.sh | bash
railcall studio

That export applies to the current shell and its child processes. For an app or service launched elsewhere, configure the same variable in its launch environment and restart it. This does not disable the website's separate analytics or network calls you request.

Receipts, files, and backups

Receipts help verify what executed, under which policy, and with which signature. They can contain operational metadata or sensitive output. Inspect them before sharing. A valid signature establishes integrity and signer attribution under the verifier's trust checks; it does not certify factual accuracy or business success.

railcall backup archives the supported receipt and approval-policy history plus the public signing key. It does not back up your entire station, Chat history, model files, credential vault, or private signing seed. Arrange separate backups for those items as appropriate.

For the broader published policies, read Data Flow, Privacy, and the threat model.