Security and privacy
Navorynth runs on your Windows PC and uses the AI providers you connect. Here is exactly what that means.
Navorynth is a Windows desktop app. Your projects live on your computer.
Project files, deliverables, Project Brains, plans, usage records and settings are stored locally. There is no telemetry, and Navorynth never updates itself or downloads code on its own.
Uninstalling Navorynth keeps your projects unless you choose to delete them.
Your Navorynth account: sign-in and subscription status, nothing else.
The account service knows your email, an account id and whether your subscription is active. Payments are handled by Stripe. It never receives your projects, your files or your API keys.
Bring your own keys for OpenAI, Anthropic, Google Gemini or xAI.
Keys are stored in Windows Credential Manager on your PC, never written to project files, logs or diagnostics, and sent only to the provider they belong to.
We never ask for your keys, including during onboarding. You enter them yourself, in the app.
What each step needs, sent directly from your PC with your key.
When your team works, the objective, the relevant project context and the work in progress go to the provider doing that step. There is no Navorynth server in between.
Known secret files are excluded, anything that looks like a credential is redacted, and a final check refuses any request that still contains one of your stored keys. Filtering is a safeguard, not a guarantee: keep information you don't want to share out of your projects.
How each provider handles what it receives is governed by your agreement and settings with that provider.
Each Project Brain belongs to one project.
What a project knows (its decisions, evidence, findings and open questions) is used for that project's work and is never shared with your other projects.
The AI recommends. You decide.
A recommendation becomes a decision only with your approval. Improve changes only the findings you approved. Nothing is built until you approve the plan and its cost.
Every job has an estimate and a hard maximum before it starts.
Navorynth stops before starting work that would go over your maximum. If a provider runs out of credit mid-job, it stops before the next request and keeps what was finished; you resume after fixing billing. We also recommend spending limits in your provider accounts.
For Build: the AI never gets a shell on your PC.
Installs, builds, tests and commands run in a container sandbox that sees only the project's folder, never your documents, keys or other projects. Tests, builds and the Builder's commands have no network access; package installs can reach package registries, without your credentials.
The sandbox is checked before a build starts. If it isn't available, Navorynth stops instead of running project code on your computer. Build never deploys, publishes or pushes your code anywhere.
Navorynth sends us nothing on its own.
If you need help, you can export a diagnostics file from Settings. It contains no API keys, no project files and no source code. You can read it first and decide whether to send it.
