Privacy at home

Your information has a home.

Last updated October 3, 2026. This page distinguishes the new household developer preview, the existing AI workspace and the public website.

Household preview

Accounts, memory and tasks are stored in an encrypted vault on the computer running Aspen. Private notes are filtered by signed-in member. Device clients receive shared household context only. Household questions go to the local Ollama runtime; the household core has no cloud-model fallback or analytics. Microphone access was disabled in the earlier household developer preview. Newer HomeOS builds support voice features and opt-in ambient conversation capture. Availability and controls depend on the installed build and the rooms you enable.

Connections you choose

Home Assistant connections send device requests to your configured local server. Downloading a model uses internet through your local model runtime. The separate online Butler service and other external services process requests under their own settings and policies. Using a cloud-hosted Aspen instance places its data on that host, rather than physically in your home.

The existing AI workspace

The separately retained AI workspace has its own optional online tools, providers and remote-access features. Its privacy behavior depends on enabled settings. Household permissions must not be assumed to apply to the legacy workspace.

This website

The homepage, documentation, and guides use first-party, aggregate counters for page views, form interactions, referrals and signups. We store a limited campaign and source category, not full URLs or referrers. Session storage preserves the limited source and campaign category as you browse and avoids repeat interaction counts. It also keeps a validated public referral code for the current tab so an invitation is not lost before signup. No cross-site identifier is created. Browser analytics honor Do Not Track and Global Privacy Control. Saved signup and deletion totals are still counted to operate the waitlist. Daily counters expire after a year; aggregate totals contain no email addresses or household information. Older pages retain their first-party visit counter. Some pages load the Inter font from Google Fonts, which receives the normal request information needed to serve the font. The site also links to services such as GitHub and app stores, which have their own privacy policies.

The Aspen waitlist

If you join, we store your email address, signup time, campaign category, referral source and consent to receive launch and early access emails in our hosted database. This website signup is separate from the private information in your Aspen home. We also store your random referral code, successful invite count, and the code that referred you. Referrers see counts, not the email addresses of people who join. A private token is saved in your browser to restore your invite link; no email address is saved in browser storage. Its hashed form authorizes access. Queue positions are not displayed. Share the public invite link. Common email aliases are grouped with a hashed identifier to prevent duplicate referral credit; signup deletion removes the associated identifier when owned by that signup. We do not sell waitlist addresses. The launch-email checkbox is selected by default and can be cleared before submitting. We record the consent shown when you submit. We use Resend to send a welcome email containing planned use cases and your invite link. Delivery records and a pending-email queue help prevent duplicate sends and retry failures. The email confirms registration, not mailbox ownership; addresses remain marked as unverified; joining is not a purchase or a guaranteed place in an early access program.

Use the unsubscribe link in your email or manage waitlist emails from the browser you joined with to remove your signup. You can also request deletion by emailing hello@runonaspen.com. The unsubscribe link grants permission only to remove that signup; opening the link alone does not unsubscribe you. Email clients may also offer a one-click unsubscribe action. Any launch emails will include an unsubscribe option. We keep signup details until you request deletion or the list is no longer needed for launch and early access. To prevent abuse, a keyed hash of your IP address is kept for up to an hour; the waitlist does not store your raw IP address.

Keeping your computer secure

A local vault protects stored data, but cannot protect it from a compromised operating system. The desktop uses OS key protection where available; headless installations require careful key storage and disk encryption. This is a developer preview with further security and recovery work required before consumer release.