In short
ALL does the work on your computer. But what ChatGPT asks it for (for example, the content of a file) travels over the internet to ChatGPT, and on the way it passes through ALL's relay.
- ChatGPT and OpenAI see what ALL returns to the conversation. OpenAI handles it under its policy, not ours.
- ALL's relay can read that content while it passes, because it ends the secure connection. There is no end-to-end encryption today; it is in preparation (Upcoming updates).
- Your account, license and computer-health data is kept by ALL on Cloudflare, without the content of your files.
This page is a plain-language summary; the Privacy Policy and the Security page are the reference texts.
Data → who sees it
| Data | Who sees it | What to know |
|---|---|---|
| Your files, while they are on your computer | Only your computer. | No file uploads by itself. ALL does not copy your disk: only what ChatGPT asks for in a task, and ALL returns, leaves it (next row). |
| What ChatGPT asks ALL for and what ALL returns: paths, file excerpts, command results, screen state, screenshots | ChatGPT and OpenAI, who are the other end. ALL's relay, while it passes. Cloudflare, where the relay runs. Your computer. | This is the uncomfortable part. ChatGPT receives the content it asks for, and OpenAI handles it under its own policy. The relay ends the secure connection (TLS), so it can technically read that content while it passes. The relay code has no place where it is stored and its Cloudflare logs are off, but we cannot promise what Cloudflare keeps on its own. There is no end-to-end encryption today. |
| Your computer's health signal, about every 6 hours: ALL version, system (macOS, Windows or Linux), whether it is healthy, operations finished today, jobs running, two estimated token numbers for the day and one word for how the last automatic update ended | ALL's control server (a Cloudflare Worker). The ALL team. You, on your activity page. | Never file names, paths, commands or text: the server rejects any other field. The latest record is kept up to 30 days and each day's count up to 400. |
| Activation steps: the install started, finished or failed (and at which stage), ChatGPT connected, first and tenth request, activity on day 7; and where you came from (the site or the utm_source label) | ALL's control server. The relay only reports the name of the step, never the content. | The date of the first time each step happened is kept. It is deleted after 180 days. The installer does not report it if you open it with ALL_FUNNEL=0. |
| Your license and your computers: purchase email, plan, status, the name of each computer at install, Stripe identifiers | ALL's control server and website (Cloudflare KV storage). The ALL team. | The email lets us find your license if you lose the link. There is no card data here. |
| Your ALL account: email, password, linked computers, authorized ChatGPT connections | ALL's accounts service (accounts.all-mcp.fyi, a Cloudflare D1 database). | The password is stored as a salted hash, not in the clear. On the usual connection (ChatGPT, relay, your computer) this service is not in the content path; it is only on the alternative account connection. |
| Card payment | Stripe. | ALL does not receive the card number. It keeps Stripe identifiers (customer, subscription, session), plan, status and the email. |
| A file you move between your computers | ALL's R2 storage (Cloudflare) keeps an encrypted copy for up to 24 hours. | Encrypted with AES-256-GCM. ALL does not receive the file name or the key. But the key travels inside the ChatGPT conversation, so ChatGPT and the relay see it: it protects the stored copy, it is not end-to-end encryption. |
| What you type in ALL Guide, this site's chat | Cloudflare Workers AI, which writes the answer. If you use Alma, the optional voice assistant, also ElevenLabs. | ALL does not store your messages in its databases or logs; the history lives in your browser's memory. It does keep hourly and daily counters tied to a hash of your IP, to limit abuse. Do not type passwords or license links. |
| Todito during the install: system, architecture, computer name, version, which stage it is at. If something fails, also the last lines of the installer logs and the state of ALL's folders, processes and network | Cloudflare Workers AI, through the website (before the computer is registered) or the control server (after). | It does not send your files or documents. Before sending, ALL hides the passwords and tokens it recognizes. The paths of ALL's folders can include your system user name. |
| Todito once installed, when a tool fails in a way ALL does not recognize | Workers AI, through the control server. | It sends the tool name, the error type, a message cut to 240 characters (your home folder is replaced by ~ and the secrets it recognizes are hidden) and the argument names, not their values. |
| Screen images, in visual tasks: when you ask ALL to operate or describe a window, or when it tries to repair a screen action that failed | Workers AI, through the control server. What it describes goes back to ChatGPT. | It only happens in those tasks. If what is on screen is sensitive, do not ask for one. |
| The emails ALL sends you: license, codes, notices | Cloudflare's email service, you and your email provider. | The license email includes your private license link. |
| Purchase notice for the review invitation | Trustpilot, to invite you to leave a review. | Only your email and a purchase reference number, in a separate notice. Trustpilot does not receive your license email or your private link. |
| Everything above, as infrastructure | Cloudflare, the provider where ALL runs. | It processes the traffic and keeps its own operational records under its own policies, which ALL does not audit. ALL has request logging off for the relay, the control server and the accounts; on the website only fixed event codes remain. |
What nobody sees
- ALL's local history. The journal of what was done (what and where, without the content), the undo trash (a copy of each file before it is changed; kept 7 days, up to 2 GB), the recipes and the token counter live in a private folder on your computer. ALL does not upload them. They can contain text from your files or commands; what ChatGPT reads from them with a tool is a result and travels like everything else.
- Masked passwords, keys and tokens. By default, ALL replaces with
***MASKED***what it recognizes as a secret in files and results before they leave your computer. Two limits: it recognizes patterns, so it is best effort and not a guarantee; and if you ask ChatGPT to show them, ChatGPT can repeat the call asking to “reveal secrets”. ALL does not check that you were the one who asked. - Your card number. Stripe sees it; ALL does not receive it.
- Your ALL password in the clear. ALL stores only a hash.
- Files ChatGPT does not ask for. They do not leave your computer.
How to control it
- Remove a computer: on your license page, the “Remove” button. ALL stops working on that computer and its seat is freed.
- Disconnect ChatGPT from a computer: on your activity page, “Disconnect ChatGPT from this computer”.
- Uninstall: the uninstaller deletes ALL, its private folder (journal, trash, counter) and frees the seat. Removing a computer from the license page does not delete those local files.
- Undo: ask ChatGPT to “undo that”. ALL copies files before changing them (7 days, up to 2 GB) and can also undo commands inside a small working folder. It does not cover everything, for example a
git pushor what a program ALL opened does: keep your own backups. - Advanced options: opening the installer with
ALL_FUNNEL=0stops it reporting its steps;ALL_TODITO_DIAGNOSIS=0turns off AI diagnosis of errors. - Ask for access or deletion of your data: write to admin@fynory.app, without credentials or documents.
Scope of this page
Checked against the ALL 1.0 code on October 24, 2026. It is not an audit of Cloudflare, OpenAI, Stripe, Trustpilot or ElevenLabs: each has its own policies. If anything here differs from the Privacy Policy, the policy prevails.
See also: Security, Privacy and Upcoming updates.