Privacy · Control Tower and MEZ Pipeline
What leaves your Mac. And what never does.
Both apps run on your Mac. This page lists everything they send — to us, and to anyone else — in plain words. Updated 28 September 2026.
On your Mac
Control Tower reads the logs your agents already write, into an archive that is redacted before it is written and encrypted at rest. Sending anything to a team is opt-in, per project, chosen by the operator.
MEZ Pipeline keeps every review on your Mac. Findings sync across devices is not in this version.
Reviews and Kai — the model you choose
MEZ reviews run from your Mac, with your own provider key or a local model. The code under review goes from your Mac to the provider you picked — or nowhere at all, with a local model.
Kai runs on your Mac. No project leaves it unless you switch a provider on for that project yourself. Silent is the default.
Control Tower holds no provider credential.
Enrolling a Mac
To use a plan or join a team, a Mac enrols with our relay. It sends its device public key — the private half is generated on the Mac and never leaves it — a device name, and, to join a team, the invite code.
It gets back a credential for the relay, handed over once — we keep only its hash — and revoking the device invalidates it immediately. Your plan arrives as a signed token that your Mac checks offline.
Improvement signals — and how to stop them
Both apps send one small batch a day to our relay, and it is counts only: the app’s version and macOS major version, how fast it ran (refresh times, main-thread stalls, memory), how often each screen was opened, our own error codes, and how many improvements your agents proposed in each category.
It carries a random install id you can replace, and no account, device key, project, file name, code, prompt, finding or transcript. The text of an idea leaves only when you choose to send that one idea to us, after seeing it.
The relay drops any field not on the app’s own allow-list, stores no IP address with the batch, keeps it apart from all team data, and deletes it after 90 days.
Signals are on by default; in the EU, the EEA, the UK and Switzerland — or when the Mac’s region is unknown — they stay off until you accept. Settings → Export & trust → Privacy shows the exact next batch and turns it off in one click; off deletes the waiting batch and sends nothing.
Team sync — we cannot read what we store
When you share with a team, everything is encrypted on your device, under a team key generated on a device and never sent in the clear. Our servers store only ciphertext and never hold a team decryption key — a test on every build fails if the server ever gains a way to decrypt it.
What our servers see: ciphertext, wrapped keys, and routing metadata — team and project ids, member and device ids, timestamps and record counts. Never file names, project content, or anything decrypted.
Two limits, said out loud
- Removing a device does not yet re-key the team. It loses access to the relay at once, but a removed device that already holds the key can still decrypt what it already has.
- There is no recovery by us, and no key escrow yet. If every enrolled device in a team loses its keys, that team’s stored data cannot be recovered. Keep at least one enrolled device you control.
This website
nobukaizen.com sets no cookies, runs no trackers and loads nothing from anyone else. Your theme and motion choices are kept in your own browser’s storage and never sent. The contact form sends what you write to the studio’s mailbox, and nowhere else.
Questions
Ask us anything about this page — write to the studio.