What Kato reads, what stays, what leaves.

Kato is an app that reads the text on your screen, so this page errs on the side of saying too much. It is written to match what the code does. Where the app can prove a claim mechanically (the egress ledger, the export command), we say so and prefer that you check.

On your Mac (the app)

What Kato reads. With your permission, Kato reads on-screen text through the macOS Accessibility API and, if you grant it, call audio for on-device transcription (whisper.cpp on Metal). Transcription uses Apple's on-device speech until the whisper.cpp model has downloaded. The audio never leaves this Mac. It listens on any call, client or personal, once a meeting app or a browser is in front with your mic in use, and it doesn't tell the others on the call. macOS asks for Screen & System Audio Recording when your first call starts; until you allow it Kato hears only your mic. During a Zoom, Teams or browser call you can press ⌃⌥⌘S to keep a picture of the meeting window with that call. Kato takes these pictures only when you press the keys, only of that window and never the whole display, they stay on your Mac as local files, and it asks for the macOS Screen Recording permission once. The transcript text of a filed call does go to the brain, like any other text Kato reads, so it can write the recap and the follow-up: secret-scrubbed for keys, cards and emails, and logged in the egress ledger. A call you leave unfiled doesn't go, and neither does one filed under a sealed client. Kato can also file a call without asking: when one client's domain or email address on file is said on it, when the meeting window's title names two of that client's people or one's email, or, if you turn on Brief me before calendar calls and give Kato your calendar, when the calendar names exactly one client. That can happen on a personal call, and the text goes when the call ends: Change moves the call and can't take the text back. Names and business detail go as written. Secure text fields (passwords and the like) are excluded by the OS and additionally skipped by Kato. By default Kato takes no screenshots and runs no OCR: it reads the same text a screen reader gets. There is an optional per-app deep read, off unless you enable it from Terminal, and every use of it is logged. With the macOS permission it asks for, Kato also reads your calendar if you turn on Brief me before calendar calls, and it can read Mail threads and open spreadsheets through Apple Events.

Where it lives. The day journal is encrypted at rest on your Mac. Your memory is plain local files you own, under ~/kato. kato export ~/kato writes the whole thing out as a plain-file bundle you own (a SHA-256 manifest and a copy of the on-disk format doc included). The journal lines and the saved copies of what was sent stay encrypted in it, and your Mac's key opens them. We never hold a copy; if you cancel, everything stays with you.

How long things stay. The audio isn't kept. Kato empties a call's transcript and deletes its kept frames after 7 days, unfiled calls included, and keeps the summary, promises and decisions. To keep transcripts past 7 days, run defaults write mx.armando.kato kato.call.retentionDays -int 0. Either way Kato keeps only the newest 50 calls and their plans, personal and unfiled calls included. An older call goes whole, summary and decisions too, though your daily backups can still hold a copy. Its promises stay. That sweep doesn't reach the copy sent to the brain: for a filed call, the scrubbed text stays encrypted on this Mac in the egress ledger's saved copies, the newest 32 MB, and in your daily backups, where nothing expires it. Screen text in the journal is kept until you pick 90, 30 or 14 days in Inspect my brain, under Keeping, and the backups keep their copies either way. Only the app runs these sweeps, so they stop while it isn't running. Kato keeps Time Machine off its journal, capture logs and backups, not the rest of ~/kato, so where Time Machine is on, its copies of call records outlast all of this.

What leaves, and how you can tell. Kato keeps an egress ledger: the cloud calls the brain makes are logged with provider, size and hash, and shown to you in the app. If macOS won't hand the app the ledger's Keychain key, the app makes a new one: the calls are still listed, but the saved copies of what was sent may not open. The kato command line logs its calls only when it can read that key. The brain's calls are:

• AI calls. Two streams of text go: the transcript of a filed call, and the text of the windows Kato files under a client that isn't sealed. By default, distilling runs on hosted Claude through our gateway at www.installkato.com, path /api/llm/messages, authenticated by your license. Paste your own Anthropic key and turn on Use my own Anthropic key instead of Kato Pro in Kato's Settings menu, and calls go directly to Anthropic instead. Until that item is on, the hosted brain answers first; if it fails three times in a row, a key you pasted answers instead, on your Anthropic bill, ten minutes at a time until the hosted brain is back. Anthropic handles that text under its own API terms. The kato command line can run on Ollama and keep that text on your machine. The menu-bar app can't yet: it stays paused without a license, and a license picks the hosted brain first. Each call carries three things besides the text: your license, a random per-device id so the service can count seats, and the app version. Nothing on the server reads the version today; it is there so a future build can be paused without an update. None of the three is derived from your memory, and none appears in the payload. Your license carries your email, and our server keeps usage counts per license and the device ids of the last 30 days, so it can enforce the limits.
• Update check. Fetches a signed manifest from installkato.com. The request carries no identifiers: the URL plus your Mac's standard request headers, which include the app version. The site has a counter for how many distinct addresses check for updates each day, and it is off today. When it is on, the site adds a keyed hash of the request's IP address to a probabilistic counter, which cannot list addresses or hashes back out. Part of that key is random, made fresh each day and deleted after two days. After that, the counter's records cannot be used, by us or anyone, to tell whether an address is in a day's count or to link one address across days. The counter never stores the IP address, and each day's count is deleted after 400 days. Like any web host, ours keeps standard request logs, IP addresses included; the counter adds no address or hash to them.
• License refresh. Periodically re-verifies your subscription. Sends the license token, nothing from memory.

Five things sit outside the ledger: the one-time model download from huggingface.co, the one-request key check against api.anthropic.com when you paste your own key, and, only if you pick those hands, a draft you send by WhatsApp, Telegram or email, which travels inside the link Kato opens for you, a hand-off to a coding agent, where the pack goes to that agent on your Mac and whatever it sends next is its own, and what an agent you connected pulls over MCP: the transcripts and screen rows of the client its folder is bound to go to that agent on your Mac, and whatever it sends to its own model is its own. The first two carry nothing from your memory; the last three are work you chose to hand over. Installing the command-line tool from Kato's menu also registers Kato as an MCP server in those agents, and a folder bound to no client gets nothing from it.

Nothing Kato files under a sealed client goes to the brain or to your agents unless you send it or hand it on yourself. The brain refuses every call attributed to that client, and agents get no content from it over MCP. That wall holds over MCP only: an agent with a shell or file access can run kato or read the brain's files, where call records are plain files. Sealing also erases that client's transcripts, drafted follow-ups, kept frames, journal text and the saved copies Kato filed under it, in your local backups too. kato unseal brings none of it back. The summaries, promises and memory stay, and Time Machine copies aren't covered. kato forget ~/kato space acme removes the client whole, backups included, along with the saved copies Kato never tied to any client, and it has no undo. Later calls under a sealed client keep no transcript and get no summary or promises. Screen text Kato can't tie to that client is not covered: a sealed client's words on a window Kato files under another client can still reach the brain, secret-scrubbed. The Blind Kato switch in the menu bar stops capture within seconds. What it already heard of a call still goes to the brain when the call closes, if that call is filed under a client that isn't sealed. Only four listed files in the brain library may make an HTTP request, and CI checks that.

On this website

We use PostHog for page analytics with autocapture and session recording off, and Do Not Track respected. Events carry a random id PostHog keeps in your browser, and a person profile is created solely if you submit your email. That address then goes to PostHog with the signup, and to our sending provider (Resend), which sends you the download link and keeps the address on our contact list.

Payments run through Stripe; we never see your card number. Billing runs on Kato's own Stripe account, so the name on your statement is INSTALLKATO.COM.

Who else handles what

Vercel hosts this site and the gateway, and keeps its request logs. Upstash stores the license records, usage counts and device ids behind the gateway. Anthropic answers the hosted brain. Stripe takes payment. Resend carries our email, so it holds your address, and the welcome and license emails it carries include your license token. PostHog, in the US, holds the page analytics.

What we don't do

• No selling or sharing of data with third parties for advertising. No ad pixels.
• No training AI models on your data.
• No holding your memory server-side: there is nothing to request a copy of, because we don't have it.

Questions or deletions

Email a human: iam@armando.mx. If you gave us your email and want it gone, one message and we delete it from our contact list and from PostHog. If you subscribed, we keep what the subscription needs, with no end date today: the license record on our server, which holds your email, its link to your Stripe customer, the device ids on your license, and Stripe's billing records. Usage counts expire by themselves, the daily ones after 3 days and the monthly ones after 70.

If you delete the app. Your files stay: ~/kato holds the memory, transcripts, saved copies and backups. First run kato connect ~/kato --undo to take Kato out of your agents, then delete ~/kato to erase what it holds. Kato's Keychain items and the agent settings it backed up in ~/Library/Application Support/Kato stay until you remove them.

Last updated October 31, 2026. If this page and the app's behavior ever disagree, that's a bug. Tell us and we'll fix whichever one is wrong.