How Gray handles your data

Gray is built so the answer to “where is my data?” is your box. This page is the exhaustive list of exceptions.

Stays on your box

• Conversations and transcripts
• Files, artifacts, and your agents’ work
• SSH keys, paired-host records, pinned host keys
• Your account record and sessions
• The voice-usage meter and your plan entitlement

The app on your phone is a viewer over an authenticated connection inside your tailnet. What it keeps locally (the phone’s secure keystore): the session bearer, your box’s address, your account profile, app-lock preferences, and the once-only state for the in-app review prompt. Settings like voice speed and language live on the box.

Leaves your box

1. Premium voice audio — when you use premium voice, your box mints a short-lived session token and the phone streams audio directly to the realtime voice provider (OpenAI) for that session. On-device voice sends nothing anywhere.
2. Apple purchase receipts — buying a plan goes through Apple, and the purchase is validated to activate your plan on your box.
3. Sign-in code email — if you configure Resend/SMTP, the 6-digit code transits your chosen email provider.
4. Your model providers — prompts go to whatever brains YOU configured (your Claude login, your API keys). That traffic is yours, on your accounts, from your box.

No analytics SDK, no crash-reporting middleman, no telemetry phone-home. The one first-party log: in-app review-prompt events are appended to a file on your own box — they go nowhere else.

Email addresses

Your email exists on your box (your account) and — only if you configure delivery — at your email provider when a code is sent.

Deleting your data

It’s your machine: Data & backups lists every path. Remove them and the data is gone — there is no second copy to request.