What Camus observes, sends, and keeps

Camus turns real work into LinkedIn drafts, then qualifies public engagement. This page describes the V1 data flow plainly.

On your Mac

  • Password managers, banking, health, HR and private browsing are never captured.
  • Email, messaging, terminal, calendar and calls produce metadata only, never message or screen text.
  • Approved work apps may produce metadata plus locally redacted OCR, limited to 2,000 characters before local processing.
  • URLs lose query strings and fragments. Secrets, tokens and personal email addresses are redacted locally.
  • The encrypted local journal rolls off after 14 days. Its directory is private to your macOS account.
  • Pause cancels capture and send tasks immediately; any in-flight OCR output is discarded before it can be written.

What can leave your Mac

  • Only after a separate, versioned cloud-processing consent in the app. macOS permissions are not treated as consent.
  • A redacted digest is capped at 32 KB; any retained evidence excerpt is capped at 300 characters.
  • No raw Claude Code prompt, email, human-to-human DM or CRM content is allowed in a digest.
  • All model calls go through Camus. The Mac never calls Anthropic or OpenAI directly.
  • A local ledger records every attempted egress and its final result, with date, destination, categories, size, redaction count and payload hash.
  • The server validates each digest before storage, keeps bounded evidence for 14 days, and keeps egress metadata for 90 days. Raw local journal frames are never uploaded.

Slack, LinkedIn and enrichment

  • Slack V1 is the private conversation with the Camus bot. Camus does not request public or private channel history.
  • Camus never posts to LinkedIn. It opens LinkedIn and copies a draft only after your action.
  • After a separate opt-in, Camus checks a tracked public post at day 1 and day 3 through Apify, then stops.
  • Airscale receives one qualified lead's public identity or LinkedIn profile only after an admin confirms “Enrich email” or “Enrich phone”. Each contact type has one attempt, and insufficient credits stop the action without an automatic retry.
  • No batch enrichment, automatic outreach, outbound sequence, bio enrichment, CRM correlation or deal attribution runs in V1.

Retention and control

  • Derived moments, public engagement and qualified leads are retained for 90 days.
  • Published posts and your voice profile remain until you delete them.
  • “Delete my data” starts a deletion job with a 24-hour completion deadline.
  • Every draft remains human-approved. Nothing is published or enriched automatically.