Reference Privacy and your data
Privacy and your data
Zorvo sends no telemetry, never stores your keys, and says which hosts it contacts.
Sign-in stays with the agents
The app never asks for or stores API keys or tokens. Agents sign in with their own tools, and pull request data comes from your own gh login.
Zorvo asks your gh whether you are signed in to github.com and reads only your login and name, to show them in the sidebar and in Settings. It stores neither, never reads or keeps a token, and downloads no picture. Connect runs gh auth login for github.com in a terminal, and you sign in through your browser.
A few hosts, all named
Zorvo's backend contacts these hosts, and only these:
- the ACP registry (cdn.agentclientprotocol.com), to list agents and their versions, and to fetch their logos;
- the download URLs the registry lists, and the HTTPS hosts they redirect to, when you install a binary agent;
- nodejs.org, when you install an agent that needs Node.js and yours is missing or older than 22;
- uv's releases on GitHub, when you install an agent that runs with uvx and you have no uvx;
- Zorvo's own releases on GitHub: github.com/zakyirsyaad/zorvo to ask whether a newer Zorvo exists (a few seconds after start, then about once a day), and, when you click Update & restart, api.github.com to download it. GitHub sends both requests on to its download host, today release-assets.githubusercontent.com.
Every agent and runtime download is checked against a SHA-256 hash that was pinned before the download, and none starts until you click Install. A Zorvo update starts only when you click Update & restart, must come from Zorvo's releases, and is installed only if its signature matches the key built into the app. The window itself makes no network requests: its Content Security Policy only allows the local IPC bridge.
The tools your agents run make their own requests. npm and npx fetch packages from the npm registry, and uvx can download Python and PyPI packages. Your agents talk to their own services as they always do.
Where your data lives
Sessions and transcripts are stored in ~/Library/Application Support/xyz.zorvo.desktop/, as state.json and transcripts/. Session worktrees live in worktrees/ there. On first launch, Zorvo copies sessions and transcripts from the folder earlier builds used and leaves that folder as it was.
Folder limits
The backend only reads and runs in folders you opened in the app.