Privacy
What stays on your machine, what leaves it, and how to turn reporting off.
What stays local
NALA is local-first by construction, not by policy. The daemon, your terminals and scrollback, tasks, artifacts, agent-to-agent messages, channels, voice models, and MCP integration all run on your machine.
There is no cloud host in the path of your work, and local use does not require a NALA account.
What leaves your machine
Three things, and only three:
| What | When | To whom |
|---|---|---|
| Provider traffic | When you run an agent turn | The provider you chose |
| Release checks and downloads | On update check or install | This site |
| Lifecycle reporting | If enabled | This site |
Provider traffic is the significant one. When you run an agent, your prompts and whatever context that agent gathers go to that provider under that provider's privacy policy. NALA does not proxy, inspect, or retain it — but it also cannot make a third-party provider private.
IMPORTANT
Choosing a provider is choosing a privacy policy. If a repository must not leave your machine, use a local model, not a hosted one.
Lifecycle reporting
Desktop and CLI lifecycle reporting is bounded and identifier-free. It exists to answer whether builds start and run, not to profile you.
Inspect or change the preference:
nala telemetry
Or override it for a single invocation:
$env:NALA_TELEMETRY = "0"
Setting it to 0 disables reporting.
Voice
Voice runs on-device. Dictation uses a local Whisper process; Read Aloud uses a local Kokoro model. Models are downloaded once, then used offline.
Audio is not uploaded to NALA. What you dictate becomes text that goes wherever you send it — including, if you dictate into an agent pane, to that agent's provider.
Diagnostics and support bundles
Diagnostics are generated locally and are not transmitted unless you send them.
WARNING
Diagnostics contain absolute filesystem paths, workspace and repository names, and provider details. Those routinely reveal usernames, client names, and unreleased project names. Review and redact before sharing.
Data on disk
NALA stores its state in a per-user data directory, namespaced by the runtime data suffix so development and packaged installs stay separate. Sessions, task state, artifacts, and scrollback live there.
Deleting that directory deletes your durable work. It is not a cache.