Privacy

Brut is built local-first, and privacy isn't a policy bolted on afterward — it's the architecture. Here is, precisely, what stays on your machine and what (very little) leaves it.

#What never reaches us

• Your prompts, images, renders and video. All of it is written to your disk (or your NAS), inside your project's outputs/ folder. Brut has no server in the generation path — your work is never uploaded to us, and we cannot see it.
• Your graphs and projects. Stored locally as files. A .brutpack or NAS share moves them between your machines; nothing routes through a cloud.
• Your exports. Exports made from the right-click menu (JPG, web JPG, PSD) are local files written into the active project's outputs/exports folder. Nothing is uploaded or shared by that menu.
• Your API keys. Stored in your OS keychain (Windows Credential Manager). Used only for direct calls from your machine to each provider. Never written into a graph, never sent to us, never in a .brutpack.
• The engine log. The desktop app writes a technical log to %LOCALAPPDATA%\Brut\logs so problems can be diagnosed. It stays on your disk: a feedback report never includes it unless you attach it yourself.
• Updates. The beta has no auto-update and never downloads anything by itself. At launch, while you're signed in, Brut checks whether a newer version exists, through the same small daily check-in (the heartbeat) described below; nothing else is sent for it.

Generation calls go from your machine straight to the provider (Google, OpenAI, Kling, Magnific, Topaz, …) on your key. Those providers see the requests you send them, under their own privacy terms — Brut is never in the middle. One provider-side detail worth knowing: Gemini Omni: Google keeps each Omni request (the prompt, the input images, the clip) on its side for a while, which is what lets the model edit its earlier clips. Same key, same Google terms as Gemini and Veo.

To be precise about that promise: there is no aggregator that Brut operates in the call path — no server of ours, ever. If you choose to run a model through a route (an aggregator you subscribe to yourself, when you hold no direct key), your requests go from your machine straight to that service, on your credential, under its privacy terms — and the node, the confirm dialog and the ledger always say so.

One provider sends nothing at all: video upscales through Topaz Video AI (local) run entirely on your own GPU via the Topaz desktop app you installed — the clip never leaves your machine.

One setup step downloads a tool rather than talking to a provider: clicking Install Kling CLI (for the Kling subscription provider) fetches Kling's official command-line client from the npm public registry — a one-time, user-initiated download of about 1 MB, integrity-checked, carrying no data of yours beyond the download request itself. Brut never auto-downloads anything.

#Your studio timeline stays local

Brut keeps a studio timeline per project — the running record of runs, results, and your conversations with Marcel, the built-in companion. It lives in a plain text file in the project's ledger folder, on your disk or your NAS, and is never uploaded — it travels only where the project itself travels. When you export a project to a folder it's included by default (it's a backup); when you make a .brutpack to hand off, it's left out by default — a checkbox lets you decide either way each time.

Chatting with Marcel works like every generation: the conversation goes from your machine straight to the text-model provider you picked (Google, OpenAI or Anthropic), on your own key, under that provider's terms. Brut is never in the middle, and every call is written to your local spend ledger with its token counts and cost. Images you attach to a chat message (the 📎 button, Send to chat, a pasted or dropped file, or the stills of a node you name in the message) are sent to that same provider as part of that one message — never re-sent on later turns, and only files inside your project's outputs can be attached at all (a file you paste or drop from elsewhere is imported into the project first, like any image you bring in). The composer tells you before sending when naming a node will attach its stills.

When Marcel acts on your canvas, what he reads to do the job — your graph's structure, node prompts and parameters, output file names, lines from the studio timeline — becomes part of that same conversation, so it reaches the text provider you picked, and nothing else. The actions themselves (placing nodes, wiring, running) happen entirely on your machine, and anything that would bill a key stops at an itemized confirm first.

When Marcel speaks up on his own (the Assist slider at Reactive and above — failure diagnoses, run commentary, the recap when you open a project), the material he reasons over is the same local record: recent timeline lines, the error text, what's still running. That goes to your chosen text provider on your key, exactly like a chat message, and each remark is a ledgered call you can see. Set the slider to Off and nothing is ever sent unprompted.

What Marcel remembers also stays on your disk. He keeps a taste profile — a plain-text note about how you like your images — tied to your account and stored beside your library. It is per-account, private, and never synced or exported: it does not travel in a folder export or a .brutpack. Project notes (a small memory for each project) live inside the project and travel with it, like the timeline. Both are plain text you can open and edit; Marcel proposes additions from your recent work and applies nothing to the profile until you approve it.

#The local engine is locked to the app

Only the Brut app can make Brut spend money or change your files. Other programs and web pages on your computer can't.

#The only thing Brut ever sends

When you're signed in, Brut sends a small heartbeat (a daily check-in) at startup and once a day, so we can count active seats during the beta. That's it. Here is everything it contains, verbatim:

{
  "install_id": "a uuid minted once on this machine",
  "app_version": "…",
  "engine_version": "…",
  "os": "Windows",
  "os_version": "…",
  "arch": "…",
  "ts": "…",
  "eula_version": "the date of the beta license you accepted"
}

• No content. No prompts, no images, no filenames, no graph data, ever. Brut sends those eight fields and nothing else.
• The license version you accepted. The date stamp of the beta license you clicked I accept on in the app — so we can show, if ever asked, that a seat took the terms. A date, nothing more.
• Nothing while signed out. If you're not signed in, no heartbeat is sent at all.
• The answer carries two things back: whether your beta seat is still active, and the version number of the latest installer. If a seat is revoked for a breach of the beta license, Brut signs you out and stops paid generations on that machine; your projects, outputs and keys stay exactly where they are. If the latest installer is newer than the one you run, a single line under the toolbar says so with a link to the download page; same version, no line. Nothing extra leaves your machine for that check: the version you run was already in the heartbeat.
• You can see this exact list any time in ⚙ Settings → Account.

#Feedback — only what you type, only when you click send

The 💬 Send feedback button is the one other thing that can send data, and it's entirely user-initiated: nothing is ever sent until you press Send. A report carries your message, your account email (so we can reply), and — only if you leave the checkbox on — a diagnostics block: the same eight heartbeat fields plus the last few error messages from the Activity panel. The modal shows that block byte for byte before you send it ("Show exactly what will be sent"). Never your graphs, images, prompts or keys.

The desktop app's quit-time prompt ("Before you go") is the same form under the same rule: it appears only after a session that actually ran something, and nothing leaves your machine unless you press Send & quit. Quit without sending is always one click.

#Sign-in

Identity runs through Supabase (magic link or Google/GitHub). It's used only to know who's using a seat — never to store your work. Your sign-in is stored in your OS keychain and checked on your machine, so it works offline. This is identity only.

#The website

getbrut.app and this documentation load nothing from third parties — fonts are self-hosted, and there are no analytics scripts or trackers. The site has its own short notice covering the beta form, sign-in and emails: getbrut.app/privacy. The beta sign-up form is the one place you hand us an email, and only if you choose to. When your seat is approved we send one approval email to that address, and the download page asks you to sign in with the same account the app uses — that sign-in is checked against the approved list to serve the installer, and nothing else is recorded.

#In short

Your keys, your work, your machine. The only thing we ever learn is that a version of Brut is running on some install, on some OS — and only while you're signed in.