An agent you can hand your inbox to.
Roy reads the most sensitive picture of you that exists. Every design decision below follows from that: it runs where you are, it keeps its secrets in your keychain, it asks before it acts, and it writes down everything it does.
Runs on your machine, only
The server binds to 127.0.0.1. There is no cloud copy of Roy, no hosted version of your data, and no port on the public internet — Funnel-style exposure is never enabled.
Your phone reaches it privately
Remote access is exclusively through Tailscale: HTTPS on a private network made of only your own devices. Not on the tailnet, not reachable.
Secrets in the OS keychain
API keys, OAuth tokens and the local password hash live in your operating system's credential store — never in a config file, never in the repo, never sent to us.
The approval gate
Every sensitive action — run a command, write a file, send mail, post, message, call, trade, unlock — is intercepted and waits for your tap. Deny means stop; Roy never retries around you.
An audit log you can read
Every tool call, every approval and every decision is appended to a plain-text log on your disk. When you want to know what Roy did and why, you read it — not a dashboard's summary of it.
Sessions that die
Logging into Roy needs your local password even on your own network. Sessions are held in memory, so Logout — or a restart — invalidates them everywhere at once.
Your account, your way in
A password (10+ characters, never a common one), a one-time code by e-mail, a passkey, or Sign in with Microsoft / Google — from which we keep only the verified address. Codes and sessions are stored hashed; five wrong guesses lock the door for fifteen minutes.
Export, delete, support access
Everything Roy holds for you can be exported or deleted from Settings. If you ever want us to look at a problem, you grant support access — time-boxed, logged, revocable — and we never have it otherwise.
You decide what's routine.
The gate is strict by default. In Settings you can add patterns that skip approval for actions you consider routine — a specific script, a specific recipient. Some patterns are in an always-confirm list and prompt regardless of any allowlist: recursive deletes, and — for the house — locks, garage, alarm, valves and stove plugs. Home devices are tiered: lights and media may be pre-approved; thermostat and away mode ask; the serious tier always asks.
What runs where
- Server
- Your PC ·
127.0.0.1· no public ports - Phone
- HTTPS over your Tailscale network
- Secrets
- OS credential manager
- Data
- Your disk, your vault; no telemetry
- Providers
- Called on your keys, from your machine
- Sends
- Approved by you, logged to disk
- This site
- Name, email, plan, license key — that's all
Only what you connected, only on your keys.
| Destination | What | When |
|---|---|---|
| Claude / ChatGPT | The context needed for a turn — a thread, a note, your instruction | Every chat turn and every draft, on your API key |
| Perplexity | A research question | When you ask for web research or the daily brief runs |
| Microsoft 365 / Google | Read requests; a draft or send only after approval | Inbox tracking, calendar, Teams asks, Drive reads |
| Slack / Telegram / iMessage bridge | Reads; a message only after approval | When connected |
| Twilio | Call audio and DTMF | Only during a call you approved |
| PXP | A payment, payout or invoice you approved; the card or account tokens it keeps for you | Only when the money desk is on, on your own merchant account |
| QuickBooks / Xero | Reads nightly; an entry only after you accept it | When books are connected |
| Roy's license service | Your license key | On first run and occasionally after — nothing else |
| Us, otherwise | Nothing | Ever |
Finance and money
The trading desk runs on a paper account until you deliberately set it live; every order passes a risk check, then waits for you. The money desk never moves money without a tap, asks two of you above a threshold, and treats a payee's changed bank details as a red flag: verify by phone first, two approvals for 30 days. Your transaction mirror is kept for two years, then exported to CSV and pruned.
Self-improvement
When Roy changes its own code it does so on an isolated branch, runs the test suites, and opens a pull request. It cannot merge; you are the merger.
Reporting a problem
Found something? Email hello@roychat.com with "Security" in the subject. We acknowledge within two business days and credit you if you'd like.
Read the code path, not the marketing.
Every claim on this page corresponds to something you can inspect on your own machine after you install: the bind address, the keychain entries, the allowlists, the audit log.