A personal agent is only as trustworthy as the place it keeps your life. Here is exactly where that is and who can see it.
Celindor runs on servers operated by Hostinger in Germany, and your documents and recordings are stored with Hetzner, also in Germany. Your data is stored inside the EU/EEA and is covered by EU data-protection law. Some features, such as push notifications and web search, send parts of it outside the EU; the privacy policy lists them.
Model provider keys and other secrets are encrypted at rest with AES-256-GCM, using a key that never leaves the server.
Each chat runs in its own agent session, and risky actions wait for your approval. The agent can only run commands for accounts that are given command-line access, and then in an isolated sandbox per chat. Every other account's agent has no command line at all.
When you connect a model provider, the content of your requests is processed by that provider under its terms. Recordings and voice messages are transcribed by Google's Gemini whichever provider you choose. Use a local model to keep your chats on your own infrastructure.
You can export your data and delete it. Permanently deleting a document also removes what Celindor learned from it.
Celindor