Privacy
What leaves your machine, stated plainly.
Most privacy pages are a list of the things a product would like permission to do. This is a list of what VolnOS actually sends, which is very little, and it includes the part that is inconvenient to admit.
The short version
VolnOS has no account system, no telemetry, and no advertising. Nothing about you is collected, stored or transmitted by the operating system itself.
The one component that sends anything is the assistant, and only while you are talking to it: your message and the output of any tool it ran go to the endpoint you chose. Choose an endpoint on your own machine and nothing leaves it at all.
What is not there
These are absences, not settings — packages removed during the build, so there is nothing to switch off and nothing to switch itself back on:
ubuntu-report— Ubuntu's install-time hardware and configuration report.popularity-contest— the package-popularity survey.whoopsieandapport— automatic crash reporting and its upload daemon.- The MOTD news fetcher, which pulls remote text on login.
There is also no VolnOS account, no licence check, no activation, and no server of ours that a running system contacts on its own.
The assistant
This is the only part of VolnOS that sends anything, and it is worth being precise.
What is sent
When you send a message: that message, the conversation so far, and the output
of any tool the assistant ran during the turn. Tools such as
read_logs, search_files
and system_info can carry personal data in their
output — that is the nature of asking a question about your own machine, and it
is why those tools are named here rather than buried.
Where it goes
To the endpoint configured in Control Panel → Assistant, and onward to whoever serves the model you picked. That may be a hosted gateway, or it may be a server on your own machine or network — in which case the traffic never leaves your hardware. VolnOS ships no model precisely so that this stays your decision.
When
Only during a turn you started. Nothing is sent while the assistant is idle, and there is no background synchronisation, no usage beacon and no “help us improve” channel.
The ten free questions
An image may carry one credential of ours so the assistant works before you have a key: ten questions a day, on a route that belongs to the image — endpoint, model and token all fixed at build time. Those questions travel to our gateway, which means traffic on that route is visible to whoever operates it. Your own key is never sent there, and picking your own endpoint replaces the route entirely.
Your key
An API key you add is stored in your login keyring — not in a configuration file, not in the image — and is only ever sent to the endpoint you attached it to.
Updates
Updates are ordinary apt over HTTPS, from a channel whose indexes are signed with a GPG key baked into the image. Two consequences:
- Downloading an update reveals what any file download reveals — your IP address and which file you asked for — to whoever serves the store. No identifier, machine fingerprint or account is attached, because none exists.
- Integrity does not depend on that server being honest. apt verifies the signature before it installs anything, so a tampered mirror fails rather than succeeds quietly.
This website
No cookies. No analytics. No advertising or tracking scripts. No fonts, stylesheets or images loaded from anyone else's server — the page you are reading makes zero external requests, and its content security policy forbids them.
It is served by Cloudflare, which keeps the standard request logs any web host keeps. The version and checksum shown here are read from the update store by the server, not by your browser, so loading this page does not make your browser contact the store at all.
What you can change
- Point the assistant at a different endpoint, or at your own hardware, in Control Panel → Assistant.
- Remove your API key from your login keyring at any time; the assistant falls back to asking for one.
- Land on the desktop instead of the assistant, also in Control Panel → Assistant. Nothing about the desktop depends on it.
- Decline any change the assistant proposes. Declining is a normal outcome — it is told you said no, and told not to try again.
Questions about this
Ask on the public tracker, or write to updates@volnos.org. If something on this page turns out to be wrong, that is a bug in the page and it will be fixed.