Settings and Privacy

Settings is one calm scrollable page. Other pages send you here, because this is where the controls live and where the privacy posture is set. A handful of these settings shape how Existential meets your day. Most you will set once and forget. This page walks through the ones that matter, what each one does, and what stays true no matter how you set them.

What you can change

A few of the settings are worth knowing by name.

When Existential runs. You tell it when your day begins and ends. Those two times set the daily rhythm: the morning brief arrives near your start, the evening close-out near your wind-down, and the heavier overnight work happens in the quiet hours between. The cutover into that overnight pass happens a few hours before your stated end, so the close-out has settled material to draw on. Change these whenever your hours shift, and the rhythm follows.

Your sharing posture. Two controls govern whether anything you write ever crosses into a shared space. One is a single master opt-in for the whole network: leave it off, and the Oracle's working stays entirely on your machine. The other is a set of categories you mark never-shareable, a permanent floor. Anything in a locked category is held back from sharing no matter what, and the lock travels with the content if that content is later merged, split, or renamed. Adding a lock is easy. Removing one asks you to confirm, so you cannot weaken a permanent protection by accident. The sharing posture also lives on the Sharing and teams page, which covers what crossing means and when those surfaces come alive. This page owns the controls.

The morning brief and the check-in. The Oracle writes your brief and your check-in from templates you can edit. Both are plain Markdown files in your own vault. Open one in any text editor, change how it reads or which questions it asks, save, and the next brief or check-in uses your version. Nothing is locked away in the app.

The GitHub connection. Teams use a connection to GitHub, set up with a short device-flow sign-in. On a personal install you will not need it. When your Oracle joins a team, this is the connection that carries that membership. The Sharing and teams page covers what teams are and when they matter.

Cloud inference. This routes the Oracle's thinking to a model you supply instead of the one running on your machine. It is off by default, and it is the one setting on this page that is a deliberate exception rather than a preference. The section below explains the trade you are agreeing to.

For when Existential starts and stops on your machine, see Install and Run. Starting it is something you choose, because the Oracle holds a language model in memory the whole time it runs.

What you keep, whatever you set

The point of these controls is not a long row of switches to manage. The point is that consent is built into the architecture, not promised by a policy you have to trust. Your notes and your local voice never leave your machine unless you choose a channel that does, and the channels that leave are few, named, and visible. Turn the master opt-in off and the Oracle works alone. Mark a category never-shareable and nothing in it crosses, ever, with no override sitting somewhere you forgot about.

What you hold onto is the tether of attribution: when your thinking does shape something the network produces, that link back to you is kept, and your sovereignty over your own thinking is preserved by how the system is built rather than by a setting you might misconfigure. Local-first is the floor here. You can reach past your machine when reaching past it serves you, and these settings are how you decide when.

Cloud inference, and the trade you are consenting to

By default, the Oracle thinks on your own machine. Cloud inference changes that. When you turn it on, you point Existential at a provider you configure and supply your own key, and from then on your prompts are sent to that provider's model instead of the local one. You might choose a broad gateway like OpenRouter, or a privacy-aligned provider such as Venice. Either way, the meaning is the same: those prompts leave your machine.

That leaving is exactly the trade. The local model keeps your thinking on hardware you control. A cloud model can be larger and faster, and you may want that. The price is that the provider you choose now handles the words you send. This is a knowing exception to the local-first guarantee, made by you, on purpose, for a reason you have weighed.

A couple of details make the consent honest. The provider is your account, on your key, not an Existential service standing between you and the model. And your real key is never written into your settings file. You store the key with your system, and the setting holds only a reference to it. The exception you are choosing is real, and it is bounded to exactly the prompts you send while it is on.