Aha sits next to everything you type, so it’s built to read as little as possible and send even less. Here’s exactly what happens with your text. For the legal details, see the privacy notice.
At a glance
| Feature | What leaves your Mac | When |
|---|---|---|
| Realtime corrections | Nothing. They run entirely on your Mac. | Never |
| Field Assist | The focused field (or your selection and the text around it), its label, your instructions and, unless you turn it off, some surrounding context. | Only when you press the shortcut |
| Smart Paste | The same as Field Assist, plus the clipboard text you’re pasting. | Only when you press the shortcut |
| Insights | Nothing. Counts stay on your Mac. | Never |
Aha never takes screenshots, never records your screen and never sends a stream of your keystrokes. There’s no analytics or tracking in the app.
What Field Assist sends
When you press ⌘., Aha sends the text of the field you’re in (or the selection and the text around it), the field’s label and placeholder, the response length and your instructions.
With Include surrounding context on, which is the default, it also sends:
- The app name and window title.
- The website’s origin only, like
https://mail.google.com, never the page path or anything after it. Those often carry document IDs or reset links. - Nearby text such as headings, and the labels of other fields on the page, never what’s typed in them.
Turn this off in Settings › Field Assist to send only the field itself.
Before sending, Aha masks anything that looks like a secret, such as API keys, private keys and card numbers, and swaps your saved personal info for placeholders.
Where requests go
- With an Aha account: requests go through Aha’s service, which checks your session and allowance, then forwards them to OpenRouter. The service streams the reply back and doesn’t store or log the text.
- With your own OpenRouter key: requests go straight from your Mac to OpenRouter.
Either way, every request asks OpenRouter to route only to model providers that don’t store prompts or train on them.
Settings › Privacy shows the last Field Assist request exactly as it was sent, with placeholders and masking applied. You can copy it or clear it. It’s kept in memory only and disappears when the app quits.
Fields Aha never touches
For both corrections and Field Assist, Aha always ignores:
- Password fields, including fields that only show dots and fields labelled as passwords.
- One-time-code and payment fields.
- Any field whose text looks like it contains a secret, such as an API key, private key or card number.
- Apps you’ve turned off and websites on your blocked list (Settings › Privacy › Blocked websites).
Aha only reads text that apps expose through macOS Accessibility. It can’t see anything an app keeps hidden.
What’s stored on your Mac
- Settings and your dictionary are in a settings file on your Mac. No secrets go in it.
- Your account session, your own OpenRouter key and your personal info are in the macOS Keychain.
- Recent edits and the last request are kept in memory only and cleared when the app quits. Clear recent edits sooner with Clear Recent Edits in Settings › Privacy.
- Logs carry details like the app, field type and timing, not your text, and pass through a filter that removes keys and card numbers.
If you’re helping track down a bug, Settings › Privacy can capture raw text in the logs for 30 minutes. It switches off by itself, and secure fields stay excluded even then.
Clipboard safety
When an app won’t accept text directly, Aha may paste the result for you. It restores your clipboard afterwards, marks its own temporary copy so clipboard managers skip it, and doesn’t touch the clipboard at all when a password manager’s private item is on it. Smart Paste refuses to send private clipboard items or anything that looks like a password or key.
How the app is built
Aha is signed with an Apple Developer ID and notarized by Apple. It runs with the hardened runtime, so other processes can’t inject code into it. Updates are cryptographically verified before they’re installed.