BreatheReply is a desktop app, not a service. Your messages don’t pass through us — but "on your machine" needs a precise answer, so here it is, step by step.
When you ask for a reply, the app sends your message and its context straight from your computer to the address you configured. That request never passes through our servers, and we keep no copy. Run a local model and nothing leaves your machine.
The key is stored on this device only, encrypted with Windows DPAPI — the same mechanism that protects your saved passwords, scoped to your Windows account. We never see it, and can’t decrypt it.
A short list, and none carries a message. ① "Fetch the latest profiles" asks our website for a provider list — no message, no key, no identifier. ② Activating and ③ deactivating a device send your licence key plus a short device label. ④ The weekly validity check sends your licence key only, no device label. Licence traffic passes through a small relay we run ourselves — see the FAQ below; it stores nothing and logs nothing.
A reply tool that couldn’t see the conversation would be guessing. Here’s exactly what it looks at — and what it never touches.
Select a message and the app reads that text, plus the app and window it came from, to work out the situation. That’s the whole input.
Some conversations can’t be selected — image-only messages, or a thread you can’t drag across. You can hand over a screenshot instead; it is read on-device by two OCR engines.
It doesn’t open your documents, read your clipboard history, touch stored passwords, or index your disk. It waits for you to select something.
No copy, no archive, no log of what you wrote or replied. Once the draft is on screen, the text is between you and your screen.
Nothing you write is used to train a model — ours or anyone else’s on our behalf. The AI provider you chose has its own policy, and that’s the one that applies to what you send it.
No data broker, no advertising SDK, no third-party analytics in the app. There is no business model here that depends on your data.
There is an optional, off-by-default anonymous counter. It records that something happened and roughly where — never the words. Text is masked, it honours Do Not Track, it is not written to disk, and it is tied to a random identifier rather than to you. You can leave it off and the app works exactly the same.
Point the app at a model running on your own machine — Ollama or LM Studio are the usual choices — and the request never leaves the computer either. That is also the path to working with no API key at all.
For your messages, no — the AI request goes from your computer straight to the provider you configured, never through us. We run exactly two things: a website that serves the provider-settings file and update information, and a small licence relay (the payment platform requires a merchant secret, and that secret cannot ship inside the app). The relay only forwards licence requests; it stores nothing, logs nothing, and never sees your messages.
No. It is encrypted with Windows DPAPI on your device and never transmitted. One thing worth knowing: that protection is tied to your Windows account, so if this computer uses a shared Windows login, someone else using it could read the stored key. Worth a thought before you share a login.
We learn that a feature was used and roughly where. We do not receive the message that was being replied to — the text is masked before it leaves the app.
Not yet. BreatheReply is a Windows app today, and the encryption described above depends on Windows itself.
Read the Browser Companion privacy policy for the extension specifically, or the privacy policy for the full written terms.
