Lorah
Download

Trust · Local-first

Local-first by design.

Your workspace, your keys, your machine. Here is exactly where every byte goes.

Five lanesKeys in your keychainZero markup

Local-first by design

Where your data goes

Five lanes, and everything on this page is a detail of one of them. Lane one is storage, on your computer. Lanes two to four are the calls Lorah makes to work, and each carries the pieces of lane one it needs: a prompt, the memory that fits, a key to authenticate. Lane five moves only when you ask it to.

Lane 1. Stored on your computer.
workspacememoryconversationsmaterialsevery roomevery syncspecialists and their promptsyour keys, in the OS keychainno Lorah cloud to log into

Lane 2. The model you chose.

A specialist's prompt, the memory that fits, the documents assigned to it, and your key go to that specialist's provider. If web search is on, the same provider runs the search.

Lane 3. Lorah's own runtime.

Sync, room decisions and the Compiler, with your brief and files, run on Anthropic, OpenAI or a local model that passed a quality test in Settings; until it passes, they use your Anthropic or OpenAI key. The Compiler names the runtime and asks before it sends.

Lane 4. Operational, tiny.

Licensing and update checks. Optional crash reports, off by default. No workspace content in those operational requests. The details are further down.

Lane 5. Only when you ask.

Read a link: Lorah fetches that page from your computer. An MCP connector you added: traffic to that connector. Export: a file you keep.

What is on your machine

Lorah is a desktop app. The workspace lives on disk where you installed it.

Every specialist. Identity, system prompt, conversation history.
Every memory entry. With the provenance link to where it came from.
Every document. Everything in Materials, and every version of a vetted source.
Every sync run, room transcript and task result. There is no cloud account you can log into to see your workspace from another device, because we don't have one.

Bring your own key

We don't see it, and we don't take a cut.

Stored locally, encrypted. AES-256-GCM through your operating system's keychain: the macOS Keychain, or Windows Credential Manager.
Sent only to the provider you chose. Your key authenticates each call, straight from your computer to that provider's API. It is never sent to Lorah's servers.
Their price, their invoice. You pay the provider's published rate. Lorah adds zero markup on inference.

What a model provider sees

Anthropic, OpenAI, Google, Perplexity or xAI, whichever the specialist is bound to. Inference happens on the provider's servers, which is unavoidable, and Lorah does not see this traffic.

They see
  • The prompt.
  • The model name.
  • Your API key.
  • The completion.
Two levers
  • Don't enable that provider in Settings.
  • Use a different provider for sensitive specialists. Each specialist is bound to one provider at a time.

What Lorah's servers see

Two things, and only two things.

Licensing. Five fields.

When you sign in or refresh your license, license.lorah.ai checks your subscription and stores exactly these:

emailStripe customer IDplan: monthly or yearlysubscription statusdate

Once a day the app checks in with:

random install idapp versionoperating systemlicense typeapproximate countrynever your IP addressnever anything about your work

Only if you claim an offer at lorah.ai/claim:

emailoffer codewhen you claimed and confirmedthe link's advertising labelsreferring siteapproximate country

A claim you never confirm is deleted after 30 days, and one that could not give you a licence after 12 months. The labels, referring site and country are removed after 12 months. A confirmed claim stays with the licence it created, so each email gets one offer licence. Claiming does not add you to any mailing list.

Updates. One GET.

A periodic HTTPS request to the release server to see whether a newer version exists. No workspace content travels with it.

  • No logging of prompts or completions.
  • No error reporting that captures conversation content.
  • No Lorah cloud that stores, mirrors, syncs or trains on your workspace.

Crash reports, only if you switch them on

Off by default. You can turn them on at first run or later in Settings.

Settings
Workspace
Appearance
API keys
License & Billing
Budget
Automatic syncs
Data & Privacy
Notifications
Backup
Advanced

Data & Privacy

Everything here is off until you switch it on. No switch sends the content of your work.

Crash reportserror type, app version, platform, whether a sync succeeded or failed
Off
Redacted diagnostic snapshotadded to a report only if you turn this on
Off
Link reports to my licenseotherwise a report is anonymous
Off
Review queued reports before they send ›

Settings, Data & Privacy. A report carries the error type, the app version and platform, and whether a sync succeeded or failed. Never chat content, memory, file names, prompts or API keys. You can read every queued report before it sends. Two further switches stay off unless you want them.

License and billing are separate from your workspace

A separate service at license.lorah.ai handles checkout for Pro through Stripe, the Stripe customer portal for changing your card or plan or cancelling, and license validation. It has no access to workspace data.

If you cancel, your workspace is never touched and never removed. You drop to the Free limits going forward: three active specialists, fifty memory items, two workspaces, ten documents. Everything you made stays readable.

Export anytime, connect only what you add

You own your data because it is already on your machine.

Export and backup. Export makes a portable archive of your specialists, memory, conversations and documents in Materials, a file you keep and share. Backup, in Settings, is the separate copy meant for getting a workspace back.
MCP connectors. Linear ships as a connector, and any MCP-compatible server you add works the same way. Traffic for a connector you enabled goes to that service. Nothing is connected by default.
This is a product decision, not a marketing line. Project memory is too valuable, and too specific to you, to hand off to a multi-tenant SaaS by default. If you want your AI workspace to compound over years of work, it should live somewhere you control. The formal text is in the privacy policy and the terms.
FormalPrivacy policyWhat we collect, what we never collect, how to reach us.ThenStart hereInstall, one key, a workspace, a first room.