DorkOS
Get started

Privacy Policy

Last updated: October 12, 2026

DorkOS is made by 144 Studio, LLC. When this page says “we,” that is who we mean.

The short version

  • The DorkOS app runs on your computer. Agents send information to the AI services you choose. Optional DorkOS-managed connections also send account actions and selected notifications through our servers and Composio. You choose which accounts and agents can use them.
  • This website collects almost nothing: your email if you subscribe, plus your name and email if you choose to make an account. We also count basic page visits. In the EU and UK we ask first with a banner. Everywhere else it is on by default, and you can switch it off in one click below. Either way, if you say no we still count you, but anonymously, with no cookies.
  • We do not run ads, we do not sell your data, and we do not track you around the web.

The app, website, and hosted services

DorkOS includes an app you run, this website, and optional hosted services. Each handles different information. Connecting an account or turning on notifications can send information beyond your computer, as explained below.

The DorkOS app: it runs on your machine

Your installation keeps local files, settings, and session records on your computer. An agent sends prompts, code, and other information it needs to the AI service you choose. That service handles the information under its own terms and privacy policy.

Information from connected accounts can become part of an agent’s work. For example, an email result may be sent to your chosen AI service. A notification sent to a room or messaging channel can be visible to other people there. Choose accounts, agents, and destinations with this in mind.

Optional usage telemetry is separate from the information needed to run hosted features. The settings below control telemetry. They do not disable account access or a notification you enabled. If you choose to help, the app can share a small daily heartbeat and anonymous marketplace install counts so we can see roughly how many people run DorkOS. It sends a random install id, the DorkOS version, your platform and chip type, which runtimes you have on, whether the tunnel and cloud link are enabled, and rough counts. It never sends your prompts, code, file paths, hostname, username, or session content as telemetry.

If you also turn on feature-usage data, the app tells us when it starts, when you start a new chat, when you finish or skip setup, and once a day that it is running. If you installed with a command copied from this site, that command may carry a short random install tag. Your computer keeps the tag either way. It leaves only with the setup event, and only if feature-usage data is on.

The first time you run DorkOS, it shows a notice explaining this and sends nothing on that first run. You can turn it off any time in three ways: run dorkos telemetry disable, set the environment variable DO_NOT_TRACK=1, or use the Privacy and Data tab in settings. Crash reporting is a separate choice and stays off until you turn it on. The telemetry page shows the exact payload, word for word.

Optional DorkOS-managed connections

You can choose DorkOS-managed access when connecting a supported service. DorkOS uses Composio to link your service account and carry out approved actions. Composio holds the service account’s login access in its vault. Our servers hold the project key used to make those requests. Agents do not receive those credentials.

Some supported services ask for account details such as an API key or password. You enter them on a secure form on dorkos.ai. Our servers pass these details to Composio without saving them. Agents and local DorkOS installations never receive them.

When an agent uses this access, the action’s inputs pass through our servers and Composio to the connected service. The result returns through the same path. Inputs and results can include email text, documents, task details, or other information needed for that action.

We store records needed to connect the right account and enforce your choices. These include your DorkOS account and linked installation, connected service references, agent access, and notification settings. We also record action names, request identifiers, status, timing, and usage information. Action receipts do not store an action’s input or result content.

You choose which agents can perform approved actions. Receiving notifications requires a separate choice of activity and destination. Granting action access does not also grant notification access.

Notification content and retention

For managed notifications, Composio sends selected account activity to our servers. We keep an encrypted delivery copy so your linked installation can collect it later. Our service can decrypt that copy to deliver it. This encryption does not hide the content from DorkOS.

The delivery window ends seven days after our servers receive the event. Retries and transfer to your installation do not restart that window. We clear the hosted content sooner when your installation confirms it has stored the event. That confirmation does not mean an agent has acted on it or a person has read it.

Your installation keeps its own protected delivery copy until delivery is recorded, cancelled, or the original window ends. Clearing a delivery copy does not erase a message already delivered to an agent, room, messaging service, or AI service.

Scheduled cleanup clears expired content in bounded batches, so an outage or backlog can delay physical deletion. Expired content cannot start a new delivery. We keep separate event identifiers and delivery status for a 30-day cleanup window to prevent duplicate processing.

Using your own service account

If you use your own Composio project, your installation contacts Composio directly. DorkOS hosting does not carry those account actions or buffer those direct notifications. Composio and the connected service still handle the information. Your local setup holds the project key and notification signing secret.

Other service routes can have different data paths. Review their setup and the service’s privacy policy before granting access. Ordinary Slack and Telegram conversations use your Messaging setup; account notifications have separate permissions.

Stopping access and deleting data

You can remove an agent’s access, remove a notification, or disconnect an account in the app. These choices stop new authorized use once the relevant change takes effect. An installation that is offline may need to reconnect to receive a hosted permission change. A request already sent to another service cannot be recalled.

Disconnecting asks Composio to remove the linked account. Cleanup can remain pending if a service is unavailable or the required access has been revoked. Removing one notification does not remove another notification that shares the same service setup.

Removing access does not erase every record. DorkOS can retain account history, usage records, security records, and temporary delivery records. It does not erase messages already delivered or records held by Composio, your connected service, or your AI service. Use those services’ controls for their records.

The website: what we collect

If you subscribe to the newsletter

We ask for your email address and nothing else. We send one confirmation email, and you are only subscribed after you click the link inside it. We keep your email so we can send you release notes, about twice a month. One click unsubscribes you. Your email lives in our database and in Resend, the service that delivers the emails.

If you create a DorkOS account

An account is optional. You only need one to link a device or use signed-in features.

  • We collect your name, email, and password. Your password is stored scrambled (hashed), never as plain text. You can also sign in with GitHub or Google instead.
  • While you are signed in, we keep a session. For security, that session record includes your IP address and browser type.
  • If you link a device, we save its name, operating system, and DorkOS version so you can see and manage your linked devices.
  • If analytics is on and you are signed in, we tie your website activity to a random account ID (never your name or email) so we can see how signed-in people use DorkOS. If analytics is off, we do not.
  • You can delete your account from your account page. This removes the account and its active hosted account-access data. Required security and audit records, temporary cleanup records, and records held by other services can remain. We also ask PostHog to erase the analytics record tied to your account.

When you install from the Marketplace

We count installs so we can show how popular a package is. We record the package name, whether the install worked, how long it took, and a random one-time ID.

We do not record your name, IP address, username, computer name, or which folder you installed into. The count is anonymous, and we cannot tie it back to you.

What about analytics and cookies?

We use PostHog, a privacy-friendly analytics tool, to understand how the website is used. We count page visits, desktop app downloads, and a few clicks, like copying the install command. There is no session recording, we do not log what you type, and we do not use tracking that follows you to other sites.

How we ask depends on where you are. In the EU, the EEA, the UK, and Switzerland, we show a banner and count nothing with cookies until you accept. Everywhere else, analytics is on by default, and you can turn it off with the switch below or from the banner if you see one.

Here is the honest part: if you decline, ignore the banner, or turn analytics off, we still count your visit, but anonymously. No cookies, no stored ID, and no way to connect today’s visit to tomorrow’s. We use a privacy-preserving code that is reshuffled every day, so the count cannot be traced back to you. We also honor your browser’s Do Not Track and Global Privacy Control signals: if either is on, the cookie version stays off automatically.

When you open a desktop app download link, our server counts it: which app (Mac or Windows), whether a build was ready, the name of the site that sent you (never the page), and a campaign tag if the link had one. Each count carries a random one-time ID, no cookie, and not your IP address. If Do Not Track or Global Privacy Control is on, we do not count it at all.

If analytics cookies are on when you copy the one-line installer or the npx command, the copied command ends with a short install tag, like --ref=k3j4mnb8x2qa.hn. The tag is new for each copy. It holds a random code and, if the link that brought you had one, its campaign tag. We record the same tag with your copy. If you later turn on feature-usage data in the app, we can count how many copies led to an install by matching the tag. Matching the tag ties that one copy to that one install. Nothing merges your website visits with the app or with an account. Your name, email, and IP address are never part of it. Without analytics cookies, or with Do Not Track or Global Privacy Control on, the command you copy has no tag. The desktop downloads and npm install -g never carry one.

Cookie-based analytics

Off. We count your visits anonymously, with no cookies and no cross-day tracking. Turn it on to allow the cookie-based version.

The cookies we set are the basic ones: a login cookie if you sign in, a small cookie that remembers UI preferences like whether a sidebar is open, and the analytics cookie only if you have it on. We do not use ad cookies, and we do not sell cookie data. Our Cookie Policy has the full list.

What we never do

  • We never sell your data.
  • We never run ads.
  • We never track you across other websites.
  • Your installation does not upload its whole session history or codebase to us for managed connections. Our hosted service processes the action and notification content described above when you use it.

Other services

Composio, each connected service, and the AI service you choose have their own terms and privacy practices. Their retention, deletion, and model-training rules can differ. This policy does not promise that another service deletes its logs or never uses data for training.

Your choices

  • Turn cookie-based analytics off (or on) with the switch above, any time.
  • Unsubscribe from any email with one click.
  • Delete your account from your account page, subject to the retention limits above.
  • Email us to ask what we hold or to have it removed: hey@dorkos.ai.

Kids

DorkOS is a tool for developers. It is not meant for children under 13, and we do not knowingly collect their information.

When this changes

When we update this page, we will change the date at the top. If it is a big change, we will say so clearly. No quiet edits.

Contact

Questions about your privacy? Email us at hey@dorkos.ai.