What OffiAI reads, stores and sends

OffiAI’s public macOS preview reads local session information to show your agents at desks. It sends no session data to Delicatino. When you ask OffiAI to start or continue work, it passes your message to the relevant agent, which keeps using its own provider.

This describes the public beta 29 code checked on 24 October 2026. It is a technical explanation alongside the app privacy policy; it does not replace that legal text.

Update, 26 October 2026: beta 40 lets Reception start Codex and Gemini sessions in their own terminal session and send your replies to them. This page has not yet been re-checked against that code; sessions you start in your own terminal are still read-only as described below.

Claude Code CLI

OffiAI downloads Claude Code from Anthropic only when you choose Install. For an OffiAI-managed installation, opening setup, refreshing status and restarting do not check for updates. ‘Update available? Check now’ requests release metadata from downloads.claude.ai. A separate ‘Update’ click downloads and verifies the checked version before activation. Cancelling or restarting does not authorize a later request. Failed checks or updates keep your working version available. The managed binary and previous version are stored inside OffiAI’s app-data folder; other installations keep precedence.

Sign in with Claude starts Claude Code’s sign-in flow and opens the provider’s page in your browser. Claude Code and the browser communicate with Anthropic. OffiAI never sees your password.

OffiAI runs claude --version, claude auth status and claude agents --json to check availability, sign-in and active sessions. It reads session transcripts under ~/.claude/projects/, including subagent transcripts and their .meta.json files. If an absolute CLAUDE_CONFIG_DIR is configured, its projects/ folder is used instead. The transcript reader is confined to that folder; it does not open Claude’s credential or settings files.

These transcripts can contain prompts, answers and tool results. OffiAI extracts bounded desk information such as status, titles, model and usage information, messages and short tool-result excerpts. Reading a transcript does not mean copying the entire transcript into OffiAI’s settings.

Watching a session does not send it a prompt or edit its transcript. Only when you send a brief or message from OffiAI does it start or resume a Claude Code process and write your message to that process’s input. Claude Code then manages its own transcript and any work it performs. OffiAI saves the desk-to-session connection locally so a session started in your chosen folder can be continued after a restart. Any tool approvals you answer in OffiAI are passed to the running CLI.

Claude app and Cowork plugin

The plugin’s bridge connects only to 127.0.0.1, the address of your own Mac. It sends session start, heartbeat and end messages, plus OffiAI tool requests. Those requests carry a conversation label, an optional conversation ID and task title, an event kind and the short summary Claude chooses to report.

For a turn marked (from OffiAI), the plugin instructs Claude to send an answer copy through offiai_reply, limited to 2,000 characters. That copy can contain details from the answer. The plugin instructs Claude not to send secrets, verbatim prompts, files or transcripts; these instructions are not a guarantee that Claude’s chosen summary or answer contains no sensitive information.

The bridge also carries protocol information: a bridge session ID, timestamps, sequence numbers, plugin version, boolean host markers, MCP method and parameters, and metadata key names rather than metadata values. It does not independently collect your files or conversation transcripts, and it has no remote destination of its own.

New Cowork task passes your text to the Claude app in a local deep link; you review and send it there. The optional Send now feature types your message into the selected conversation and submits it. Both add the (from OffiAI) marker.

Codex CLI

The hooks report session lifecycle and activity over 127.0.0.1. Reports contain session identifiers and delivery metadata, fixed activity labels, a prompt’s word count and tool names. They do not carry the prompt text, tool arguments or tool outputs.

Separately, OffiAI reads rollout files under ~/.codex/sessions/ and titles from ~/.codex/session_index.jsonl. It also supports an absolute CODEX_HOME and discovers eligible ~/.codex-* homes. This reader is read-only: it does not open Codex’s authentication file, configuration file or SQLite state. It extracts session status, model and usage information, a masked task label and the latest masked answer.

Installing hooks is a separate, explicit change: the installer adds OffiAI entries to hooks.json, saves a backup when replacing an existing file, and installs its helper under OffiAI’s support folder. Observing sessions does not send work to Codex.

Gemini / Antigravity

This integration is early and read-only. It reads the summaries database at ~/.gemini/antigravity-cli/conversation_summaries.db, checks its SQLite sidecar files and lists names in presence/. It does not read the presence files’ contents or run agy to observe sessions. Summary titles and previews can appear at desks after masking. If installed, the optional hooks report fixed lifecycle and activity information locally. OffiAI does not send prompts through this integration.

What stays on your Mac, and for how long

App data: ~/Library/Application Support/Oficina/. The historical folder name is intentional. It contains local office/device identifiers, settings in preferences/, the office layout in office/, and recovery files in quarantine/. Saved records can have previous-version backups. The window’s own browser storage there remembers the ID of a brief that is still on its way and your office-motion preference.
Saved desk connections: local-bindings-v1.json inside that folder stores session IDs, desk connections, Reception request IDs and working/configuration paths. It is not a message transcript. A damaged copy is set aside next to it as local-bindings-v1.json.quarantine-…. App-managed Claude working folders can be under connectors/claude/desk-…/; tasks started in a folder you choose work there instead.
Reception receipts: reception-receipts-v1.json in that folder, readable only by your user, lets Reception recognise a brief it already received, so a restart never sends it twice. Each receipt holds a random request ID, timestamps, its state, the desk and session it went to and a short outcome message. Instead of your folder and brief text it keeps a keyed fingerprint (HMAC-SHA-256). The key is random, made on your Mac and stored in the same file; it never leaves the Mac. Finished receipts shrink to ID-only tombstones after 30 days, or sooner once 10,000 receipts are kept; at most 50,000 tombstones remain.
Published reports: only when you turn on Publish to the office in Settings (off by default) can a Claude Code session started from OffiAI publish a report to the Reports view. Reports are kept in published/ inside that folder. index.json and its recovery copy list each report’s masked title, desk, session ID, time, size and checksum, and for an attached file its working folder and path. Each report’s own folder holds a content file: the masked Markdown text, or an unchanged copy of the attached file (PDF, image, spreadsheet or text). Limits: 200 reports and 500 MB per desk, 2 GB in total. When you unpublish a report, its copy is removed in the background and its entry is dropped after 30 days; reclaim.log lists removed items (name, time, size) for 30 days, and up to 50,000 ID-and-checksum tombstones stop a repeat submission from reappearing.
Desk history: the integrations keep bounded recent events in memory. They are not a separate permanent transcript archive. Ending a session does not necessarily remove it immediately; several connectors retain ended-session information for up to ten minutes, subject to capacity limits. Quitting ends the in-memory history, but information can reappear when OffiAI reads an agent’s existing files again. The “Result ready” badge is also kept in memory only. If you turn on result notifications, macOS shows “Result ready” with the desk number and masked session title, and Notification Center can keep that until you clear it.
Pairing and helpers: ~/Library/Application Support/OffiAI/bridge.json holds the local bridge port and a random authentication token. The folder also holds installed hook helpers under bridges/, an empty bridge.json.lock and a small owner-schema.json version marker. OffiAI removes the pairing file when it quits normally and writes a new one at the next start; after a crash it can remain, but its old port no longer accepts connections.
Reports waiting for OffiAI: if a session publishes while OffiAI cannot be reached, the request waits in publish-outbox/ in that folder. The file holds the title, summary and Markdown text or file path as the session sent them, unmasked, plus that session’s one-time token. Once a request is accepted, a copy stays in done/ with no timed deletion; refused requests move to failed/, which keeps the newest 64.
Hook delivery state: a folder named offiai-bridge-<your numeric user ID> in macOS’s per-user temporary directory holds counters, timestamps and a pairing fingerprint. Hooks opportunistically clean up eligible state files older than one day.

Apart from the Reception receipts and unpublished reports above, there is no general timed deletion of saved settings, desk connections, published reports, queued report requests, working folders or the agents’ original transcripts. Those remain until replaced or deleted. OffiAI’s memory limits and ended-session timers do not delete the agents’ own history.

What leaves the Mac

The public preview has no Delicatino endpoint receiving your sessions, prompts, answers or file contents. Its plugin and hook connections stay on 127.0.0.1. Your agents still communicate with their own vendors and services as they normally do. A message you send through OffiAI becomes input to that agent; it is not made anonymous or kept offline by OffiAI.

Masking is best effort

Before agent text reaches desk displays and retained event buffers, OffiAI tries to replace recognised credentials, email addresses and local paths with [secreto], [email] and [ruta]. It also limits text length. This is best-effort masking, not a promise that every secret or path is removed.

Redaction work tracked as T-203, T-210 and T-224 is still open, although parts of it are in this build. Known gaps include unusual Unicode characters, encoded text and ambiguous path boundaries. The display filters do not sanitise the agents’ original files, your outgoing prompts, files attached to a published report, queued report requests or operational paths saved in desk connections.

Permissions

OffiAI requests macOS Accessibility access only for the opt-in Send now feature for Claude conversations. It is off by default. After you enable it, a send attempt can trigger the macOS permission prompt. Watching sessions does not need that permission. You can disable the feature in OffiAI and revoke access in System Settings → Privacy & Security → Accessibility.

Delete OffiAI’s local data

Quit OffiAI and disable or uninstall its Claude plugin and any installed Codex or Antigravity hooks so they stop reporting.
In Finder’s Go to Folder, open ~/Library/Application Support/. Delete the Oficina and OffiAI folders to remove the default app profile, saved settings and desk connections, Reception receipts and their key, published reports, queued report requests, app-managed working folders, pairing file and hook helpers. Keep any work you want from those folders first.
Remove only OffiAI’s entries from the applicable ~/.codex/hooks.json or configured Codex home. Remove unwanted hooks.json.offiai-backup-* backups too; preserve other tools’ hooks. Uninstall an Antigravity plugin through its host if you installed one.
For remaining hook counters, delete the offiai-bridge-<your numeric user ID> folder in your macOS temporary directory. Remove the OffiAI application and revoke its Accessibility permission if you are uninstalling it.

These steps remove OffiAI’s local data, not the agents’ own records. Claude transcripts remain under ~/.claude/projects/ or the configured Claude directory; Codex history remains under its sessions/ directory and session_index.jsonl; Antigravity retains its store under ~/.gemini/antigravity-cli/. Manage those records through the relevant agent, and separately delete any work in folders you chose. Local deletion does not delete vendor-side conversation history.

Contact

Questions or a mismatch with what you observe? Write to preview@offiai.app.