Where your data lives, product by product.
Straight answers, checked against the code of each product. Where a product is still in build, we describe the current build, including the parts we are not proud of yet.
| Allmount | Vettly | AI Nutrition Scanner | Drawloom | |
|---|---|---|---|---|
| Where your data lives | Your own bucket, at your provider. Nothing on our servers. | Cloudflare D1 (records) and R2 (resumes, files). | On your phone, in a local SQLite database. | Cloudflare D1, R2 and Durable Objects. |
| What leaves your device | Signed requests, straight from the app to your provider. App Store receipt and an anonymous id to RevenueCat. | What you upload: job descriptions, assignments, invites. Candidates upload a repo link and an optional resume. | Nothing, unless the on-device model is under 65% confident or fails. Then the photo goes to our cloud check. | Prompts, board content and comments, so the board can be drawn, saved and shared. |
| AI providers | None. Allmount has no AI. | Cloudflare Workers AI. The model is swappable. | On device: EfficientNet-Lite0 or Gemma 4 E2B. Cloud check: a vision model from OpenAI or Google, called by our Cloudflare Worker. | Cloudflare Workers AI for free runs, or your own Anthropic or OpenAI key if you add one. Both go through Cloudflare AI Gateway with logging and caching off. |
| Retention | We hold nothing to retain. | Resumes are used for one evaluation only. Admins can delete a candidate at any time, which removes the resume and personal details. A fixed retention period is not set yet. | Meals stay on the phone until you delete them. Our cloud check does not store photos; the vision provider handles them under its API terms. | Deleted projects are purged after 30 days. |
| Account needed | Hiring teams: yes. Candidates: no. | Not to start | ||
| Keys and encryption | Keys in the Keychain, this device only, never synced. Requests signed on device (SigV4). | Candidate code runs in isolated sandboxes. Payments handled by Razorpay; we never see card or UPI details. | HTTPS to the cloud check, which is rate limited. | Your AI key is encrypted with AES-GCM; only the last 4 characters are ever shown. |
| We train models on your data |
Status: Allmount is in beta, Drawloom in private beta, Vettly and the AI Nutrition Scanner are in build. Each product publishes its own privacy policy when it launches.
Beta. Your bucket, your keys, no middleman.
No Allmount server
The app talks to your storage provider directly. There is no Allmount account and nothing of yours passes through us.
Keys stay put
Access keys live in the Keychain, marked this-device-only, so they never sync to iCloud. Secrets are redacted from logs and descriptions.
Signing on device
Every request is signed with AWS SigV4 using Apple CryptoKit. No AWS SDK, and RevenueCat is the only third-party dependency.
Sandboxed
The Mac app is sandboxed with a hardened runtime. The drive is an Apple File Provider extension: no kernel extension, no FUSE.
Plain http only at home
Unencrypted http is allowed only for local-network endpoints such as a NAS or MinIO. Everything else is HTTPS.
Read-only keys welcome
Connect a read-only key and Allmount warns you, then browses without the power to change anything.
In build. Candidate data is personal data, and we treat it that way.
Isolated runs
Each submission installs, builds, tests and runs inside its own sandbox container, with time limits on every step.
One purpose for resumes
A resume is used only to evaluate that candidate for the organization that invited them, including a check of its claims against the code.
Visible to one org
Reports are visible only to the organization that created the assignment. Candidates see their own assignment page and nothing else.
No training, no ad cookies
We do not train models on resumes or submissions. Cookies keep you signed in and guard public pages from abuse, nothing more.
Safer inputs
Repository and deployed links pass strict URL checks before we fetch them, and webhooks fail closed when a secret is missing.
Signals, not verdicts
Integrity findings are reported as confidence levels with evidence. A signal never rejects a candidate on its own.
In build. On device first, and honest about when it is not.
On-device by default
The Fast engine (5.4 MB) or the Max accuracy engine (Gemma 4 E2B, 2.6 GB) runs on the phone. Most meals never leave it.
The cloud fallback, precisely
If the on-device model is under 65% confident, or fails, the photo (JPEG or PNG, up to 5 MB) is sent to our cloud check. In current builds this happens automatically, without a separate prompt.
What the cloud check does
A Cloudflare Worker forwards the photo to a vision model from OpenAI or Google and returns the estimate. The Worker does not store the photo; the provider handles it under its API terms.
No fake answers
If the cloud check fails, you get an honest error and the scan waits in an offline queue. We never show made-up results.
Your log stays local
Meals, targets and settings are stored in SQLite on the phone. There is no analytics provider in current builds.
Estimates, not advice
Calories and macros are estimates to help you log. They are not medical advice.
Private beta. Built only on Cloudflare.
One platform
Workers, D1, R2 and Durable Objects on Cloudflare. Live co-editing runs through Durable Objects with Yjs.
Private model calls
Generation requests go through Cloudflare AI Gateway with logging and caching turned off, so your content is not kept in gateway logs.
Bring your own key
Add an Anthropic or OpenAI key and runs use it with no credits. The key is encrypted with AES-GCM and only its last 4 characters are shown.
Code citations, when they arrive
Repository boards are not built yet. The spec keeps their code citations visible to the owner only and out of every export.
Sharing you control
View, comment and edit roles, plus public view links. Workspaces have Owner, Admin and Member roles.
Real deletion
Delete your account from settings. Deleted projects are purged after 30 days.
What twistorlabs.com collects.
No cookies
The site sets none. Your light or dark choice is saved in your own browser and never sent anywhere.
Cookieless analytics
Cloudflare Web Analytics counts page views, referrers and load times in aggregate. No fingerprinting, no profile of you.
No forms
There is nothing to fill in. If you email us, the message reaches us and nothing else.
Self-hosted fonts
Fonts and assets are served from our own domain. The only outside script is Cloudflare's analytics beacon; there are no ad tags.
Found a security problem?
Email hello@twistorlabs.com with "Security" in the subject and the product name. Include steps to reproduce. We read it and reply from the same address.
Questions about your data?
Ask us anything about how a product handles it. We answer with specifics.
- Allmount keys stay on your device
- Scanner models run on your phone
- Every release dated in public