Privacy and Data Handling

OpenMobius-skill is a local-first AI agent skill. This document describes every piece of data that leaves your machine, the destination, and the purpose.

Network endpoints

The installer and runtime make outbound requests to only the following hosts. No other domains are contacted, ever.

Host	When	Purpose	What is sent
pypi.org (and PyPI mirrors)	Install time	Install declared Python dependencies from requirements.txt	Standard pip download requests
huggingface.co	Install time	Download the open-source nomic-embed-text-v1.5 model (Apache 2.0)	Standard HuggingFace Hub download requests
playwright.azureedge.net	Install time	Download chromium browser used for chart rendering	Standard Playwright download requests
mobiusquant.ai / api.mobiusquant.ai	Install + runtime	(a) Fetch install manifest. (b) Public OHLCV / indicator / playbook endpoints (used at runtime when the user asks a trading question that needs live data).	Manifest fetches contain no user data. Runtime API calls contain only your explicit query: asset name, timeframe, indicator name. No authentication required, no credentials collected.

What is stored locally

The installer writes only to these locations:

Location	Content	Removable by
<skill-dir>/.venv/	Python virtual environment	python install.py --uninstall --full
~/.cache/huggingface/hub/	nomic embedding model cache	python install.py --uninstall --purge --yes-i-know
Playwright browser cache (per OS) — ~/.cache/ms-playwright on Linux, ~/Library/Caches/ms-playwright on macOS, %LOCALAPPDATA%\ms-playwright on Windows	chromium browser binary	python install.py --uninstall --purge --yes-i-know
<skill-dir>/knowledge_base/_index/	Local ChromaDB vector index	python install.py --uninstall --full
~/.<agent>/skills/OpenMobius-skill/ (symlink)	Skill registration into your AI agent	python install.py --uninstall

<skill-dir> defaults to ~/OpenMobius-skill/ for the curl installer, or to the location you clone into for the git workflow.

What is NOT done

• No telemetry. No usage analytics, crash reports, or any background-collected data are transmitted from your machine.
• No background processes. No daemons, system services, or startup entries are installed.
• No system-level modifications. No /etc/, no /Library/LaunchAgents/, no registry keys.
• No automatic updates. Version upgrades require explicit python install.py --update.

How to inspect

Before installing you can review the install steps in install.py. The --strict flag halts on the first error (useful for CI environments).

Reporting

For privacy or security concerns, please open an issue on the project's GitHub repository (when public) or contact the project maintainers via the website listed in README.md.