Tohseno

GitHub distribution on MENLO

When you deploy, MENLO uses your GitHub token to check your account and repository write access. The public service does not store the token. It stores your public GitHub account and repository IDs, app name, description, build recipe, and registration history. Your source stays on GitHub. Your Mac fetches the exact selected commit directly from GitHub and keeps build and installation records locally. MENLO checks public repository heads to show available updates. Native sign-in stores its session in your Mac's Keychain; you can sign out in the GitHub profile screen.

Optional Farcaster sign-in and saved apps

You can browse Menlo without signing in. Guest saved apps stay in this browser's local storage. If you sign in with Farcaster, Menlo stores your numeric Farcaster ID, the public signing address for browser sessions, and the app names, repositories, and exact source versions you choose to save. Guest saves are added to your account only when you explicitly choose to do so. You can remove saves from your library.

Browser sign-in asks your wallet to sign a one-time login message. Menlo checks the signature and current Farcaster custody or auth-address authority through an Optimism RPC. Mini Apps use Farcaster Quick Auth, whose tokens Menlo verifies for this domain. These providers receive the information required to authenticate or check public identity. Menlo does not request seed phrases, wallet private keys, payments, or permission to post. Signing in does not authorize GitHub publication, source reviews, builds, or installation.

Browser sessions use an HttpOnly cookie and expire after 24 hours. Only a hash of the session token is stored on the server. Pending login challenges expire after ten minutes. Authenticated browser requests recheck the signing address’s current Farcaster authority, and logout revokes the browser session. Saved apps remain with your Farcaster account after logout; they are private to authenticated account access. Access logs record a semantic route and response status, not authentication messages or tokens.

Tohseno / PRIVACY

Privacy notice

Browsing requires no account. Optional Farcaster sign-in keeps saved apps across devices. The native Mac factory stays local by default; managed intelligence is a separately approved Tohseno → Bankr → model-provider path.

Before TAKE A SHOT

The prompt and reference images are a Browser Draft. They remain in browser memory and a versioned IndexedDB record on this device so a reload can restore them. Tohseno does not put them in cookies, URLs, service workers, server-rendered pages, analytics, or application logs. There is no account, email collection, advertising, analytics, or third-party browser script.

The browser reports “Saved on this device” only after IndexedDB confirms the write. Clearing browser site data removes that copy. The private download is a second local fallback.

After TAKE A SHOT

The browser freezes a transfer snapshot, packages the exact prompt and ordered references, and encrypts the complete package with a fresh AES-256-GCM key and nonce before upload. The Pending Relay Intention is bounded opaque ciphertext. The relay never receives the decryption key and cannot see the plaintext prompt, reference bytes, filenames, or a canonical Shot identity. It does no classification, indexing, model inference, or content analytics.

The relay operator may see unavoidable transport information: request IP, creation time, ciphertext size, chunk count, expiry, state, response status, and duration. Incomplete uploads expire after one hour. Ready ciphertext is held for at most seven days and is deleted synchronously after the Mac confirms a durable import, or deleted on expiry. Short-lived metadata-only tombstones let the browser observe the terminal state. Infrastructure snapshots or operator failure can retain ciphertext longer, but it remains encrypted without the separately held key.

The copied command contains a high-entropy, single-use bearer token. Anyone who obtains it before claim can import the intention. The command can remain in shell history unless the shell is configured otherwise; after successful import or expiry its capability no longer works.

On the Mac

The verified CLI claims, downloads, verifies, and decrypts locally. It imports a Local Pending Intention into durable private machine state before acknowledging deletion. That record is still not a Shot. Tohseno Studio binds to 127.0.0.1, keeps the intention safe through onboarding and restarts, and uses the existing local engine only after the person reviews the plan and boundaries. The engine then creates the canonical Shot; later immutable continuations are Evolutions.

The installed factory sends no Tohseno telemetry. A selected coding harness can read the intention and references only after local approval to do the requested work; its provider is a separate trust boundary with its own account, privacy, and retention settings.

Native and managed intelligence

The native app uses a short-lived scoped loopback session. Listing apps, readiness, builds, signing, and phone installation do not send source to Tohseno. A custom executable is owner-selected local code. A configured OpenAI-compatible endpoint is loopback-only and requires recorded consent before source is sent.

Optional managed work shows the model, privacy tier, live server-priced range, and hard maximum before submission. Exact admitted source travels through the Tohseno proxy to Bankr and the selected upstream model. Tohseno does not write prompts or source to its ledger or access logs. It records an opaque installation binding, balance movements, reservation and execution identifiers, model/tier, provider request and usage/cost evidence when available, retail charge, and reconciliation state. Stripe receives only the opaque binding and chosen pack metadata. Provider retention follows the actual selected tier and deployed provider policy.

The downloaded private package

.tohseno-intent is generated entirely in the browser and contains the readable prompt and original reference bytes. It is private but not encrypted. Store and share it as carefully as the original files, then import it locally with tohseno intent open <file>.

Apps built on these rails

Apps start from a local, account-free baseline. Their accepted manifest declares data, storage, network, identity, integrations, entitlements, and irreversible operations. Tohseno operates no centralized content backend for generated apps and receives none of their users’ runtime content.

Contact

This site is operated by Anky, Inc. Questions: support@anky.app.