There is no service here to send anything to.
Portico has no servers. The app talks to a machine in your house that you installed and control. We operate nothing, receive nothing, and could not read your family's data if we wanted to.
Nothing. No accounts, no sign-in, no analytics, no crash reporting, no advertising identifiers, no telemetry of any kind. The app contains no third-party SDKs. This website loads no scripts, fonts or trackers.
| Data | Where it lives |
|---|---|
| Conversations between a child and Portico | The ledger, on your box |
| Photos of worksheets or jobs | Your box |
| Children's names, grades, chores | family.json, your box |
| Device pairings | portico.state.json, your box |
| A parent's own sessions | Only the parent's phone. Never written to your box at all. |
| Voice | Transcribed on the device. Audio is never transmitted. |
Portico can route a turn to an outside model. You choose which, per child and per helper, and the app shows which engine answered.
| Setting | What is sent, and to whom |
|---|---|
local-* | Nothing leaves. The model runs on your box. |
claude-* | The message and recent turns go to Anthropic, under your own subscription and their terms. |
hf-* | The message and recent turns go to Hugging Face and the provider serving that model, under your own token. |
The ledger itself is never transmitted anywhere, under any setting. Notifications go through an ntfy instance you host; message content stays on your machine and only a content-free wake-up reaches Apple's push service.
Portico is built for children and is explicit with them about it: every screen a child sees says their parents can read the conversation. Nothing is hidden from the child, and nothing about a child is sent to us, because there is no us to send it to.
Parents hold the record. It is append-only and hash-chained, so it can be shown to be unedited — including by the parent. A child cannot delete it, and neither can anyone else; the software has no such function.
Delete the ledger/ directory on your machine, or the machine. There is
no account to close and nobody to ask.
If this ever changes it will change here, and the source is public so the claims can be checked rather than believed.