Camera, microphone and screen, all at once.

That is the capability set of spyware. An app holding those grants has to be provably trustworthy rather than merely well-intentioned, and that shapes most of how this one is built.

• 01

  Your camera never leaves your Mac

  Hand tracking runs locally through MediaPipe. The models are bundled with the app and checksum-pinned rather than downloaded. No frame is ever uploaded.

• 02

  The app's window cannot reach the internet

  Its content security policy permits zero remote origins — not Toki's own service, not the sign-in provider, not a font. Every outbound call is made from Rust instead, which also keeps access tokens out of the JavaScript entirely.

• 03

  The service is told almost nothing

  When you ask for guidance it receives a prompt and one image. It knows nothing about your display, your calibration, or what the accessibility scan found. Turning an answer back into a place on screen happens on your Mac.

• 04

  Nothing is searched for on your machine

  Toki never scans directories to find a program to run. Anything it launches would inherit its screen-recording permission, so a path is used only because someone typed it into settings, and it must be absolute and must exist.