Connect privacy and human control
Your choices when sharing a personal Mac, adding Macs, or using optional Connect invitations and events: device control, account access, sending and learning.
You can start with one supported personal Mac. You choose when it can help and can pause new work. Each extra Mac needs its own setup and permission. Business administration, invitations and Community Hours are optional.
You choose the account, the people, and the message. Source access and action approval are separate decisions: permission to read contacts or conversations does not approve sending, and sending does not automatically permit message learning. Review the exact action or plan before approving it.
Connect may also help a provider set up or manage a participating Mac under separate Compute rules. The Mac's bounded operational telemetry is a separate path from relationship context and task content; read data and processing boundaries for that distinction.
For example, approval for a scheduled email plan covers the sender, recipients, reviewed copy, and timing you saw. If any of those details changes, review the new plan before it acts.
Make three separate decisions
| Decision | What you permit | What it does not permit |
|---|---|---|
| Source access | Use the selected account, contacts, or conversation evidence for its stated purpose. | Reading unrelated accounts or sending a message. |
| Action or plan approval | Perform the reviewed steps with the selected sender, recipients, copy, and timing. | Changing the message, switching accounts, expanding recipients, or spending beyond that approval. |
| Optional learning consent | Retain and analyze the disclosed sent-message fields for the stated learning purpose and period. | Sending, sharing private messages publicly, or ignoring a withdrawal or expired policy. |
A generated draft is not an approval. A recommendation, reply, retrieved page, or model answer cannot grant new tools, destinations, permissions, spending, or policy changes.
Know what approval allows
Human control does not require every approved message to be copied by hand. For an approved scheduled plan, the scheduler may perform only the covered steps. The approval binds the account, people, message versions, and timing you reviewed.
A material edit needs a new review. A reply, stop condition, revoked approval, or unavailable required account evidence stops the affected remaining steps. Check the plan's current outcome before resuming or creating another message. A prepared or attempted step must not be treated as confirmed sent.
Email, LinkedIn, and Facebook have different account and action requirements. An approved Email plan does not permit a LinkedIn or Facebook action, or the reverse. Warm-network permissions do not authorize cold prospecting, connection requests, or premium messaging operations. Facebook work remains human-reviewed: Lithi prepares the post and related material for you to choose, copy, and paste into the group yourself.
Follow the selected channel's data path
Local preparation can use relationship context on your Mac under the source permission you granted. That does not mean every message and operational record stays only on that Mac.
Email sends use the approved sender account and mail path after the covered plan is approved. LinkedIn work prepares a supported message to an existing connection for you to review, copy, and open in LinkedIn; it does not authorize connection requests or promise an automated provider send. Facebook work follows the human-reviewed copy-and-paste handoff. The recipient or platform can retain a message or post under its own rules, and Lithi uses scoped approval, status, and receipt records to reconcile the supported action.
Keep private context out of public reports and ordinary support messages. Review the selected connection's permissions and handling terms rather than relying on a blanket claim that nothing leaves the Mac.
Control optional learning and retention
Learning from exact sent messages requires a separate affirmative, current consent and the matching disclosure and retention policy. Declining that consent is not a refusal of an otherwise permitted send. Required operational records and optional learning copies have different purposes.
Withdrawal or expiry stops new learning use under that grant. An unavailable policy does not authorize continued use or establish completed deletion. Retention cleanup follows the applicable policy; it cannot recall a message already delivered to another person's account.
For an operational problem, use Connect Help with the affected account area, visible status, and safe reference. Leave out private messages, recipient records, passwords, tokens, and bank details. For a security or privacy concern that needs private reporting, use Report a security issue.