Settings and privacy
Enable, disable, opt out, monthly token caps, and what data leaves your org when the assistant is used.
The in-app assistant is opt-in per org. An owner enables it once; every member can use it from then on, and any member can opt themselves out of all AI features at any time.
Settings live in Settings -> Assistant.
Enable for an org
The first time you open Settings -> Assistant as an owner, the AI assistant card is Off. Toggle it on and you'll see a consent dialog summarising what's sent, what isn't, and which model is in use. After you confirm, the drawer (⌘J) and the inline AI features become available across the org.
Disabling later keeps existing conversations but hides the drawer and inline features for everyone in the org.
Opt out as an individual
Even when the org has the assistant enabled, you can opt your own account out from Settings -> Assistant -> Personal preferences. Opting out hides:
- The ⌘J drawer
- Inline AI features (the natural-language quick entry, the cover note drafter on invoices)
Other members of the org are not affected. Toggle it back on at any time.
Monthly token caps
Each org has a monthly budget that resets on the first of each calendar month. Default caps:
- Input: 500,000 tokens
- Output: 100,000 tokens
The cap is shared across the whole org and across every AI surface (the drawer, the quick-entry parser, the cover-note drafter). Settings -> Assistant -> This month shows usage with a warning indicator near the cap and a hard stop at 100%.
Owners can raise (or lower) the caps from the same page. Most freelancers won't approach the defaults; the assistant uses Claude Haiku 4.5, which is cheap.
When the budget is exhausted the assistant returns "Monthly AI budget exhausted. Try again next month." Other parts of Hourdini continue to work normally.
What data is sent
When the assistant is used, the following is sent to Anthropic:
- Your conversation prompts (verbatim).
- A snapshot of the workspace state needed to resolve names to ids: client and project names plus their ids and currencies.
- The current time and the org id.
- Tool results from any read tools the assistant invokes (entry descriptions, amounts, currencies, dates, invoice line items).
The following is never sent:
- Personal access tokens or any session credential.
- Raw user ids or email addresses.
- Payment instructions or billing addresses.
- Anything outside the org you're currently using.
Per Anthropic's API terms, prompts are not retained for model training. The exact data envelope is enumerated on the consent dialog and on the Settings -> Assistant card.
How role affects access
| Role | Drawer + inline AI | Enable / disable | Change caps |
|---|---|---|---|
| Owner | Yes | Yes | Yes |
| Member | Yes | No | No |
| Viewer | Read-only (no draft commits) | No | No |
Viewers can ask questions but can't commit drafts (the same rule as the rest of the app: viewers don't write).
Where conversations live
Conversations are stored in your Hourdini database, scoped to your user account. They persist across page reloads and devices. They aren't shared with teammates and aren't visible from other orgs even if you share the org.
To delete a conversation, hover the tab and click the × in the drawer. Deletion is immediate and irreversible.
Audit trail
Every commit the assistant performs (logging a time entry,
creating an invoice draft) writes an audit entry tagged with the
source mcp and a conversation_id linking it back to the thread.
You'll see these in Activity alongside web, CLI, and system
actions.