Bandicot is a native Mac workspace where people and AI agents work on the same projects. Agents ask before they write, every change becomes a version, and every turn shows the tokens and cost it spent.

Yes, for one person: Solo is free with every capability for one profile. Team is $8.99 a month for up to 3 profiles, Family $14.99 for up to 6, Business $49.99 for up to 25, and Enterprise starts at $50 for 26 profiles plus $1.92 per seat.

Does Bandicot reduce token costs?

It is built to, and it shows you every token either way. A frozen prompt prefix keeps caches warm, history is append-only, compaction runs only at thresholds and skills load on demand. No whole-task saving is claimed until the fixed-corpus measurement is published.

Can several people use Bandicot together?

Yes, on one Mac today: profiles keep each person's projects and memory apart, and a team roster puts agents next to people. Syncing a team across machines is in development.

Does the AI change files without asking?

No. Writes, commands and spend outside your permissions file wait for approval, and every file change is recorded so it can be restored.

Which models does Bandicot work with?

Hosted providers you connect, and local models. A pinned catalog of 8 small chat models for Apple Silicon Macs, from Gemma 3 270M to SmolLM3 3B, each checked against the Mac's GPU memory budget before download. Larger work goes to a hosted provider you connect. Remote providers receive the prompts sent to them.

Does Bandicot run automations?

Yes. Automations are agents that run on a schedule or on request inside a project, on your Mac while Bandicot is open, under the same approvals as a chat.

Does Bandicot claim SOC 2 or GDPR credentials?

No external certification is claimed. Read the privacy and security docs for the actual boundaries.

Is Bandicot the same as Bandicoot?

Yes. The brand is Bandicot, one o. Bandicoot is a common misspelling.

Updated 28 August 2026

Cookies and local storage

This page is the cookie notice for the Bandicot website. It is not a consent banner for advertising, because this codebase does not ship ad or analytics cookies.

Essential cookies

Sign-in uses Auth.js with a JWT session. That typically sets HttpOnly cookies such as a session token and a CSRF token on the website origin. They exist so you stay logged in and so form posts cannot be forged from another site. They are not used to advertise.

Duration follows the Auth.js session configuration (JWT). Signing out clears the website session cookie. Native Bandicot sessions are not these cookies.

Local storage (not cookies)

bandicot-docs-theme, docs light/dark preference, if you toggle it.
bandicot:session, a client-side session snapshot used by older website auth helpers. It is not your native host ledger.

What we do not set

No Google Analytics, Plausible, PostHog, Meta pixel, or similar tags are present in apps/ui as of this notice. If a host (Vercel) injects its own logs, that is infrastructure, not a marketing tracker we control on the page.

Third parties

Stripe Checkout, GitHub, and Google (if you use those buttons) will set their own cookies on their origins. Read their policies. We do not control them.

Choices

You can block cookies in the browser. The website account will not stay signed in. The native app does not need these cookies to run locally.

Questions: hi@apparatdynamics.com. Related: Privacy, Terms.

Also: Terms · Privacy · Cookies