Talorys keeps tasks and ordinary reminders working when its Cloudflare AI allowance runs out, according to the project's documentation. That separation gives this open-source personal assistant a practical reason to exist: using up the chat budget shouldn't make you lose access to the work you've already recorded.
The MIT-licensed app combines chat with editable memories and a personal organizer. It deploys inside your own Cloudflare account, without a backend operated by Talorys' developers. The README describes a single-owner application, with reminders delivered to an in-app notification center. That delivery detail matters if you're expecting an alert to reach you somewhere else.
Your account hosts the whole application
A browser request takes a fairly short route. Cloudflare Pages serves the React interface, and a Pages Function forwards API requests through a service binding to a private Worker. The Worker then addresses one fixed agent instance backed by SQLite. Talorys' architecture document places conversations and the organizer's records inside that Durable Object, a Cloudflare component that combines persistent storage with application code.
The same document says the agent Worker has neither a public Workers URL nor a preview URL. Authentication happens in the backend, and chat streams through the Pages proxy. This is a specific deployment arrangement you can inspect in the request-flow description. It reduces the number of public entry points while leaving the Pages site reachable from the internet.
Owning the account still means trusting a cloud provider with the content. Cloudflare's Workers AI data policy says it processes customer data to provide inference and doesn't use that content to train models or improve its services without explicit consent. It also says content may be stored when customers use a storage service alongside Workers AI. Talorys uses exactly that arrangement, so its privacy case depends on Cloudflare's terms as well as the application's code.
Free chat has two different limits
Cloudflare currently includes 10,000 Neurons of Workers AI usage per day. Neurons measure inference compute rather than a fixed number of conversations. The pricing page says the allowance resets at midnight UTC. Usage above it requires a paid Workers plan, where excess usage costs $0.011 per 1,000 Neurons. You can't turn that daily allocation into a reliable message count without knowing the model and the work each request performs.
Talorys adds its own limits before the provider's allowance becomes the only brake. In the inspected version 0.1.2 constants, defaults include 200 AI requests and six scheduled AI runs per day. A turn allows six tool calls, with a 1,024-token output limit and a 6,000-token context setting. Those are application settings, not entitlements supplied by Cloudflare.
The chat runner checks the application's daily AI allowance before constructing a model request. It also has a separate error for deployments without an AI provider. This places the failure inside the chat path. Reading those checks supports the documented separation between AI access and stored records, although it doesn't establish how an actual deployment behaves under every provider error.
Storage and compute have their own ceilings. Cloudflare's Durable Objects pricing lists 100,000 requests a day and 5GB of total SQL storage on the free plan, alongside limits on rows read and written. Operations of an exhausted type fail. Keeping reminders independent of inference protects them from AI exhaustion specifically; it doesn't remove their dependence on the infrastructure that stores and schedules them.
Remembering less keeps prompts smaller
The default model is Cloudflare-hosted GLM-4.7-Flash, identified in the shared configuration. Its provider implementation explicitly disables thinking to reduce Neuron use. The same provider code forces a text response on the final permitted step or after the tool budget is spent. These choices bound how much work a chat turn can attempt.
Personal memory is similarly selective. The memory-selection code takes full-text matches first, then fills remaining space with recently updated preferences, up to eight memories in total. It doesn't send the entire stored memory collection on every turn. For someone accumulating months of notes, the distinction is between what the app retains and what a particular model request actually receives.
Older conversation material also passes through a filter. Recent messages are fitted into a token budget, while summarization waits until enough history has overflowed. The summary prompt asks for a maximum of 150 words. This makes the conversation history deliberately lossy. If a detail must survive exactly, an editable stored record gives you a place to keep it outside a compressed conversation summary.
Scheduled work has narrower permissions
Durable Object alarms let Cloudflare wake an object at a future time without an open browser keeping it alive. The platform's alarm documentation guarantees execution at least once and describes automatic retries after errors, with up to six retries. That is a useful scheduling mechanism, though it isn't a promise of exactly one execution or an indefinitely retried job.
Talorys' security document says scheduled AI runs receive read-only tools plus the ability to notify the owner. It also lists no shell, code execution, outbound HTTP or deployment tools. The assistant's authority is confined to its organizer, which makes its automation narrower than the broad word “agent” might suggest.
The tool executor enforces that restriction when it selects available tools. It also validates inputs and rejects an identical repeated call within a turn. Destructive actions require a confirmed flag and a matching word in the owner's latest message. This is an actual code check, rather than an instruction the model is merely asked to obey.
Its confirmation rule deserves scrutiny. The matching expression accepts words including “yes,” “delete” and “cancel.” It doesn't interpret whether the owner used those words to approve this particular operation. That limits what can be claimed about the check: it detects confirmation vocabulary, while the intended action still requires correct interpretation. The inspected code alone isn't evidence of an exploit.
Owner access uses password authentication and revocable sessions. The security documentation describes password hashing on the installer's machine, secure HTTP-only cookies and login lockouts after repeated failures. These are documented controls, not an independent security assessment. A private backend and a password don't establish that an application has been audited.
One command still leaves an owner to do the upkeep
The documented installation command is short:
npx create-talorys@latest
The deployment guide requires Node.js 20.18 or newer. The installer handles Cloudflare login, requests an owner password and deploys both the Worker and Pages project. It also checks that the configured AI model exists without invoking inference. Those steps explain what “one command” covers: resource setup and configuration, followed by verification through the public URL.
Recovery is part of that installer design. The deployment guide says interrupted runs reuse recorded resource names, preserve existing secrets and resume completed steps. Updates keep the same Durable Object class and apply schema migrations transactionally. Retaining the installation manifest therefore matters after the first successful deployment, especially when updating an app that now contains your records.
You can inspect much of the interaction without paying for inference. The development guide describes a local stack using a deterministic mock AI provider, with separate Worker, Pages proxy and frontend processes. It lists unit, browser and packaging checks, plus an optional real-account smoke test. Mock conversations are useful for checking application behavior, but they won't tell you how well the live model understands a request.
Data export provides another practical check on ownership. The backup implementation exports conversations and organizer records while excluding sessions and credentials. Import validates the backup, merges records inside a transaction and re-arms imported schedules afterwards. That gives owners an application-level recovery route, although the exported format still belongs to Talorys.
The next evidence to watch is ordinary deployment experience: whether upgrades preserve records, reminders survive interruptions and real chat usage fits the daily allowance. Talorys already documents local and optional cloud checks. Reports from sustained use would help establish whether the separation that makes its design interesting also holds up when an owner depends on it every day.