Data and privacy

Where things live

• State — projects, chats, schedules, goals — is saved on your machine under the app's user-data folder as a versioned workhorse-state.json. Writes are atomic, three protected backup generations are kept, older saves migrate on load, and a corrupt primary falls back to the newest compatible backup.
• Keys go in the OS credential store — Keychain on macOS, DPAPI on Windows — never in plain text, and are removed from normal state and backups. If that store is unavailable the desk refuses to save the key at all.
• Learning memory is a SQLite file on your disk. Export it or wipe it from Settings → Learning.
• Development runs (npm run dev and local packages) use isolated data and session-only credentials, so a local build never touches Keychain or the installed app's vault.

What it talks to

• The vendors you connect, including their usage endpoints for the meters.
• GitHub, to check for a newer release.
• Nothing else. It sends no analytics.
• There is no account with us and no server of ours. Each vendor runs through its own CLI or API under your own login; nothing is pooled, proxied or shared between vendors.

Support report

Settings can export a support-safe report. It excludes prompts, messages, file contents, environment variables, URLs and credential values.

App identity

On macOS, approval belongs to the signed app identity: one allow sticks across updates with the same bundle ID and Team ID, and local builds cannot open the installed app's vault. Windows keeps the same app identity and encrypted user vault across updates.