Skip to content

PRIVACY.md

Latest commit

 

History

History
13 lines (10 loc) · 2.83 KB

PRIVACY.md

File metadata and controls

13 lines (10 loc) · 2.83 KB
Raw

CoalLedger Privacy Policy

CoalLedger collects nothing and phones nowhere by default—every online step is yours to consent to.

  • No telemetry. No usage data, analytics, or identifiers are collected, stored, or transmitted—by the hooks, the engine scripts, or the skills.
  • No network calls from the shipped code. The hooks and every engine script are offline by design (Phoenix #7): local filesystem only, no sockets, no requests. (The self-update check is the agent's /coalledger:update procedure, run only with your consent—never a hook.)
  • It runs inside your agent. No CoalLedger servers and no CoalLedger account—the code executes under your own AI agent, subject to your platform's own permission gate.
  • The grounding fetch is the consented exception. The doc-grounding / doc-standard semantic Full tier verifies claims against live sources—an agent action behind an explicit consent. Be aware the CLAIM under verification travels in those fetch/search requests; for docs you do not want checked online, stay on the Quick tier (fully offline) or scope the scan.
  • Reports stay local. Findings are printed to your session—nothing is persisted or transmitted; /coalledger:stats is a session-local read-only count.
  • Error reports are manual and scrubbed. When something misbehaves, your agent may offer to open a GitHub issue; nothing is submitted automatically, you see and edit the contents first, and the report carries mechanical facts only (canary, check id, counts, error class)—never your doc text.
  • Local files only. All state lives in files you can read: the self-update throttle stamp ~/.claude/coal/coalledger/update-check (a timestamp, nothing more—a pre-2026-08-08 install may also have ~/.claude/.coalledger-update-check, read once as a migration fallback then removed); the config (~/.claude/.coalledger.json global; per-project, resolved in order—.claude/coal/coalledger.json (own dir) → .agents/coal/coalledger.json → .gemini/coal/coalledger.json → the two DEPRECATED legacy paths .claude/.coalledger.json then root .coalledger.json, first found wins; the session-start conductor also checks, by a file-existence test only and never reading any contents, a fixed short list of near-miss config paths in the project root so it can name one that nothing reads); the docs-drift session state os.tmpdir()/coalledger-<session-id>.docs and .docmemmoved (a path list and a 0-byte marker, cleared as the session proceeds and OS-tmp reaped otherwise); and, on Antigravity, the once-per-session marker os.tmpdir()/coalledger/ag-conductor-*.marker. The engine scripts write nothing at all. Fix-mode checkpoints (a git stash/commit, or a copy-aside) are made by your agent in your project, on your disk.

Questions: open an issue at https://github.com/TheColliery/CoalLedger/issues.