What is sent and stored
Exactly what leaves your computer, and where data is kept.
Sent for a task
- The list of file names in the allowed folder (up to 2,000 names; skipped folders are left out).
- The content of the files the task needs, up to the size limit in Project reading (2 MB per file by default).
- Your rules and saved memories, and the task text.
- Test output when tests fail, so the AI can fix the problem.
Never sent
- Secret files:
.envfiles, private keys (.pem,.key,id_rsa...),credentials.json,.npmrc,.netrc, Terraform state and similar, and anything in.ssh,.aws,.gnupg,.kube,.dockeror.git. - Files outside the allowed folders.
- Files you list in Also never read these files.
Secrets found inside normal files (API keys, tokens, passwords) are replaced with markers like [hidden-1] before sending, and put back when the file is written. See Secrets.
Kept on our servers
- Your account, settings, linked computers and allowed folder names.
- Task text, plans, progress messages, the names of changed files and line counts, and usage for billing.
- We don't keep your file contents after a task, and nothing is used to train AI models.
Kept on your computer
| Windows | %APPDATA%\CodeStilt |
| macOS | ~/Library/Application Support/CodeStilt |
| Linux | ~/.config/codestilt |
This folder holds your link (access key), settings and task checkpoints. Checkpoints older than 7 days are deleted automatically.