Privacy

What the plugin sends

When a check runs, the plugin sends us:

• your recent prompts in the session (up to four, each cut at 4,000 characters), the session's first prompt, and your agent's plan and to-do list if it made them
• your agent's final message for the turn
• the diff and the contents of the files that changed, or the files you asked it to review
• your agent (Claude Code or Codex) and its version, your operating system, and the plugin version

What stays on your machine

Before anything is sent, the plugin blanks out things that look like secrets: private keys, common API key formats and .env-style KEY=value lines.

The plugin keeps a log of every upload in .intent/.sent.log in your repo, so you can see exactly what left your machine.

What we keep, and for how long

We delete raw request payloads after 90 days. We keep the review record and the generated files (the intent, the K claims, the semantics and the verdict), so report links keep working.

We also keep your account (GitHub login or email), the machines you connected, and counts of checks and page views.

DeepScan

DeepScan uploads a snapshot of your repository's text files.

• We delete the snapshot when the scan finishes, and sweep away any leftover once it is 24 hours old.
• The report keeps only the lines it quotes.

Who processes it

The service runs on Railway, in the US. Clerk handles sign-in and accounts. Model calls go through OpenRouter, only to endpoints with zero data retention; for the current model that is Microsoft Azure. Your code isn't used to train models.

Reports

Each report has its own long, random link. Anyone with the link can open it, but reports aren't listed anywhere and search engines are asked not to index them. Private reports are planned.

Turning it off

Run /intent:off in your agent to stop uploads for a project. Setting INTENT_DISABLED=1 or DO_NOT_TRACK=1 in your environment turns the plugin off everywhere. You can revoke a machine's key from your account page at any time.

Deleting your data

Email privacy@intentcomputing.org and we'll delete your account, your reports and the data behind them.