Privacy & security
What stays on your machine, what goes where, and how agents are limited.
What stays on your machine
- Your code, prompts, conversations and settings
- The event log (local SQLite database); terminal output is not stored there, only kept in memory
- Your license (checked offline)
What leaves your machine
OpenCognit itself has no telemetry, no tracking and no account. The complete list of what the app sends over the network:
| When | Where | What |
|---|---|---|
| At start and every 6 hours | github.com (release repo) | Fetches the version file and its signature, without any identifier. Can be switched off in Settings → Updates |
| With the update check | opencognit.com | Fetches the price table for the usage dashboard. Off when the update check is off |
| Before an agent installs a package | registry.npmjs.org, pypi.org | The package name, to check whether it exists and how old it is |
| Once a day and on “Check now” under Settings → System (off with “Check for updates automatically”) | registry.npmjs.org | Only the package names of Claude Code, Codex and Gemini CLI, to learn the latest version |
| Only on the Skills page | skills.sh, api.github.com, github.com | Your search term; installing clones the skill's repository |
| Only when you set up dictation | huggingface.co | One-time download of the speech model. Recognition runs locally |
| Only when Kimi Code is set up, every 3 minutes | Kimi's own address | Reads your quota with the login Kimi Code already uses |
| Only when you enter an address | your ntfy server | Short notices to your phone, never code or terminal content |
| Only when you turn it on | your tailnet | Remote control from your phone, only inside your Tailscale network |
| When you open something in the side panel | the page you open | Like any browser; search terms go to DuckDuckGo |
On top of that comes what the CLIs send themselves: each CLI talks to its own provider, exactly as without OpenCognit.
Check it yourself. An application firewall such as OpenSnitch (Linux) or Portmaster (Linux and Windows) shows every connection OpenCognit makes.
With local models the code stays on your machine as well: in workspaces with “Local models only” every cloud CLI is blocked.
Updates are signed
Every new version is signed with the OpenCognit key (Ed25519). The private key stays with the publisher — not on GitHub and not in the build pipeline. The app checks the signature before it offers an update: if it is missing or wrong, nothing is downloaded and a notice appears in the bottom right. Even someone who takes over the release repository on GitHub cannot push an update this way.
Limiting agents
- Approvals in threads for writing, commands and pushes
- Guardrails for every input to an agent — and for commands the agents run on their own
- Confirmation of large start requests by the conductor
- The conductor's internal control channel is local only (Unix socket or named pipe), and every request needs a session token
- Web pages in the side panel get no access to camera, location or notifications
- Remote control from your phone is off until you turn it on; it only listens in your own tailnet (Tailscale), needs a 256-bit token and sends input through the guardrails
- Package protection holds suspicious package installations by agents
- Protect secrets: reading keys and uploading files need approval; credentials in environment variables do not reach the agents
Otherwise, agents in a terminal work with the permissions their CLI grants — just as if you started it directly. For Claude Code, Codex, Gemini CLI, Kimi Code and Hermes, OpenCognit also checks every shell command the agent runs (see Guardrails & agent protection).