Skip to main content
Continuum is local-first, but “local-first” is not one setting — it is four different postures, and they carry genuinely different data. This page enumerates every network egress in each, names what the receiving side sees, and tells you how to turn it off.
“Only token counts ever reach a Continuum server” was true of earlier versions of Continuum, and is now true only while you are signed out. Signing in turns on a rolling encrypted transcript mirror, and hosted inference sends prompts to Continuum’s gateway by definition. Both are documented in full below. If that matters to you, stay in Posture A — nothing forces an account.

​
The four postures

Postures mostly stack — each one adds egress rather than replacing what came before. They are not strictly ordered, though: connecting a Mac to an organization and signing in to a personal account are separate consents you can give independently, and org mode deliberately disables the personal iCloud analytics mirror while it is on.
Independent of all four: Continuum is a console in front of third-party AI coding agents. The single biggest data flow is the one you intend — when you send a prompt, that content goes to the provider you chose. Continuum routes it through your machine to that provider and does not store, proxy-inspect, or copy it elsewhere. Each provider has its own privacy policy.

​
Posture A — signed out

This is what a fresh install does with no account. Four egresses, and one of them is yours.
Continuum drives provider runtimes as child processes or harnesses. Each owns its own network egress; Continuum does not proxy or inspect their traffic.On first launch on iPhone you explicitly accept an AI-data-sharing disclosure naming these providers before any prompt or file can leave the device. Uninstalling a provider CLI removes its egress entirely without affecting Continuum.
Continuum ships product analytics. The Mac, iPhone, and Watch apps link three analytics SDKs — PostHog, Mixpanel, and Google Analytics 4. They share one stable per-install identifier (clawdmeter.telemetry.deviceId, a random UUID — not your Apple ID, email, or any hardware serial).
Two streams flow to these sinks:
  • Behavioral analytics — button taps and screen/tab names, plus a device_paired event carrying only the transport and a short session-id prefix. No prompts, code, file paths, or repo names.
  • Aggregate usage — a daily snapshot with per-provider token counts, cost totals, session count, and provider ids. It reads only window-level aggregates: never per-repo, per-day, per-model, or any path string.
What you can turn off: Settings → Your Preferences → Privacy → Share anonymous usage disables the aggregate stream (clawdmeter.telemetry.usageOptOut; the stream is on by default). Behavioral button/screen analytics are not gated by that toggle.Analytics are only active if the build embeds project tokens. The SDKs stay inert when those keys are absent.
Each client checks its own update feed. This transmits your IP and standard HTTPS metadata, and no device identifier, install id, session token, chat content, or repo path.Disable automatic checks from the in-app updater, or firewall the feed URL. The CLI never checks on its own.
Continuum ships an embedded LiteLLM pricing snapshot. Refreshing it (./tools/refresh-pricing.sh) fetches the table from raw.githubusercontent.com — a one-way read-only request with no body and no identifier beyond a standard User-Agent and your IP.The shipped app never fetches pricing at runtime. It reads the embedded snapshot. Users who never run the script never make this request.

​
Posture B — signed in

Signing in with an email account is what makes your devices find each other without Tailscale, and what lets a phone open a session that started on your desktop. Making that work means the cloud holds state.
This is the egress most people don’t expect. While signed in, your host publishes a workspace snapshot roughly every 60 seconds, and transcript pages for recently active sessions, to Continuum Cloud.
What is published:
  • Workspace shells — your session list, repo folder names, models, PR state, and aggregate usage, so a phone or browser can show your work before any host is reachable.
  • Transcript bodies — the actual chat items, in fixed-size pages. Only sessions active in the last 15 minutes are eligible, pages are capped per session, and bodies are pruned on a rolling 30-day retention window. The workspace shells are the permanent index; the bodies are the prunable part.
How it is protected. Every transcript page is sealed at rest with AES-256-GCM under a per-member key. Removing a member destroys that key and every page encrypted under it becomes permanently unrecoverable — deletion that survives replicas and backups without hunting down rows. Tenant tables enforce and force Postgres row-level security, so the policy applies even to the table owner.What that seal is not. It is encryption at rest, not end-to-end. Continuum holds the master key and unwraps it to render your own history back to you. See Prompt inspection below for the consequence, stated plainly.Turning it off. There is no Settings toggle for the mirror today. On macOS you can suppress it with a defaults key before signing in:
Signing out stops it entirely. Staying signed out (Posture A) never starts it.
Signing in enrolls your devices in the account mesh so they can reach each other. Two things cross the network:The control plane (/v1/device/* at continuumcode.ai) sees device enrollment metadata — host identities, enroll codes, connect and revoke events — authorized by an account bearer. It does not receive prompts or code. An account is limited to 10 devices; the eleventh is refused with “Device limit reached (10). Remove a device to add this one.”The relay carries the actual session traffic between your devices. It sees:
  • Opaque XChaCha20-Poly1305 encrypted bytes — it cannot decrypt them.
  • A short header: protocol version, sender role, envelope type.
  • TCP/TLS metadata: source IP, timing, byte counts, and the session id presented at connect.
The relay does not see chat messages, code diffs, plan text, or approval decisions. The symmetric key is derived inside your devices; the relay never holds it. Note that establishing a connection requires reaching the control plane — there is no fully offline device-to-device mode. See Security for the key schedule.
When a device is added to your account, Continuum emails you: subject “New device added to your Continuum account”, with the device name, kind, timestamp, and a link to your settings to revoke it. Re-enrolling a device you already have does not re-notify.
If you run sessions on Continuum-managed compute, the client emits lifecycle events — availability, lease create/wake/status/stop, relay attach, session spawn, cleanup — each with a stage and outcome.This is a closed, versioned event shape, not a metadata dictionary: by construction it cannot carry prompts, transcripts, paths, repository names, credentials, relay material, signed URLs, or request/response bodies. It respects the same clawdmeter.telemetry.usageOptOut key as the aggregate usage stream.

​
Posture C — connected to an organization

If you connect a device to an organization (Settings → Your Organisation), Continuum uploads normalized usage records to https://continuumcode.ai/v1/ingest.This path is off until you bind a work account. You sign in on the web, explicitly opt in which accounts upload, and only then does the app send token counts, model identifiers, billing-rail observations, hashed repo keys, and repo folder names — never prompts, code, or diffs. The record type is a strict allowlist with no free-form field.The in-app What leaves this device panel renders the live list of active egresses with their on/off state. When org mode is on, the detailed per-repo iCloud analytics mirror (egress 11) is gated off.Org reporting is aggregate and separate from your personal cloud sync — admins see the rollups described in Organization & Cloud, not your transcript mirror.

​
Posture D — hosted inference

When you run a session on a Continuum-hosted model, the prompts and completions go to Continuum’s gateway, which forwards them upstream. This is not incidental — it is the service.
  • Upstream provider credentials never reach any client. They are server-side only, sealed at rest with AES-256-GCM under a key the database never holds. Clients see at most a four-character key hint.
  • The gateway is the enforcement point for organization model allowlists and spend caps, so policy cannot be bypassed by an older or modified client.
  • Sessions you run through your own provider accounts do not traverse this path at all, on any plan.
Signed-out visitors on the website get one free hosted message per week; that message is subject to the same handling.

​
Independent of posture

To show your usage analytics on a paired iPhone, the Mac writes the analytics snapshot to iCloud Key-Value storage. This snapshot is more detailed than the aggregate telemetry above — it carries per-repo, per-day, and per-model rollups.This crosses into your own iCloud account, not a Continuum server, and only when the iCloud entitlement is signed and you’re signed into iCloud. It is governed by Apple’s privacy policy. In org mode it is disabled. Sign out of iCloud to suppress it.
When the Mac sends a plan-approval push to the iPhone, it goes through a Continuum-operated APNS gateway that holds the operator’s Apple signing key.The gateway sees the SHA-256 hash of the iPhone’s APNS device token (the raw token is hashed before any storage or log write), the byte size of the encrypted payload, and delivery metadata — Apple’s response status, the apns-id, a timestamp.It does not see the notification body. The body is sealed with the per-pairing symmetric key; only your iPhone can decrypt it. You can opt out per device.
If you register another machine as an execution host, Continuum runs agent sessions there. By design this moves data off your primary machine:
  • Provider credentials are pushed to the host so its sessions bill the same subscriptions, written owner-only.
  • Transcripts stream back from the host so the session stays interactive.
Transport is your own Tailscale tailnet or the account relay, and the host you provisioned — not a Continuum server holding your content. This path exists only after you explicitly add a device.Hosts are compute, not credential custodians: they hold only what you deliberately push. For managed cloud runs, GitHub access uses short-lived credentials scoped to the single repository, delivered through a credential helper so the token never lands in git config or shell history.
Continuum discovers .env* files in place and never copies or uploads them. The wire type for an environment variable has no value field at all — only the key name, a fingerprint, and whether a value exists. Agents are told the key names only, never the values, and revealing a value is a local action against your own Keychain.Keys that could hijack a process — loader, hook, and routing variables such as LD_PRELOAD, DYLD_INSERT_LIBRARIES, NODE_OPTIONS, PATH, BASH_ENV, GIT_SSH_COMMAND, and proxy variables — are refused on import and reported rather than silently dropped, and stripped again at spawn time.

​
Prompt inspection: the honest version

Because the transcript mirror is encrypted at rest rather than end-to-end, Continuum is technically capable of reading mirrored prompts. There is an internal founder-only path that does exactly that, and pretending otherwise would be dishonest. Here is what actually constrains it:
  • It is reachable only through a superadmin-gated internal route. The application role has no direct read privileges on the underlying tables; access runs through narrow, purpose-built database functions.
  • Every plaintext read writes an append-only audit row recording the request id, the reading admin’s organization, member id, and email, the timestamp, the response format, the filters used, and the counts returned, scanned, decrypted, and unreadable — plus the subject organizations and members whose content was read.
  • The audit trail cannot be edited or erased. Updates and deletes against it raise a database error, and the application role has no privileges on the table or its sequence.
  • The audit row never stores the search text. The schema explicitly rejects any attempt to write a query string into it, so the audit itself cannot become a second copy of your content.
The scope-limiting fact: this only reaches what the mirror holds. Content that never left your machine — anything in Posture A, and anything older than the 30-day retention window — is not readable by this or any other path, because it does not exist server-side.

​
What stays local

The following data lives on your machine and crosses no network boundary Continuum controls, in any posture, unless you turn on org upload or the iCloud mirror above:
  • Chat transcripts. Per-session JSONL under ~/.claude/projects/, ~/.codex/sessions/, ~/.local/share/opencode/, and provider analogues. Continuum parses them for display and analytics.
  • Code diffs. The diff workbench reads local git checkouts.
  • Repo paths and worktrees. All local; repo identity normalization runs on-device.
  • Session metadata. Session ids, model selections, terminal pane ids, archive flags.
  • Usage rollups. The analytics cache at ~/Library/Application Support/Clawdmeter/analytics-cache.json.
  • Multi-account credentials. Per-account tokens isolated per provider instance — Claude tokens in per-instance Keychain partitions, other providers in their own config roots. The index file holds no secrets.
  • Keychain entries. Per-provider tokens and Continuum’s bearers live in your OS keychain.
Continuum’s internal codename is Clawdmeter, which is why on-disk paths, defaults keys, and the URL scheme still use that name.

​
Deleting your data

​
On your machine

Your local data is plain files: Uninstalling removes the app; delete the directories above to remove all local data. To reset the analytics identity, also clear the clawdmeter.telemetry.deviceId defaults key.

​
Your account

If you signed in, there is a server-side account to delete. The process is documented at continuumcode.ai/delete-account: email accounts@montaukanalytics.xyz from your registered address with the subject “Delete my Continuum account”. Deletion completes within 30 days of verification, is confirmed by email, and is permanent. Deleted: your account identity, device links and cloud-relayed session metadata, subscription state (the Stripe customer object goes with it), and support history on request. Retained: invoices and payment records required by tax and fraud-prevention law, and de-identified aggregate analytics that cannot identify you. If you only ever used the app locally, or tapped Skip for now at sign-in, there is no account to delete.

​
GDPR / CCPA

  • Signed out, Continuum holds no named user record. Product-analytics sinks store anonymous events keyed by a random per-install id with no name, email, or stable hardware identifier, and the aggregate-usage stream is opt-out in Settings.
  • Signed in, your account and its mirrored content are personal data. Right to access is served by the app itself (the mirror is your own history); right to erasure by the account-deletion path above, backed by per-member key destruction; and retention is bounded at 30 days for transcript bodies regardless of any request.
  • Org members — your upload records are governed by your organization’s agreement and visible to you in the in-app trust panel.
  • Relay and push operators hold only the metadata enumerated above — hashed identifiers, byte counts, IP-level metadata — with a 90-day default retention, after which it expires automatically.
  • Local data deletion is exercised by deleting the files listed above; session history can also be deleted per session inside the app.
The published policy documents at continuumcode.ai are the legal instrument; this page is the engineering detail behind them.

​
Report a security issue

To report a security or privacy concern, email the maintainers via continuumcode.ai. Please do not file public reports.