> ## Documentation Index
> Fetch the complete documentation index at: https://continuum-three-olive.vercel.app/docs/llms.txt
> Use this file to discover all available pages before exploring further.
# Privacy
> Every byte that can leave your machine, organized by the four postures Continuum can be in — signed out, signed in, org-connected, and hosted inference.
Continuum is local-first, but "local-first" is not one setting — it is four different postures, and they carry genuinely different data. This page enumerates every network egress in each, names what the receiving side sees, and tells you how to turn it off.
**"Only token counts ever reach a Continuum server" was true of earlier versions of Continuum, and is now true only while you are signed out.** Signing in turns on a rolling encrypted transcript mirror, and hosted inference sends prompts to Continuum's gateway by definition. Both are documented in full below. If that matters to you, stay in Posture A — nothing forces an account.
## The four postures
| Posture | You did this | What Continuum can see |
| ------------------------ | ---------------------------------------------- | ---------------------------------------------------------------------------------------------------------- |
| **A — Signed out** | Nothing; just installed the app | Anonymous product analytics and an update check. No prompts, no code, no account. |
| **B — Signed in** | Signed in with an email account | Above, plus your workspace state and a rolling **30-day transcript mirror**, encrypted per member. |
| **C — Org connected** | Bound a work account in **Your Organisation** | Above, plus **aggregate** usage records visible to your org admins. Still no prompts or code in this path. |
| **D — Hosted inference** | Subscribed and picked a Continuum-hosted model | Above, plus the prompts and completions of those sessions — that is the product you bought. |
Postures mostly stack — each one adds egress rather than replacing what came before. They are not strictly ordered, though: connecting a Mac to an organization and signing in to a personal account are separate consents you can give independently, and org mode deliberately *disables* the personal iCloud analytics mirror while it is on.
Independent of all four: Continuum is a console in front of third-party AI coding agents. The single biggest data flow is the one you intend — when you send a prompt, that content goes to the provider you chose. Continuum routes it through your machine to that provider and does not store, proxy-inspect, or copy it elsewhere. Each provider has its own privacy policy.
## Posture A — signed out
This is what a fresh install does with no account. Four egresses, and one of them is yours.
Continuum drives provider runtimes as child processes or harnesses. Each owns its own network egress; Continuum does not proxy or inspect their traffic.
| Provider runtime | Egress owner |
| ------------------------------------ | -------------------------------------------------- |
| `claude` (direct PTY) | Anthropic |
| `codex` (ACP harness) | OpenAI |
| `agy` / Gemini (Antigravity harness) | Google |
| `cursor-agent` (ACP harness) | Anysphere |
| `grok` (headless harness) | xAI |
| `opencode serve` (HTTP/SSE) | Your configured OpenRouter / Z.ai / other upstream |
On first launch on iPhone you explicitly accept an AI-data-sharing disclosure naming these providers before any prompt or file can leave the device. Uninstalling a provider CLI removes its egress entirely without affecting Continuum.
Continuum ships product analytics. The Mac, iPhone, and Watch apps link three analytics SDKs — **PostHog**, **Mixpanel**, and **Google Analytics 4**. They share one stable per-install identifier (`clawdmeter.telemetry.deviceId`, a random UUID — not your Apple ID, email, or any hardware serial).
Two streams flow to these sinks:
* **Behavioral analytics** — button taps and screen/tab names, plus a `device_paired` event carrying only the transport and a short session-id prefix. No prompts, code, file paths, or repo names.
* **Aggregate usage** — a daily snapshot with per-provider token counts, cost totals, session count, and provider ids. It reads only window-level aggregates: never per-repo, per-day, per-model, or any path string.
**What you can turn off:** Settings → **Your Preferences** → Privacy → **Share anonymous usage** disables the aggregate stream (`clawdmeter.telemetry.usageOptOut`; the stream is on by default). Behavioral button/screen analytics are not gated by that toggle.
Analytics are only active if the build embeds project tokens. The SDKs stay inert when those keys are absent.
Each client checks its own update feed. This transmits your IP and standard HTTPS metadata, and no device identifier, install id, session token, chat content, or repo path.
| Client | Feed |
| ----------------------- | ------------------------------------------------------------------------------------- |
| macOS | Sparkle appcast at `continuumcodeapp.github.io/continuum-updates/updates/appcast.xml` |
| Windows / Linux desktop | `electron-updater` against the `continuum-updates` GitHub releases |
| `continuum` CLI | On demand only, when you run `continuum update` |
Disable automatic checks from the in-app updater, or firewall the feed URL. The CLI never checks on its own.
Continuum ships an embedded LiteLLM pricing snapshot. Refreshing it (`./tools/refresh-pricing.sh`) fetches the table from `raw.githubusercontent.com` — a one-way read-only request with no body and no identifier beyond a standard User-Agent and your IP.
**The shipped app never fetches pricing at runtime.** It reads the embedded snapshot. Users who never run the script never make this request.
## Posture B — signed in
Signing in with an email account is what makes your devices find each other without Tailscale, and what lets a phone open a session that started on your desktop. Making that work means the cloud holds state.
**This is the egress most people don't expect.** While signed in, your host publishes a workspace snapshot roughly every 60 seconds, and transcript pages for recently active sessions, to Continuum Cloud.
What is published:
* **Workspace shells** — your session list, repo folder names, models, PR state, and aggregate usage, so a phone or browser can show your work before any host is reachable.
* **Transcript bodies** — the actual chat items, in fixed-size pages. Only sessions **active in the last 15 minutes** are eligible, pages are capped per session, and bodies are pruned on a **rolling 30-day retention window**. The workspace shells are the permanent index; the bodies are the prunable part.
**How it is protected.** Every transcript page is sealed at rest with **AES-256-GCM under a per-member key**. Removing a member destroys that key and every page encrypted under it becomes permanently unrecoverable — deletion that survives replicas and backups without hunting down rows. Tenant tables enforce and *force* Postgres row-level security, so the policy applies even to the table owner.
**What that seal is not.** It is encryption at rest, **not** end-to-end. Continuum holds the master key and unwraps it to render your own history back to you. See [Prompt inspection](#prompt-inspection) below for the consequence, stated plainly.
**Turning it off.** There is no Settings toggle for the mirror today. On macOS you can suppress it with a defaults key before signing in:
```bash theme={"dark"}
defaults write ai.continuum.mac clawdmeter.workspaceMirror.enabled -bool false
```
Signing out stops it entirely. Staying signed out (Posture A) never starts it.
Signing in enrolls your devices in the account mesh so they can reach each other. Two things cross the network:
**The control plane** (`/v1/device/*` at `continuumcode.ai`) sees device enrollment metadata — host identities, enroll codes, connect and revoke events — authorized by an account bearer. It does not receive prompts or code. An account is limited to **10 devices**; the eleventh is refused with "Device limit reached (10). Remove a device to add this one."
**The relay** carries the actual session traffic between your devices. It sees:
* Opaque **XChaCha20-Poly1305** encrypted bytes — it cannot decrypt them.
* A short header: protocol version, sender role, envelope type.
* TCP/TLS metadata: source IP, timing, byte counts, and the session id presented at connect.
The relay does **not** see chat messages, code diffs, plan text, or approval decisions. The symmetric key is derived inside your devices; the relay never holds it. Note that establishing a connection requires reaching the control plane — there is no fully offline device-to-device mode. See [Security](/docs/security) for the key schedule.
When a device is added to your account, Continuum emails you: subject "New device added to your Continuum account", with the device name, kind, timestamp, and a link to your settings to revoke it. Re-enrolling a device you already have does not re-notify.
If you run sessions on Continuum-managed compute, the client emits lifecycle events — availability, lease create/wake/status/stop, relay attach, session spawn, cleanup — each with a stage and outcome.
This is a **closed, versioned event shape, not a metadata dictionary**: by construction it cannot carry prompts, transcripts, paths, repository names, credentials, relay material, signed URLs, or request/response bodies. It respects the same `clawdmeter.telemetry.usageOptOut` key as the aggregate usage stream.
## Posture C — connected to an organization
If you connect a device to an organization (Settings → **Your Organisation**), Continuum uploads normalized usage records to `https://continuumcode.ai/v1/ingest`.
This path is **off until you bind a work account.** You sign in on the web, explicitly opt in which accounts upload, and only then does the app send token counts, model identifiers, billing-rail observations, hashed repo keys, and **repo folder names** — never prompts, code, or diffs. The record type is a strict allowlist with no free-form field.
The in-app **What leaves this device** panel renders the live list of active egresses with their on/off state. When org mode is on, the detailed per-repo iCloud analytics mirror (egress 11) is gated **off**.
Org reporting is aggregate and separate from your personal cloud sync — admins see the rollups described in [Organization & Cloud](/docs/features/organization), not your transcript mirror.
## Posture D — hosted inference
When you run a session on a Continuum-hosted model, **the prompts and completions go to Continuum's gateway**, which forwards them upstream. This is not incidental — it is the service.
* **Upstream provider credentials never reach any client.** They are server-side only, sealed at rest with AES-256-GCM under a key the database never holds. Clients see at most a four-character key hint.
* **The gateway is the enforcement point** for organization model allowlists and spend caps, so policy cannot be bypassed by an older or modified client.
* Sessions you run through your **own** provider accounts do not traverse this path at all, on any plan.
Signed-out visitors on the website get one free hosted message per week; that message is subject to the same handling.
## Independent of posture
To show your usage analytics on a paired iPhone, the Mac writes the analytics snapshot to **iCloud Key-Value storage**. This snapshot is more detailed than the aggregate telemetry above — it carries per-repo, per-day, and per-model rollups.
This crosses into **your own iCloud account**, not a Continuum server, and only when the iCloud entitlement is signed and you're signed into iCloud. It is governed by Apple's privacy policy. In org mode it is disabled. Sign out of iCloud to suppress it.
When the Mac sends a plan-approval push to the iPhone, it goes through a Continuum-operated APNS gateway that holds the operator's Apple signing key.
The gateway sees the **SHA-256 hash** of the iPhone's APNS device token (the raw token is hashed before any storage or log write), the byte size of the encrypted payload, and delivery metadata — Apple's response status, the `apns-id`, a timestamp.
It does **not** see the notification body. The body is sealed with the per-pairing symmetric key; only your iPhone can decrypt it. You can opt out per device.
If you register another machine as an execution host, Continuum runs agent sessions there. By design this moves data off your primary machine:
* **Provider credentials** are pushed to the host so its sessions bill the same subscriptions, written owner-only.
* **Transcripts stream back** from the host so the session stays interactive.
Transport is your own Tailscale tailnet or the account relay, and the host you provisioned — not a Continuum server holding your content. This path exists only after you explicitly add a device.
Hosts are compute, not credential custodians: they hold only what you deliberately push. For managed cloud runs, GitHub access uses short-lived credentials scoped to the single repository, delivered through a credential helper so the token never lands in git config or shell history.
Publishing a transcript to `continuumcode.ai/share/` is always an explicit action. What you publish is **redacted server-side before storage** — no client can widen what a link exposes.
The redactor is an **allowlist walker**: messages are rebuilt from a known key set and anything unrecognized is dropped, so a field added tomorrow cannot leak by default. It also masks known secret shapes (private keys, Anthropic/OpenAI/GitHub/Slack/AWS/Google keys, JWTs, database connection strings, `KEY=value` dotenv lines, and `api_key:`-style assignments), home directory paths, email addresses, and private IP ranges. Raw tool-input JSON — the largest leak surface, since it carries whole file contents and shell commands — is never stored at all.
Links carry an optional expiry, can be revoked, and show a view count. Preview exactly what a viewer will see before publishing. See [Sharing](/docs/features/sharing).
Continuum discovers `.env*` files **in place** and never copies or uploads them. The wire type for an environment variable has no value field at all — only the key name, a fingerprint, and whether a value exists. Agents are told the **key names only**, never the values, and revealing a value is a local action against your own Keychain.
Keys that could hijack a process — loader, hook, and routing variables such as `LD_PRELOAD`, `DYLD_INSERT_LIBRARIES`, `NODE_OPTIONS`, `PATH`, `BASH_ENV`, `GIT_SSH_COMMAND`, and proxy variables — are refused on import and reported rather than silently dropped, and stripped again at spawn time.
## Prompt inspection: the honest version
Because the transcript mirror is encrypted at rest rather than end-to-end, Continuum is technically capable of reading mirrored prompts. There is an internal founder-only path that does exactly that, and pretending otherwise would be dishonest. Here is what actually constrains it:
* **It is reachable only through a superadmin-gated internal route.** The application role has no direct read privileges on the underlying tables; access runs through narrow, purpose-built database functions.
* **Every plaintext read writes an append-only audit row** recording the request id, the reading admin's organization, member id, and email, the timestamp, the response format, the filters used, and the counts returned, scanned, decrypted, and unreadable — plus the subject organizations and members whose content was read.
* **The audit trail cannot be edited or erased.** Updates and deletes against it raise a database error, and the application role has no privileges on the table or its sequence.
* **The audit row never stores the search text.** The schema explicitly rejects any attempt to write a query string into it, so the audit itself cannot become a second copy of your content.
The scope-limiting fact: **this only reaches what the mirror holds.** Content that never left your machine — anything in Posture A, and anything older than the 30-day retention window — is not readable by this or any other path, because it does not exist server-side.
## What stays local
The following data lives on your machine and crosses no network boundary Continuum controls, in any posture, unless you turn on org upload or the iCloud mirror above:
* **Chat transcripts.** Per-session JSONL under `~/.claude/projects/`, `~/.codex/sessions/`, `~/.local/share/opencode/`, and provider analogues. Continuum parses them for display and analytics.
* **Code diffs.** The diff workbench reads local git checkouts.
* **Repo paths and worktrees.** All local; repo identity normalization runs on-device.
* **Session metadata.** Session ids, model selections, terminal pane ids, archive flags.
* **Usage rollups.** The analytics cache at `~/Library/Application Support/Clawdmeter/analytics-cache.json`.
* **Multi-account credentials.** Per-account tokens isolated per provider instance — Claude tokens in per-instance Keychain partitions, other providers in their own config roots. The index file holds no secrets.
* **Keychain entries.** Per-provider tokens and Continuum's bearers live in your OS keychain.
Continuum's internal codename is **Clawdmeter**, which is why on-disk paths, defaults keys, and the URL scheme still use that name.
## Deleting your data
### On your machine
Your local data is plain files:
| Location | Contents |
| ------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- |
| `~/Library/Application Support/Clawdmeter/` | Analytics cache, session registry, pairing state, attachment staging, outbox, workspace store, provider-instance index |
| `~/.clawdmeter/` | Audit logs, autopilot trust list |
| `~/.claude/projects/` | Claude JSONL transcripts (shared with Claude Code; deleting affects it too) |
| `~/.codex/sessions/` | Codex JSONL transcripts (shared with Codex CLI) |
Uninstalling removes the app; delete the directories above to remove all local data. To reset the analytics identity, also clear the `clawdmeter.telemetry.deviceId` defaults key.
### Your account
If you signed in, there is a server-side account to delete. The process is documented at [continuumcode.ai/delete-account](https://continuumcode.ai/delete-account/): email `accounts@montaukanalytics.xyz` from your registered address with the subject "Delete my Continuum account". Deletion completes within 30 days of verification, is confirmed by email, and is permanent.
Deleted: your account identity, device links and cloud-relayed session metadata, subscription state (the Stripe customer object goes with it), and support history on request. Retained: invoices and payment records required by tax and fraud-prevention law, and de-identified aggregate analytics that cannot identify you.
If you only ever used the app locally, or tapped **Skip for now** at sign-in, there is no account to delete.
## GDPR / CCPA
* **Signed out**, Continuum holds no named user record. Product-analytics sinks store anonymous events keyed by a random per-install id with no name, email, or stable hardware identifier, and the aggregate-usage stream is opt-out in Settings.
* **Signed in**, your account and its mirrored content are personal data. Right to access is served by the app itself (the mirror is your own history); right to erasure by the account-deletion path above, backed by per-member key destruction; and retention is bounded at 30 days for transcript bodies regardless of any request.
* **Org members** — your upload records are governed by your organization's agreement and visible to you in the in-app trust panel.
* **Relay and push operators** hold only the metadata enumerated above — hashed identifiers, byte counts, IP-level metadata — with a 90-day default retention, after which it expires automatically.
* **Local data** deletion is exercised by deleting the files listed above; session history can also be deleted per session inside the app.
The published policy documents at [continuumcode.ai](https://continuumcode.ai) are the legal instrument; this page is the engineering detail behind them.
## Report a security issue
To report a security or privacy concern, email the maintainers via [continuumcode.ai](https://continuumcode.ai). Please do not file public reports.