Privacy Policy

Last updated: August 20, 2026

⚡ The short version: EditVolt runs on your computer. The IDE collects no telemetry and operates no servers that receive your code — and it works fully without an account. The only time your code leaves your machine is when you use an AI feature with a cloud provider you configured, and that request goes directly from your machine to that provider, never through us. Prefer nothing leaving at all? Strict privacy mode runs everything on local models. Separately, if you choose to sign in, we receive your email address and basic profile — that is the only personal data we hold, and section 2 explains exactly what it is used for.

1. What we collect from the IDE: nothing

The EditVolt application collects no usage analytics or telemetry of any kind:

• No telemetry. Telemetry is disabled at build time, and the telemetry machinery is structurally replaced with a no-op inside the application — there is no data-collection pathway alive in the shipped binary.
• No crash reporting. The crash reporter has no upload destination configured; crash data never leaves your machine.
• No experiments, A/B tests, surveys, or ads.
• No code, ever. We operate no proxy, gateway, or backend that your prompts, code, or AI responses pass through.

We never sell or share your data, and we do not use it to build advertising or behavioural profiles. The one category of personal data we do hold — your account, if you create one — is covered next.

2. Accounts and sign-in

An account is optional. The IDE is fully functional without one: chat, the agent, completions, and codebase indexing all work signed out, and nothing on this page changes if you never sign in.

If you do choose to sign in, you authenticate with GitHub or Google through our authentication provider, Supabase. We then hold:

• Your email address
• Your basic public profile from that provider — display name, username, and avatar URL
• The provider account identifier that links your sign-in to your EditVolt account
• Authentication records — account creation and sign-in timestamps, plus the IP address and browser user-agent recorded in security logs

We request only your identity. Sign-in uses the minimum scopes needed to confirm who you are — your email address and public profile. EditVolt does not request, receive, or have access to your repositories, your GitHub code, your Gmail messages, your contacts, or your Google Drive.

What we use it for. Your email and profile are used solely to create and identify your EditVolt account, to keep you signed in, and to contact you about your account or a security issue. We do not send marketing email without your separate consent, and we do not use account data for profiling.

Legal basis. Where the GDPR or similar law applies, we process this data to perform our contract with you (providing the account you asked for) and on the basis of our legitimate interest in keeping the service secure. Where India's Digital Personal Data Protection Act applies, we process it with your consent, given when you sign in.

Your session token. After sign-in, an access token is passed to the EditVolt application running on your own machine (over a loopback address, 127.0.0.1, which never leaves your computer) and is stored in your operating system's secure keychain. Signing out removes it.

Retention. We keep account data for as long as your account exists. Delete your account and the record is removed from our systems within 30 days, except where we are required to retain something by law. Authentication security logs are retained for a shorter period.

3. AI features and your code

When you use an AI feature (chat, agent mode, cloud completions), the relevant prompt and code context is sent directly from your machine to the AI provider you configured — Anthropic (Claude), Google (Gemini), an OpenAI-compatible endpoint of your choice, Hugging Face, or a local model. EditVolt operates no proxy, gateway, or backend in between: we never receive, store, or log your prompts, code, or the model's responses. This is true whether or not you are signed in — an EditVolt account gives us no visibility into your AI usage.

Your relationship with each AI provider is governed by that provider's own terms and privacy policy, under your own API key or account. Please review the policies of any provider you connect.

• Local by default where possible. Inline completions run on a bundled local engine, and codebase indexing uses a bundled on-device embedding model — neither touches the network.
• Strict privacy mode. One setting routes every AI request to local models only, disabling all cloud providers. No silent substitution: EditVolt never quietly reroutes a request to a different provider than the one you chose.
• Sensitive-file protection. The .editvoltignore file (enabled by default) keeps matching paths — including .env files, private keys, SSH and cloud credentials — out of the AI's context and the local index.

4. Third-party CLI integration

EditVolt can optionally bridge to an AI vendor's own command-line tool installed on your system (for example, Anthropic's Claude Code CLI) so you can reuse an existing sign-in. In that mode, the vendor's tool handles the requests itself and may perform its own diagnostics and event logging to the vendor and its logging services, under the vendor's policies — this is that tool's behavior, not EditVolt's. If you prefer to avoid it, connect with a direct API key or use local models instead.

5. Data stored on your device

Everything EditVolt saves lives on your computer, in the application's data folder:

• Settings, keybindings, and themes
• Chat and session history (stored per workspace, with automatic size caps)
• The local semantic index of your codebase and its embeddings
• Optional project memory (off by default)
• Your customization files: rules, skills, subagents, hooks, commands, automations

None of this is synced to us. Deleting the data folder removes it permanently.

6. API keys

Provider API keys are stored in your operating system's secure keychain — never in plaintext files — and are read only for the duration of the individual request that needs them. They are never transmitted to us.

7. Network connections EditVolt makes

For transparency, here is the complete list of network connections the app can make, and why:

If you never sign in, the three authentication rows never occur. This behavior is verified with network-interception audits against a blocklist of known telemetry endpoints before each release.

8. Service providers we rely on

We keep our list of processors deliberately short. These are the only third parties that handle personal data on our behalf:

AI providers are not on this list because they are your counterparties, not ours — you connect them under your own key and your data goes to them directly.

International transfers. Our authentication provider stores account data on servers that may be located outside your country, including in the United States. Where the law requires it, these transfers rely on standard contractual clauses or an equivalent safeguard.

9. Your rights, and deleting your data

Because we hold so little, acting on your rights is straightforward. You may ask us to:

• Access a copy of the account data we hold about you
• Correct anything inaccurate
• Delete your account and its data
• Withdraw consent or object to processing, and to receive your data in a portable form

Email hello@editvolt.com and we will action the request within 30 days, free of charge. Deleting your account does not touch anything on your own machine — your settings, chats, and index are local, and are removed by deleting the application's data folder.

Revoking EditVolt's access from your GitHub or Google account settings stops future sign-ins, but ask us directly if you also want the account record erased.

10. Extensions

Extensions you install from Open VSX are third-party software with their own privacy practices and may make their own network connections. Review an extension's documentation before installing it.

11. This website

This website is a static site. It runs no analytics and hosts no tracking scripts, and the marketing pages set no cookies.

The sign-in pages are the one exception: to keep you signed in, they store session data in your browser's local storage. This is strictly necessary for authentication and is not used for tracking. Signing out or clearing your browser data removes it.

If you email us to be notified about product launches, we use your email address only for that notification and delete it on request.

12. Children's privacy

EditVolt is not directed at children. You must be at least 18 years old to create an EditVolt account. Users under 18 may use the IDE without an account, with the involvement of a parent or guardian where local law requires it. We do not knowingly collect personal data from a child; if we learn that we have, we delete it. Contact us at hello@editvolt.com if you believe a child has created an account.

13. Changes to this policy

If EditVolt's data practices change — for example, if an optional, opt-in metrics service is introduced, or if an account gains a new feature that stores more data — we will update this policy and call out the change prominently in the release notes before it ships.

14. Contact

Questions about privacy, or want your data deleted? Email hello@editvolt.com.