Data handling

Where conversation data goes

• The model provider you configure, and nothing else. With openai-compatible pointed at a local server, prompts and tool output never leave the machine. With anthropic, or an openai-compatible baseURL on a remote host, the conversation goes there. /status shows the active endpoint and flags whether it’s local.

• web_search sends your query to the configured search backend (DuckDuckGo by default). /status shows which. In manual mode each search prompts; to block it, add "web_search" to permissions.deny.

• A remote MCP server (an mcpServers entry with a url) receives whatever the model passes to its tools, over the network. A url on localhost stays on the machine; anything else doesn’t. Local (command) MCP servers run as a subprocess and send nothing outbound on their own.

• The only other outbound request is a version check against the npm registry on startup - it sends nothing about your session, and runs even when autoUpdate is false. It fails silently offline.

• Telemetry never leaves the machine, and is off by default. With telemetry: true (opt-in, asked once on first run), polyglot writes which provider/model/base-URL host you use and whether tool-call parsing needed repair or failed - no prompts, file contents, tool arguments, or model output - to telemetry/<id>.jsonl. Nothing is sent over the network.

• Tool output is scanned for secrets before it’s sent. Shell output, file reads, web fetches and MCP tool results are checked for API keys, tokens and private-key blocks on their way into the model’s context. By default you’re warned; set redaction.mode: "redact" to strip them. See Secret & PII scanning.

See Running offline for the full lockdown.

What’s written to disk (~/.polyglot/)

Path	Contents
sessions/<id>.jsonl	Full transcript - every user message, assistant reply, and tool result, in plaintext, plus per-turn token/cost totals.
plans/*.md	Every plan proposed via exit_plan_mode.
capabilities.json	Cached probe results per endpoint (context window, structured-output support). Only with probeCapabilities / --probe.
audit/<id>.jsonl	Only with audit.enabled. One record per tool call, permission decision, tool result, usage report and stop reason, plus a content_findings entry for each secret scan hit (pattern labels and counts only, never the matched text) and a hook_blocked entry for each hook block. Args and results are SHA-256 hashes unless audit.hashArgs: false - except the verbatim raw block of a repaired tool call, which is always recorded in full so a parser fix can’t hide a model regression.
telemetry/<id>.jsonl	Only with telemetry: true. One record per session (provider, model, base-URL host) plus a record per tool call for whether parsing needed repair, a record per parse failure, and the turn’s stop reason. No tool names, arguments, prompts, or model output.
settings.json	Your config (may contain an apiKey).

Controls

Set once in settings.json / env / a launch flag - not toggleable mid-session, so a running session can’t lower its own guarantees.

• persistTranscripts: false (or POLYGLOT_NO_PERSIST=1, or --no-persist) - ephemeral: nothing is written to sessions/ or plans/. --resume still works within the same process; once it exits there’s nothing to resume.
• retentionDays: <n> (or POLYGLOT_RETENTION_DAYS) - on startup, delete transcripts, plans and audit logs older than n days. Unset = kept indefinitely.
• audit.enabled: true (or POLYGLOT_AUDIT=1) - additionally write a structured JSONL audit trail per session under audit/. Tool-call args and results are hashed by default; set audit.hashArgs: false to keep them raw. Subject to retentionDays.
• telemetry: true - opt in to local usage telemetry under telemetry/ (asked once on first run if you haven’t set it either way). false turns it off again at any time. Subject to retentionDays.

Why no at-rest encryption

Polyglot deliberately does not encrypt its own files. A key stored on the same disk adds little against an attacker who can already read your home directory (where your API key and SSH keys also live), and it breaks cat / grep / --resume. For a regulated setup the effective controls are full-disk encryption + a local model + persistTranscripts: false or a short retentionDays.