Privacy and local data

CodeMorph is local-first. Most of what it does never leaves your computer, and CodeMorph itself has no server that receives your code.

What stays on your machine

Activity	Where it happens
Scanning and parsing your files	Locally
The dependency graph	A local SQLite database
The migration plan and history	Locally
Diff review	In the editor
Run & Verify (tsc, tests, build)	Locally, with your own tools
Your API key	Encrypted in the editor's secret storage

What goes to your model provider

Only conversion and Ask use a model. When you trigger them, CodeMorph sends the relevant code and context directly from the editor to the provider you configured, using your key:

• The file being converted and the typed files it imports.
• Compiler diagnostics from repair attempts.
• Your instruction or question, and relevant graph and history context.

Your provider's terms govern that data. See Model provider terms.

What goes to CodeMorph

Nothing from the app. Telemetry is disabled in the product configuration and crash reports have no destination.

Other connections

• Open VSX when you browse, install or update extensions.
• GitHub when you download an installer.
• Anything you configure, such as git remotes or extensions that call their own services.

Workspace trust

The CodeMorph engine only runs in folders you've trusted. A folder in Restricted Mode is never scanned.

Controlling your data

To	Do this
Stop all model requests	Don't set an API key, or revoke it in your provider's console
Replace your key	Run CodeMorph: Set API Key again
Keep code fully local	Use a local model with Ollama (coming soon)
Stop extension update checks	Set extensions.autoUpdate to false
Remove all local data	Uninstall, then delete %APPDATA%\CodeMorph and %USERPROFILE%\.codemorph

For the website and email side, see Privacy choices and the privacy policy.