See what leaves your machine

Where your work goes

Stays on your machine

The runtime, your workspace, session history, snapshots, and the audit log.

Goes to your provider

The context each turn needs — your messages, the files and tool results Codewhale reads for that turn — goes directly to the provider you selected. There is no Codewhale relay in between.

Stays local entirely

With a local model (Ollama, vLLM, SGLang), inference never leaves your machine.

Needs no account

Installing and running Codewhale locally needs no Codewhale account.

Plan mode

Cannot edit files or run shell commands. Research it is allowed to do may still contact outside services.

Tools you add can send data elsewhere: an MCP server, a web search, or a hook runs with your permissions and reaches whatever it reaches. Add only ones you trust.

Know what usage counting sends

Codewhale counts anonymous usage by default and says so the first time you launch it, naming Codewhale and PostHog. Here is exactly what it covers:

Never sent

Prompts, responses, code, diffs, file contents, file or repository or branch names, paths, model ids, MCP server names, API keys or tokens, error message text, keystrokes, or any per-turn or per-tool timeline.

Sent while on

Version and platform classes, session length and outcome, feature and error counts as fixed categories, and a random install id that changes every 90 days.

Where it goes

https://telemetry.codewhale.net/v1/telemetry, a first-party service whose source is in the repository. It stores no IP address, country, or location, keeps no request logs, and holds data for three months.

PostHog

Forwarding to PostHog happens only if the service operator configures it separately; it carries the same fields and nothing more.

Turn usage counting off

codewhale config set telemetry false   # stop, and erase the local id and buffer
CODEWHALE_TELEMETRY=0 codewhale        # stop for this process, erase nothing

The config setting is the lasting choice: later versions keep it, and a command-line flag or environment variable cannot turn it back on. You can also switch it in /settings. Turning it off deletes what was kept on your machine; rows already sent are keyed only to the random id you just erased, and expire with the three-month window.

To see exactly what would be sent without sending anything, set telemetry_endpoint = "" in ~/.codewhale/config.toml. Each batch is then written to $CODEWHALE_HOME/telemetry/dryrun.jsonl on your machine, byte for byte, and no network connection is made.

Check the local audit log

Credential, approval, and elevation events are appended to $CODEWHALE_HOME/audit.log (by default ~/.codewhale/audit.log). Writing is best-effort: if a write fails, the failure is logged rather than hidden. The log never leaves your machine.

Report a vulnerability

Email security reports to the address below instead of opening a public issue. Include your Codewhale version (codewhale --version) and steps to reproduce if you have them.

Next