Privacy Policy

The short version

• Your code never routes through us. The CLI talks directly to your model provider and to your machine. ThinkingDBx does not receive your source code, your prompts, or your API keys through the CLI.
• Your keys stay local, in an owner-only (0600) file under ~/.config/vibecodecli/, or in your environment.
• Long-term memory is stored on your machine, never uploaded.
• What leaves your machine does so to services you choose · your model provider and, optionally, a web-search provider, MCP servers, or a data backend you connect.

What stays on your machine

• API keys & credentials · written to a 0600 credentials file or read from environment variables. Never transmitted to ThinkingDBx.
• Your code and files · read and edited locally. Git worktrees, sessions, and the repo map all live on disk.
• Session history · saved locally so you can resume; not uploaded.
• Long-term memory · short turn summaries (your prompt, the reply, the names of changed files) and fleet outcomes, stored per repository in an owner-only file under ~/.local/share/vibecodecli/memory/. See below.
• Fleet run records · each fleet's manifest (task, per-agent results, cost) under .vibecodecli/runs/ in your repo, used for resume and cost estimates.

What (optionally) leaves your machine

The CLI is useless without a model, so it sends data to the services you configure. In each case, that third party's privacy policy governs the data:

• Your model provider (required). To answer a turn, your prompt and the relevant code/context are sent to the provider you picked (Anthropic, OpenAI, Google, a self-hosted server, etc.). We don't see it; their terms apply. For a fully local setup, point the CLI at a self-hosted model and nothing goes to a cloud provider at all.
• Recalled memory, to your model provider. When a stored memory is relevant to a turn, it's included in the prompt sent to your model provider, like any other context.
• Web tools (optional). fetch_url requests the page you/the agent ask for; web_search sends your query to the search provider you configured (Tavily, Brave, or Exa). Off unless used.
• MCP servers (optional). Any Model Context Protocol servers you configure run as you direct and may reach their own endpoints.
• Data backends (optional). If you /connect a cloud data platform (for example ThinkingLanguage or Studio), queries and the connection details you choose to store there go to that service under its terms. connect local keeps warehouse credentials on your machine.
• Model prices (automatic, no personal data). To show cost estimates for a model it doesn't already have a price for, the CLI downloads the public model price list from openrouter.ai at most once a day and caches it locally. It sends nothing about you or your code. Local models and models priced by a [pricing] entry in your config never trigger it.
• Update check (automatic, no personal data). At startup the CLI asks vibecodecli.com for the latest version number. Set VIBECODECLI_NO_UPDATE=1 or [update] check = false to turn it off.

Long-term memory

Memory is built into the CLI and stored only on your machine: one owner-only (0600) file per repository under ~/.local/share/vibecodecli/memory/ (or $XDG_DATA_HOME). ThinkingDBx never receives it. Before anything is written, the CLI runs a redaction pass that scrubs known secret shapes (API keys, tokens, private keys) and obvious PII · a defense-in-depth safety net, not a guarantee. Because relevant memories are replayed into future prompts, they reach your model provider the same way the rest of the context does.

You control it: /memory turns auto-recall/remember off or erases a repository's memory, [memory] enabled = false disables it, and vibecodecli uninstall --purge deletes all of it. Earlier versions could optionally sync memory to the hosted ThinkingMemory service; v0.4 no longer sends anything there. If you used it, any data already stored remains under that service's account and deletion controls · email us for help.

This website

vibecodecli.com is a static site served over HTTPS. It uses Google Analytics (gtag) to understand aggregate traffic · standard cookies and usage metrics, no sale of personal data. We don't run ad networks or third-party trackers beyond analytics.

Your choices

• Run fully local: a self-hosted model, no web/MCP/cloud connections, and VIBECODECLI_NO_UPDATE=1 = nothing leaves your network.
• Erase memory any time: /memory → forget this repo, or delete ~/.local/share/vibecodecli/memory/.
• Disable analytics with any browser/extension that blocks Google Analytics; the site works the same.
• For data from earlier versions' optional hosted memory (access, export, deletion), email us.

Contact

Questions or data requests: [email protected].