# What knitor sends, what it stores, and where

**Short version:** knitor runs entirely on your Mac. The only data that ever leaves your machine is the content of your chats and dashboard scans, sent to Anthropic when Claude needs to respond. There is no third-party telemetry. There is no central knitor server. Your conversations and workspace stay local.

This document explains the full data flow so you can verify the short version is true.

---

## The three actors

| Actor | Role | Where it runs |
|---|---|---|
| **knitor frontend** | The UI you interact with in your browser | `localhost:5181` on your Mac |
| **knitor backend** | The Hono server that owns settings, runs the dashboard scan, and proxies chats | Same Bun process, same machine |
| **Anthropic API** | Claude's hosted inference endpoint — receives chat prompts, returns responses | `api.anthropic.com`, off your machine |

There is no fourth actor. knitor does not have a backend service. There is no analytics provider, error reporter, ad network, or update server.

---

## What knitor sends off-machine

### Chat content → Anthropic

Every time you send a message, the contents of your conversation are sent to `api.anthropic.com` so Claude can respond. This is the standard Claude API flow.

What's included in the payload:
- The text of your message
- Any attachments (images, PDFs, text files) you've added to the composer
- Any `@`-mentioned file content (when you reference a workspace file in a chat)
- The conversation history of the current chat
- The system prompt knitor builds for the session

What's NOT included:
- Files in your workspace you haven't referenced
- Other chats outside the current one
- Settings, postpones, resolutions, or any other knitor metadata
- Your filesystem layout beyond what's in the current chat's context

### Dashboard scans → Anthropic

When you click "scan now" or the background scheduler fires, knitor sends a prompt to Claude asking it to surface open threads from your active sources (Linear, Notion, files, recent chats). This prompt includes:
- Source hints (e.g., "search Linear for items assigned to Pavel")
- The agent's tool calls and results during the scan

This uses Claude's tool-use capability, so each MCP tool call (Linear's API, Notion's API, etc.) goes from your Mac directly to those services using your own credentials. knitor doesn't proxy these.

### Auto-check verdicts → Anthropic

Each item on your dashboard can be re-checked (manually via "check progress" or automatically by the background scheduler). The check sends the item's text + content from the sources it consults to Claude, gets a CLOSE / KEEP / ESCALATE verdict back, and stores it locally.

### Authentication

If you use the **OAuth path** (Claude Code login), Anthropic sees the same auth they already have on file from your `claude login`.

If you use the **API key path**, Anthropic sees the key you pasted in setup. That key never leaves your Mac to any service other than Anthropic.

---

## What knitor stores on your Mac and only on your Mac

| Path | Contents |
|---|---|
| `~/.claude/projects/-Users-[you]/memory/settings.json` | Workspace folder, auth choice, your API key if you chose that path (`chmod 0600`) |
| `~/.claude/projects/-Users-[you]/memory/postpones.json` | Per-item snooze history |
| `~/.claude/projects/-Users-[you]/memory/resolutions.md` | Items you've resolved, with your resolution notes |
| `~/.claude/projects/-Users-[you]/memory/thread_chats.json` | Map of dashboard items → chats you opened for them |
| `~/.claude/projects/-Users-[you]/memory/discovered_threads.json` | Cache of items the scan agent found, with timestamps |
| `~/.claude/projects/-Users-[you]/memory/now_check_history.json` | Auto-check verdicts (CLOSE/KEEP/ESCALATE) per item, with timestamps |
| `~/.claude/projects/-Users-[you]/memory/archived_chats.json` | Which chats you've archived |
| `~/.claude/projects/-Users-[you]/memory/system_sessions.json` | Which sessions were system-initiated (scans, checks) vs user-initiated |
| `~/.claude/projects/-Users-[you]/*.jsonl` | The full transcript of every chat, one file per session (this is the Claude Code SDK's standard format) |

All these files are owned by your user, readable only by you (mode 0600 for `settings.json` which contains the optional API key; 0644 for the others which don't contain secrets).

---

## What knitor does NOT do

No bullet here is "we don't do this YET" — they're hard properties of the architecture as shipped.

- **No telemetry.** knitor does not phone home with usage data, crash reports, feature analytics, or any other signal. No PostHog, no Sentry, no Google Analytics, no anything. (If we ever add an opt-in telemetry channel, it will be explicit and on by default OFF.)
- **No automatic updates.** You update by running `git pull` and `bun install`. There's no auto-update server checking for new versions.
- **No central account.** There's no "sign in to knitor." There's no email, password, or user record anywhere off your machine.
- **No knitor server.** When you run `bun start`, the only server you talk to is the one on your own laptop. There is no `api.knitor.com`.
- **No background data collection.** When the app isn't running, nothing is. The background scheduler runs only while the Bun process is up, and only does what you'd see if you watched it: scan + check via Anthropic.
- **No reading of other apps' data.** knitor reads only the workspace folder you picked, your `~/.claude/projects/` directory (chat history), and any files you `@`-mention in a chat. It cannot read your email, your calendar, your browser history, or files outside your workspace.

---

## Third-party services you choose to use

If you enable Linear, Notion, PostHog, or Microsoft 365 integration in Settings, those services will be queried directly from your Mac using your own credentials. knitor never proxies those calls or stores those credentials beyond what Claude Code's MCP layer already does.

---

## Verifying this yourself

You can audit the data flow:

```bash
# 1. Watch network traffic from the knitor server
sudo tcpdump -i any -n 'host not 127.0.0.1' -A | grep -v "^$"

# 2. Or use Little Snitch / LuLu / your firewall of choice

# 3. Read the source — every outbound call is in:
grep -rn "fetch\|https://" server/lib/ --include="*.ts"
```

The only outbound destination knitor's own code initiates is `api.anthropic.com`. Tool calls to Linear / Notion / etc. come from the Claude SDK using your configured MCP servers.

---

## If this changes

If a future version adds any new outbound data flow, it will be called out in the release notes and require an explicit opt-in in Settings. This document is versioned in git — you can `git log docs/privacy.md` to see every change.

---

**Last reviewed:** 2026-05-12 against knitor at commit on `work` branch.
