Privacy & Data

Cordy Desktop is local-first in the strong sense: your projects, workspaces, notes, and layout are stored on your machine, nothing is uploaded unless you deliberately export it, and Cordy never touches your agents' provider keys, prompts, or responses.

Local-first by design

There is no Cordy account, no sign-in, and no cloud sync. Cordy does not run a server, collect telemetry, or phone home. Everything you create lives in a user-data directory on your own disk, and the app works fully offline (aside from whatever the agents and Git remotes you use need).

Where your data lives

Cordy stores its data under your operating system's standard application-data directory, in Cordy's own folder:

OS	Base location
Windows	%APPDATA% (for example C:\Users\<you>\AppData\Roaming)
macOS	~/Library/Application Support
Linux	~/.config (or $XDG_CONFIG_HOME)

You can point Cordy at a different directory with the CORDY_USER_DATA_DIR environment variable (see Runtime). Inside that directory:

Path	What it holds
project-workspace/project-workspace-store.json	Your projects, workspaces, notebook metadata, active selection, and layout
project-workspace/notebooks/<id>.md	Your notebook contents (one file per note)
project-workspace/*.backup-*.json	Automatic local backups of the store
agent-presets.json	Your custom agent presets (command, arguments, environment overrides)
themes/*.json	Your custom or imported themes
window-appearance.json	The last window background color
logs/, diagnostics/, Crashpad/	Logs, structured events, and crash dumps (see Troubleshooting)

A couple of renderer settings — your appearance choices and any keyboard-shortcut overrides — are kept in the app's local browser storage within the same user-data directory. Everything above is local; none of it is synced.

What leaves your machine

Nothing, unless you export it. Specifically:

• No telemetry or analytics. There are no analytics SDKs in Cordy.
• Crash reports stay local. Native crash minidumps are written to disk with uploading disabled — no crash-report server is configured, so they never leave the machine.
• The only outbound data is a manual diagnostics export, described next.

The other network traffic you'll see comes from tools Cordy launches on your behalf — your CLI agents talking to their providers, and Git talking to your remotes — not from Cordy itself.

The diagnostics export

When you export a diagnostics package from the performance monitor (see Troubleshooting), Cordy writes a folder to your disk containing app and environment info, metrics and restart history, recent events, and the tail of the logs. Before writing, it redacts paths: absolute file paths become [redacted-path] and path-like metadata becomes [redacted].

This export is a local file write only — Cordy does not send it anywhere. If you want to share it on a bug report, you attach the folder yourself. Because you control when and whether it is created and shared, it is the one and only way your data leaves the machine, and it is scrubbed of paths first.

The agent boundary

Cordy launches your CLI agents as ordinary subprocesses in a workspace terminal. It hosts and observes them; it is not part of the conversation between an agent and its provider. Concretely:

• Cordy holds no provider API keys. Each agent reads its own credentials from its own environment or config files, exactly as it does when you run it yourself.
• Cordy never reads, stores, or proxies an agent's prompts or responses. The runtime handles raw terminal bytes for rendering and scrollback only; it makes no model calls.
• The agent status you see is inferred from small output patterns. The activity panel shows only the matched lines, heuristic reasons, and exit codes behind each state change — never raw agent output — and that evidence is kept in memory and never written to disk. See Agents.

A note on preset environment variables

A custom agent preset lets you set environment variables for the command it launches, and you may choose to put a key-like value there. If you do, that value is stored locally in agent-presets.json like any other preset field, and it is only ever used to set the environment of the local process you launch. Cordy does not transmit it anywhere — but treat that file with the same care you would any file that can contain a secret.

No accounts, no tracking

To summarize the guarantees:

• No Cordy account and no sign-in.
• No telemetry, analytics, or usage tracking.
• No uploads except a manual, path-redacted diagnostics export you initiate.
• No provider keys held, and no agent prompts or responses read.

Related pages

• Runtime — the local process supervisor and CORDY_USER_DATA_DIR.
• Agents — the agent boundary in practice.
• Troubleshooting — logs, crash dumps, and the diagnostics export.