Privacy & Data
Understand Cordy Desktop's local storage, terminal history, browser and agent network boundaries, encrypted passwords, and diagnostics exports.
Cordy Desktop has no Cordy account or cloud-sync service. Project metadata, workspace layouts, notes, settings, browser state, and diagnostics are stored on the machine by default. Network activity still occurs when you open sites in the built-in browser or run tools that use a network, including CLI agents and Git commands.
User-data location
The production Windows build uses %APPDATA%\cordy. Electron uses the corresponding application-data location on other operating systems when you run a source build. Set CORDY_USER_DATA_DIR before launch to use a different directory; see Runtime.
Important local data includes:
| Path or store | Contents |
|---|---|
project-workspace/project-workspace-store.json | Projects, workspaces, code targets, active selection, and saved layout. Timestamped backup and recovery copies may sit beside it. |
project-workspace/notebooks/<id>.md and <id>.assets/ | Workspace notebook text and pasted assets. |
agent-presets.json | User preset names, commands, arguments, environment overrides, and state-detection rules. Values are stored as configuration, not as a secret vault. |
terminal-shell.json | Selected default shell. |
themes/*.json and window-appearance.json | User themes and native window appearance. |
browser-passwords.json | Saved browser credential metadata and encrypted password ciphertext. |
browser-site-permissions.json and browser-downloads.json | Per-origin clipboard/fullscreen decisions and download preferences. |
| Embedded-browser partition | Cookies, web storage, cache, and other Chromium state for all built-in browser tabs. |
| Renderer local storage | Appearance and shortcut choices, preset-bar state, external-editor choice, browser bookmarks, and serialized terminal-history snapshots. |
logs/, diagnostics/, and Crashpad/ | Rotating application/runtime logs, structured diagnostic events and exports, and native crash minidumps. |
The projects you edit and downloads you save remain in their chosen filesystem locations outside this directory.
Terminal and agent data
Cordy's runtime and renderer process PTY output to emulate and display the terminal. When an agent preset uses pattern-based status detection, the runtime compares rendered screen text with its configured running, waiting, busy, and failure patterns. A matched evidence line can be held in the live agent state, capped at 256 characters; the inference engine does not write that evidence to disk.
For recovery, the renderer serializes up to 1,000 lines from each terminal's normal buffer into local storage. It excludes the alternate-screen buffer and terminal modes. While the app is open, the live PTY remains attached to the runtime; after a full quit, a new shell can display the saved text as static previous-session history, but the old process is gone. This history may contain commands and output that appeared in the terminal.
Cordy does not proxy terminal content to a model service. Each CLI agent manages its own provider login and network requests. If you place a credential in a custom preset's environment overrides, Cordy stores that value in agent-presets.json and passes it to the launched child process.
Built-in browser and passwords
All built-in browser tabs share the persistent persist:cordy-browser partition. Opening a URL sends ordinary requests to the site and its resources; downloads write to the selected destination. Cookies and web storage stay in that partition until removed through Site data or Clear all browsing data. Saved permission decisions, download preferences, bookmarks, and the password vault have their own stores and controls.
Passwords are encrypted before disk persistence with Electron safeStorage; Windows uses DPAPI. Cordy refuses to save or import a password when operating-system encryption is unavailable. Plaintext is materialized only for an explicit reveal or fill, and fill requires the active browser tab's scheme, host, and port to match the saved origin. See Built-in browser.
Logs, crashes, and exports
Current source has no Cordy analytics or cloud-sync client. Application and runtime diagnostics stay in local log files. Native crash capture writes minidumps under Crashpad/ with upload disabled and no submission URL.
Two manual exports are available:
- Settings → Diagnostics → Export log bundle creates a ZIP from your selected time range and selected main log, runtime log, diagnostic events, and system information.
- The full performance monitor can export a timestamped diagnostics package with application/environment data, metrics, runtime restart history, recent events, and log tails.
Both exports are local writes and redact absolute or path-like values. Cordy does not upload them; you decide whether to share them. Path redaction is not a general secret scanner, so review an export before attaching it to a report.
Deletion boundaries
The Diagnostics Storage section can clear logs, old diagnostics exports, crash dumps, disposable Chromium caches, and regenerable snapshot backups. It protects settings, themes, projects, workspaces, notebooks, browser governance files, the live project/workspace store, and non-regenerable recovery copies.
Browser-data clearing is separate and applies to the shared browser partition. Removing a saved password, revoking a site permission, changing the download directory, deleting a bookmark, and removing a custom preset each use their own UI.