Getting oriented

Your data

At Clanker Gear we believe that your data should remain yours. This is a full accounting of what data we receive and store — kept in step with the software, and a mismatch between this page and what the software does is a bug.

• We will never train on your data, and we require the same of everyone we send it to.
• The files in your repository are never stored at rest on our systems or any of our vendors’ — beyond the cache of embedding vectors described below. Content sent to cloud features is processed in memory and discarded.
• Signed out, the software contacts our servers only for updates — when you run rql update, or on a schedule if you enrolled in automatic updates. Never your content or usage data.
• Signed in, unless you opt out, it sends minimal usage data to help us improve the product — deleted from our primary store after 30 days, with every operational copy expiring within 90.
• We cache semantic embeddings — numeric vectors keyed by one-way hashes, never the text — to make indexing repositories faster and more cost effective.

You can opt out of usage telemetry with an environment variable, or by asking your agent to turn it off in the settings. The environment variable is honored every time the host starts; a settings change takes effect the next time it starts. These switches govern the rql binary — our websites’ analytics are described separately below.

What passes through our services and is not stored

Each of these is held in memory for the duration of the request, forwarded only to the provider that serves it, and discarded. It is not written to disk, not logged, and not attached to your account.

• The contents of your codebase, when indexing with a paid or trial account using high-quality cloud embeddings.
• Fragments of your repository required for cloud-based tool invocations — reranking, semantic search, inference.
• Tool requests and results relayed by uplink, if your organization uses rql uplink to reach its RepoQL instances through our gateway. The content transits; only the audit metadata below is kept.

The only model providers that receive your content are Voyage AI (embeddings, reranking) and Fireworks AI (inference), both under zero-retention, no-training configurations. Our cloud runs on Google Cloud, which hosts everything we process.

What we store

• Usage telemetry — while you are signed in, one record per tool call. The full field list and a real record are below. The parameters you passed are included as your agent typed them, truncated at 1,024 characters each — we never read your files into a record, but anything you or your agent paste into a query, question, or script goes as typed, and error messages can echo it. telemetry.params = false drops the values and keeps only the parameter names. Deleted from our primary store after 30 days; every operational copy (delivery queues, monitoring) expires within 90.
• Basic machine demographics attached to those records — OS, process architecture, rql version, which agent called us, and a random per-installation identifier that is not derived from your hardware; delete ~/.repoql/machine-id and it resets.
• Cached embeddings derived from your content — the vector and a one-way hash of the text. The hash cannot be reversed; the vector is derived from your content, so we treat it as confidential and delete it on request.
• Usage data for billing and rate limits — request counts, durations, and token counts, tagged with your organization and the repository the work was for (its normalized identity, like github.com/org/repo), retained as billing records.
• An audit trail of uplink calls — if your organization uses rql uplink, each relayed call records your organization, member, instance, tool, target, outcome, timing, payload sizes, and the calling client’s name and version. Never payload content. Kept so your organization can audit its own usage — your use through uplink is visible to your organization; that is the trail’s purpose.
• Basic identifying information about your organisation and its members, required to operate the service — name, email, organization membership, plan and subscription status.
• Feedback you explicitly submit — your message plus a diagnostics snapshot of the running host (memory, performance, and index statistics — no file contents). Feedback text also appears in our server logs.
• Website analytics — our public site and portal use Datadog Real User Monitoring, proxied through our own servers with no persistent identifier. On the public site, sessions are recorded and 15% include session replay (the content there is public). In the portal, 5% of sessions include replay with all text masked, and sessions are attached to your signed-in identity — user id, email, organization, role. DO_NOT_TRACK is an environment variable and does not reach a browser; these are separate from the binary’s telemetry. This page itself loads no analytics.

The software does not report installs or updates today; if that ever changes, this list grows first.

Every field of a usage record

A real record, in full:

After a record reaches us, our server may replay it to Datadog, our monitoring provider, so we can watch error and empty-result rates live — the same fields, nothing more, expiring within 90 days. If you have opted out, there is no record to replay.

This page is kept in step with the software, and a mismatch is a bug we want to hear about. Questions, corrections, requests about your data: privacy@repoql.ai.