--- title: "Privacy policy ยท Cork" description: "How Cork handles your data: Cork, free and local, keeps everything on your machine; on the paid plan your source files stay on your machine and Cork receives their structure (names, signatures, docstrings, line hashes). Pull request checks read code from GitHub only if your workspace chooses." canonical: "https://corkcli.com/privacy" last_updated: "2026-11-13" --- # Privacy policy Last updated: November 13, 2026 Cork is operated by Lithometric ("we", "us"). This policy explains what we collect, what we deliberately do not collect, and what we do with it. The short version: **Cork with no account keeps everything on your machine**, and once you sign in **your source code does not persist on our servers**: Cork's hooks parse your files on your machine and send only their structure (names, signatures, docstrings, who calls what, line hashes); older hooks and the MCP report\_edit tool send a file's text, which we parse in memory and discard. We never store your source files. Pull request checks read code from GitHub only if your workspace chooses, and keep only its structure. Exactly what each request carries, and how to check it on your machine, is on [What Cork sends](https://corkcli.com/data). ## Cork, free and on your machine The free version installs one program on your computer (`~/.cork`) with a small server that listens on `127.0.0.1` only. Everything it records (what your agents read and changed, its code map, notes and messages between agents) stays in `~/.cork/local` on that machine. It sends us nothing, except to check for a signed update of itself. If you sign the machine in (`cork login`, or the install your agent runs from `setup`), we learn the machine's name, its operating system, a random machine id, and its totals (tokens saved, agents, repositories, changes), so your dashboard can show them. Signing in also moves the machine onto our servers, on Free as on a paid plan: it sends its local history to the workspace each repository belongs to, and from then on works as described below. Repositories with no remote on a git host stay on the machine. ## What we store once a machine is signed in **Code structure, never your source files.** Cork's hooks parse a file on your machine and send its structure: symbol names, kinds, signatures, docstrings, which symbol calls which, content hashes, line ranges and file paths. When an agent reports a file through the MCP server instead, its content is parsed in memory on our server and discarded the same way. No version of the hooks or the MCP tools leaves a file's text on our servers. **Pull request checks.** Where you install Cork's GitHub App, it checks each pull request in the repos you give it. By default it reads only the PR's file names and changed line numbers from GitHub (the patch text GitHub sends with them is dropped unread). If the workspace owner chooses "Read code for PR checks", it also reads the PR's changed files at its base and head, and once a copy of the default branch, parses them in memory on our servers and keeps only their structure, the same structure the hooks send; the text is never stored or logged. While a PR is open we keep its number, title, author's GitHub login, branches and the symbols it changes, and drop them when it closes. The check and the comment Cork posts are visible to everyone who can see the PR: they name teammates by GitHub login, never by email, and on a public repo they say a pinned note exists without quoting it. Exactly what each choice reads and keeps is on [What Cork sends](https://corkcli.com/data#pr-checks). **Activity.** An append-only, hash-chained record of what agents did: edits (paths, line counts, changed symbols), checks, intents, messages between agents, claims, and the token usage each agent's harness reports, so the dashboard can show cost and savings. **Notes.** Notes your agents or teammates save on purpose, and, when an agent finishes a turn that changed code, the first paragraph of its closing message, kept as a note on the code it changed so the next agent there sees it. **Prompts.** On the paid plan and Enterprise, a prompt is used once to find the code it is about. Its text is not stored; a numeric summary of its meaning is kept for about two hours, and the code names it mentions are kept to learn which files they lead to. The model that makes that summary runs on our own servers: prompts are not sent to any outside AI provider. **Account data.** Your email address, display name and avatar, through Firebase Authentication (Google or GitHub sign-in, or email). Workspace names, members, invites and nicknames. GitHub sign-in gives us your username, avatar and email; we keep no personal GitHub token. Cork's GitHub App, where you install it, reads repository names and organization members, and for pull request checks what is described above. **Billing.** Payments are processed by Stripe. We never see or store card numbers; we keep your Stripe customer and subscription identifiers, your plan, seats and monthly usage counts. **Product analytics.** We use PostHog to learn how people find and adopt Cork: pages visited on this site, where you came from (referrer and campaign tags), clicks on the connect and pricing buttons, and account milestones such as signing up, connecting an agent, starting a trial and subscribing. These events carry your account id, email, workspace id and repository name, never code, file contents or tool-call contents. PostHog keeps an identifier in your browser's local storage and a first-party cookie. **Email.** We email you about your account and workspaces: invitations, billing, and notices such as a teammate waiting on you. Each kind can be turned off in your email settings on the dashboard, or from the email itself. New accounts also get Cork's product news, about Cork only and at most twice a month. You can say no when you sign up, turn it off in your email settings, or unsubscribe with one click from any news email. We keep when and how you answered, and the words you were shown, so we can show what you agreed to. We never sell or share your address. ## Who sees what A workspace's records are visible to its members and to no one outside it. Players (members with a seat) see the full detail. Viewers see who is working on what, collisions and savings, but not the code-level detail: changed lines, signatures, notes and recipes. Your account and machines are visible only to you and the workspaces you belong to. ## Model and interaction data **We learn from how agents coordinate, never from your code.** Cork retains protocol and interaction data from paid workspaces: how agents declare intent, check for collisions and adapt to one another, the sequences and timing of their tool calls, collision and reconciliation patterns, and aggregate usage. This coordination data is owned by Cork, and we may use it, now and in the future, to operate, improve and train our own models and systems. We do not use your source code, snippets, prompts or notes for training. Cork, free and local, sends us none of it. ## What we do not do We do not sell your data. We do not train on your source code, snippets, prompts or notes. We do not show ads. We do not share workspace contents with anyone outside the workspace. ## Processors we rely on Railway (hosting and database), Cloudflare (backups and network), Google Firebase (sign-in), Stripe (payments), PostHog (product analytics), Resend (email invitations, notices and product news), Cal.com (demo bookings) and GitHub (sign-in, and the GitHub App where you install it). Each receives only what it needs for its job. ## Retention and deletion How far back you can see depends on the plan: 30 days on Free, 90 days on the paid plan, unlimited or custom on Enterprise. Older records are kept, not deleted, so they come back if you upgrade; ask us and we will delete them. Presence (who is working right now) expires within minutes. With Cork free and local, everything is on your machine: `cork uninstall` removes the hooks and deleting `~/.cork` removes the rest. You can delete your account yourself from **Settings, Delete account**, which immediately removes your login, profile, workspace memberships and credentials. To delete a whole workspace and its record, or for any other request, email [kevin@lithometric.com](mailto:kevin@lithometric.com); we complete deletion within 30 days. ## Self-hosting On Enterprise self-hosted or private deployments, all of the above lives in your infrastructure and this policy covers only the account and billing data we hold. ## Changes and contact We update this page when the policy changes and note the date above. Questions: [kevin@lithometric.com](mailto:kevin@lithometric.com), or see [support](https://corkcli.com/support). This page in HTML: https://corkcli.com/privacy