# Privacy

> What Switchyard stores locally, sends only by choice, and excludes from telemetry.

Switchyard is local-first and has no required product telemetry or cloud
account. Project metadata, manifests, operations, audit history, logs,
diagnoses, feedback, recipes, plugins, and settings remain on the local machine
unless the user explicitly exports or sends them.

Deterministic discovery reads only bounded allowlisted repository files and
does not execute code. Optional AI onboarding or diagnosis sends the exact
previewed, bounded, redacted evidence bundle to the provider the user selected;
provider use is not required for any deterministic workflow. Provider terms
and retention apply after that explicit request.

Support bundles always exclude source, database contents, resolved secrets,
arbitrary environment values, terminal output, and project application logs.
The exact manifest is previewable before a private archive is written, and the
archive contains only allowlisted system/configuration facts plus recent
redacted internal daemon warnings and errors. Logs and diagnostic evidence
share the same redaction pipeline before display, persistence, export, or
provider use. Novel secret formats remain a residual risk, so bundles should
still be reviewed and shared privately.
Plugins are external programs with separately reviewed fingerprints and scopes;
their own network or data behavior remains the plugin publisher's
responsibility within permissions granted by the user.

Optional peer federation sends only the bounded identity, trusted-project, and
registered-environment fields documented in the federation guide. It excludes
repository locations, source, Git changes, logs, terminal output, secrets,
environment values, and runtime-native identifiers. Switchyard does not supply
the tunnel or relay remote traffic through a hosted service.

Encrypted team sync contains only explicitly trusted public publisher records
and verified portable configuration bundles. The standard age file excludes
projects, repository paths and contents, machine credentials, fleet records,
operations, logs, terminals, environment values, and runtime state. Decryption
occurs in the CLI process and import is previewed before confirmation.

Anonymous usage metrics are off by default and have no vendor-controlled
destination. Opt-in requires an explicit HTTPS endpoint and displays the full
payload: a random anonymous installation ID, Switchyard version, operating
system, architecture, fixed operation-category counters, and generation time.
It contains no project, machine, action, plugin, provider, path, command, log,
diagnostic, or error detail. Disabling metrics clears the installation ID and
all pending counters. A signed team policy may prohibit opt-in.