Privacy Policy
Last Updated: July 6, 2026 · v1.0.6
Effective Date: June 28, 2026
DevDiff ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we handle your data when you use the DevDiff CLI, Gateway, VS Code Extension, Open VSX Extension, and associated open-source packages (collectively, the "Software").
1. Core Philosophy: Privacy-First by Design
DevDiff is built under a local-first, offline-capable paradigm. We believe your source code, configuration values, and API keys are your intellectual property and must remain under your control at all times.
TL;DR — DevDiff never phones home. No telemetry. No analytics. No cloud servers in the middle. Your code stays on your machine.
2. Data We Process
A. Local Model Processing (Default)
When configured with local models (Ollama, llama.cpp, WebGPU/Transformers.js):
- Entirely Local: All AST parsing, diff extraction, token evaluation, and LLM inference run inside your local system memory.
- Zero Network Egress: No data is transmitted over the internet.
- Offline Capable: DevDiff functions completely offline once models are downloaded.
B. Cloud Model Processing (Opt-in Only)
When you explicitly configure cloud AI providers (OpenAI, Anthropic, Google Gemini, etc.) in .devdiff.config.js:
- Direct API Communication: DevDiff transmits the pre-trimmed and redacted diff context directly to the configured provider's API endpoint.
- No Intermediate Servers: Requests are never proxied through DevDiff servers. Your API keys are loaded from local environment variables into memory at runtime only.
- Provider Policies Apply: Data sent to cloud providers is subject to their privacy policies. Most API providers guarantee that data sent via the API is not used for model training.
C. Automated Credential Redaction
Before any context is sent to any model (local or cloud), DevDiff's Redaction Engine v2 scans and strips:
- AWS access keys and secrets
- GitHub personal access tokens
- OpenAI/Anthropic/Gemini API keys
- Private SSH/PEM keys
- Database connection strings and passwords
.envvariable values matching credential patterns
D. What We Never Collect
| Data Type | Collected? |
|---|---|
| Source code or diffs | ❌ Never |
| CLI command history | ❌ Never |
| Repository names or paths | ❌ Never |
| API keys or credentials | ❌ Never |
| IP addresses | ❌ Never |
| Crash reports / telemetry | ❌ Never |
| Usage analytics | ❌ Never |
3. Documentation Website
The DevDiff documentation site (https://devdiff.vercel.app) is hosted statically on Vercel.
- We do not use cookies or behavioral trackers.
- We do not store or collect personal data from visitors.
- Vercel may collect anonymized infrastructure metrics (such as page load times) per their own Privacy Policy.
4. Open Source Transparency
DevDiff is fully open source under the MIT License. You can audit every line of code that handles your data:
- GitHub Repository: https://github.com/EldrexDelosReyesBula/devdiff
- Redaction Engine:
packages/core/src/ai/redaction-engine-v2.ts - Network Guard:
packages/core/src/security/network-guard.ts - Injection Guard:
packages/core/src/security/injection-guard-v2.ts
5. Data Retention
DevDiff does not operate servers, databases, or data stores. There is nothing for us to retain.
Local artifacts generated by DevDiff (e.g. .devdiff/ context files, encrypted audit logs) are stored entirely on your own filesystem and can be deleted at any time by removing those directories.
6. Your Rights
Because we collect no personal data, there is no data to access, correct, export, or delete on our end. You retain full control over all data processed locally.
7. Contact
For privacy-related questions, please open an issue on GitHub:
https://github.com/EldrexDelosReyesBula/devdiff/issues
8. Changes to This Policy
We may update this policy when the Software's behavior changes in ways relevant to privacy. All changes are published to this page with a "Last Updated" date and tracked in git history.