Product policy · September 28, 2026

Privacy, stated precisely.

Commandem is local-first. That describes where Commandem keeps its state. It does not mean every service you connect to is local.

Data stored by the product

Commandem stores its project registry, Profiles, Loadouts, preferences, notification state, indexed agent history, Matrix metadata, experiment records, and run receipts locally. Some provider CLIs also keep their own local history and credentials under their own policies.

Data sent to model providers

When you start or continue an agent turn, the selected provider receives the prompt and the context selected for that turn. Provider retention and training settings are controlled by that provider and your account plan. When Commandem cannot read a provider setting, it reports that posture as unknown rather than assuming it is safe.

Optional integrations

GitHub, comments and notes adapters, browsers, sync providers, remote machines, and other tools contact their respective services only when configured or invoked. Their privacy terms apply. Receipts aim to identify the effective provider, account, policy, and evidence source without recording credentials.

Sensitive data controls

Privacy gates, context manifests, secret redaction, protected-path rules, and explicit account routing reduce accidental disclosure. They are guardrails, not a promise that a model provider cannot retain or train on submitted data. Review provider settings before sending sensitive material.

This website

The public website has no signup form and intentionally sets no application cookies. Its hosting provider may process ordinary request data such as IP address, user agent, path, timing, and security events to deliver and protect the site. Interactive catalog pages refresh community entries through a same-origin registry proxy. Offline previews use bundled entries and do not claim a successful refresh.

Deletion and control

Inventory and back up local state before removing it. Read the data-removal guidance; removing the app itself does not remove all local data. Deleting local data does not delete copies already sent to a model provider or configured integration; use that provider’s controls for those copies.

Current scope

This page documents the pre-release product and website as they exist today. It is not a substitute for the policies of model providers or integrations. Material behavior changes will require this notice to change with them.