How kcap handles your data
The full account is Data security and privacy in kcap. This is the page to read before your first session
What is sent
Section titled “What is sent”When a session is stored, kcap sends the transcript and lifecycle events: your prompts, the agent’s replies, every tool call with its input and result, thinking text when the agent exposes it, token usage, subagent transcripts, the repository and branch, and the commits the agent makes. Not your repository: file contents and diffs appear only where a prompt or a tool result contained them. A plan document the agent declares is sent in full, up to 256 KB
Treat a transcript as sensitive by default. If a prompt or a command’s output contained a secret or a confidential discussion, it is in the transcript
What is kept out
Section titled “What is kept out”- Exclusions and allow lists decide, on your machine, which repositories and folders are stored at all. Nothing excluded is sent, live or on import
- Redaction removes recognised secret patterns such as API keys and tokens before upload, from transcripts and from commit messages. It cannot recognise a confidential conversation
- Records over 4 MiB are replaced by a capture-loss marker rather than sent
Who can read it
Section titled “Who can read it”Your default audience, then whatever you set per session. Admins can see that sessions exist and how many; they read content only where the audience allows. Agents read through kcap’s tools only what their user could read in the web app. Kurrent and its employees do not have access to your workspace’s data; Access by Kurrent says what that means in practice
Where it lives
Section titled “Where it lives”A cloud workspace runs on infrastructure Kurrent operates, one workspace per organisation, encrypted at rest. The local edition keeps everything on your own machine and listens only on the loopback interface; its server sends no telemetry, though the CLI and desktop app still do until you turn it off. Data location has the specifics
What kcap knows about you
Section titled “What kcap knows about you”Your identity from sign-in, your sessions’ metadata, and, for the CLI and web app, anonymous usage telemetry you can turn off. Telemetry lists it and the switches
The controls, in one place
Section titled “The controls, in one place”| To | Do |
|---|---|
| Keep a repository out | kcap ignore <path> or excluded_repos |
| Store only some repositories | kcap allow <path> or allowed_repos |
| Make new sessions private | kcap config set default_visibility private |
| Hide one session | kcap hide, or ask your agent |
| Delete one session | kcap disable <id>, or ask your agent |
| Turn telemetry off | kcap config set telemetry off |