Privacy

Local-first means exactly that.

This page states plainly what the skep tool and this website do and do not collect. Last updated 2026-07-30.

The skep tool

  • No account, no cloud, no telemetry. Skep runs entirely on your machine. It does not phone home, report usage, or send analytics anywhere.
  • Your code stays with you. Runs, patches, evidence, approvals, and the audit ledger live in a local SQLite store under ~/.skep.
  • Secrets ride by name. Skep stores environment-variable names, never their values. Values are read from your environment at run time and passed only through the explicit allowlist.
  • Network is policy. Workers get no outbound network unless your policy or an approval grants specific domains. The only external traffic skep itself makes is to the model provider you configure (Anthropic, Ollama, or another endpoint) — under your keys, under your control.
  • The web UI binds to loopback. skep serve listens on 127.0.0.1 only, token-gated. Nothing is exposed to your network unless you expose it.

This website

  • No cookies, no analytics scripts, no trackers. This is a static site; we run no analytics of our own.
  • Hosting. The site is served by GitHub Pages, so GitHub's standard server logs apply (see GitHub's privacy statement).
  • Third-party requests your browser makes. Fonts load from Google Fonts, icons from unpkg, and the live repository numbers (stars, forks, issues, latest version) are fetched by your browser directly from the GitHub and PyPI public APIs. Those services see the requests your browser sends them; we receive nothing.

Questions

Open an issue or discussion on GitHub. For anything private — including security reports — use the contact on the security page.