PRIVACY POLICY FOR CODEWHISPER

Last Updated: September 3, 2026

Jamsoft Inc. ("Jamsoft," "we," "us," or "our") respects your privacy. This Privacy Policy explains how information is handled when you use CodeWhisper (the "App"), a macOS application available through the Apple Mac App Store.

CodeWhisper is a read-only tool that explains what a codebase does, reports security weaknesses and quality concerns, and assesses architecture. It never modifies, patches, rewrites, deletes, or formats your source code.

This Privacy Policy covers CodeWhisper for macOS. There is currently no iOS version of CodeWhisper. If we release a version for iOS or another Apple platform, we will update this Privacy Policy to describe how that version handles information before or at the time it becomes available.

1. INFORMATION WE DO NOT COLLECT

CodeWhisper does not require you to create an account. We do not ask you to provide your name, email address, telephone number, mailing address, payment information, or other direct personal identifiers to use the App.

There is no Jamsoft server that the App communicates with, and no Jamsoft cloud account. We receive no data from the App: not your code, not your analysis results, not your usage patterns, not your API keys, and not your identity.

The App does not use analytics tools to collect non-personal information such as device type, operating system version, or usage patterns. We do not use advertising SDKs, third-party behavioral analytics, attribution frameworks, third-party crash reporting, or tracking technologies. We do not sell personal information or share personal information for cross-context behavioral advertising.

2. INFORMATION STORED ON YOUR DEVICE

CodeWhisper stores information locally on your Mac, inside its own sandboxed container, so that the App can remember your work and provide its features. This information may include:

Your projects: the name and location of each codebase you have opened, and a security-scoped bookmark that allows a previously opened folder to be reopened.

Your reports: the analyses you have run, saved as structured metadata alongside the report text.

Your learning records: quiz results, Explain It Back grades, reading-path progress, and understanding coverage for each project.

Snapshots: copies of your project's text files, kept as a baseline so the App can detect and explain changes made outside it.

Cloned repositories, when you clone a repository rather than open a local folder.

Downloaded on-device model files.

Your preferences: selected AI provider and model, appearance, confirmation and session-restore settings, and any custom endpoint address.

None of this is transmitted to Jamsoft or synced to any cloud service by the App. Deleting a project from the Dashboard removes its stored reports and related data, and removing the App and its container removes all of it.

3. HOW CODEWHISPER ANALYZES YOUR CODE

CodeWhisper's analysis features work by sending code to a large language model. You choose which engine performs that analysis in Settings, and that choice determines whether anything leaves your Mac at all.

If you choose an on-device engine, your code never leaves your Mac. If you choose a cloud AI provider, the App sends the content you asked it to analyze directly to that provider, using your own API key. The sections below describe both paths.

4. AI PROVIDERS YOU CHOOSE

If you select a cloud AI provider, the App transmits the content you asked it to analyze directly from your Mac to that provider's API over an encrypted TLS connection, authenticated with the API key you supplied. The connection is between you and that provider. Jamsoft is not a party to it, does not proxy it, and cannot see it.

If you choose Claude, the App contacts api.anthropic.com and no other AI host.

If you choose OpenAI, the App contacts api.openai.com and no other AI host.

If you choose Google Gemini, the App contacts generativelanguage.googleapis.com and no other AI host.

If you configure a Custom Endpoint, the App contacts only the base URL you entered. This allows you to use a server you operate yourself, such as one running on your own machine or inside your own network, so that your code never reaches a third party.

Your API key for a given provider is sent only in the authorization header of requests to that same provider's host. It is never sent anywhere else, and never to Jamsoft.

5. WHAT IS SENT TO YOUR AI PROVIDER

Depending on the feature you invoke, the content transmitted to your chosen cloud provider may include:

The contents of the file or the specific lines you selected.

For whole-repository features such as Architecture, File Guide, repository Security review, Sweep Repo, and Explain Codebase: the file tree outline and the contents, sometimes truncated, of the reviewable files in the project you opened.

Diffs and git patches, when you use Explain Changes or ask the App to explain a commit from your git history.

Code you paste into the Scratchpad.

The text of your follow-up chat questions, your quiz answers, and your Explain It Back write-ups.

Basic request metadata required by the provider's API, such as the model name and token counts.

Before any whole-repository run, a preflight sheet shows you the exact files whose contents will be sent, the token estimate, and the approximate cost, so that you can cancel before anything is transmitted. This confirmation can be turned off in Settings. Per-file analyses run immediately.

6. YOUR PROVIDER'S TERMS GOVERN THAT DATA

Once data reaches your chosen provider, that provider's privacy policy, terms of service, and data retention and training policies apply, under your own account with that provider. We encourage you to review them.

Anthropic: https://www.anthropic.com/legal/privacy

OpenAI: https://openai.com/policies/privacy-policy

Google: https://policies.google.com/privacy

If you use a Custom Endpoint, the policies of whoever operates that server apply. If you point it at a server on your own machine or network, the data stays within that boundary.

7. YOUR RESPONSIBILITY FOR THE CODE YOU ANALYZE

You choose which codebase to open and which engine to analyze it with. If a repository contains personal data, customer data, trade secrets, or material you are contractually or legally restricted from disclosing to a third party, you are responsible for deciding whether sending it to a cloud AI provider is appropriate. If it is not, use an on-device model or a Custom Endpoint that you control.

8. ON-DEVICE ANALYSIS

CodeWhisper offers engines that run entirely on your Mac, so that your code never leaves the machine.

Local (On-Device) analysis runs open-weight models locally through Apple's MLX framework. It requires no account and no API key, and makes no network request at analysis time.

Quick Summary produces per-file summaries using Apple Intelligence and Apple's on-device Foundation Models. This is handled within Apple's on-device framework, and no code is transmitted by the App.

These options allow you to use CodeWhisper with no third-party processing of your code at all.

9. ON-DEVICE MODEL DOWNLOADS

The first time you use a local model, the App downloads the model weights from huggingface.co into its own storage. This request retrieves public model files. It does not carry your code, your API keys, or any identifier we assign to you. Downloads are gated on your Mac's installed RAM, and you can delete downloaded models in Settings to reclaim the space.

10. GITHUB REPOSITORY CLONING

If you use the App to clone a repository, it contacts github.com, api.github.com, and codeload.github.com to download that repository's archive. Only the sanitized owner and repository name you supplied appear in the request.

For private repositories, you may save a fine-grained GitHub personal access token with read-only Contents scope. That token is stored in the macOS Keychain and is sent only to GitHub's own API hosts to authenticate your clone. It is never sent to Jamsoft or to any AI provider.

GitHub's privacy statement applies to these requests: https://docs.github.com/site-policy/privacy-policies

11. API KEYS AND CREDENTIALS

API keys and tokens you enter are stored in the macOS Keychain, protected so that they remain on that device only. They are never written to preferences, log files, or ordinary disk storage, and they never leave your Mac except in the authorization header of a request to the provider or host that issued them. You can remove a key at any time in Settings.

12. SECRET REDACTION

The App statically scans every codebase it opens, on your Mac and without any network request, for hardcoded credentials such as cloud provider keys, tokens, and private key material. Matched credential values are redacted in place before any content is placed in a prompt, including file contents, repository digests, diffs, and git patches, so that the credential value itself is not transmitted to an AI provider while line numbers and surrounding context remain intact.

This redaction is a safeguard, not a guarantee. It matches known credential patterns and cannot recognize every possible secret or every form of sensitive content. Please review what you are analyzing.

13. FILE ACCESS AND PERMISSIONS

The App runs with the macOS App Sandbox enabled and holds read-only access to files, limited to the folders and files you explicitly select. It does not browse your disk on its own, does not read hidden files or dependency directories, and skips binary files. Its git integration is strictly read-only. The App never writes to, patches, or deletes your source code.

14. NO ICLOUD SYNC

CodeWhisper for macOS does not use iCloud, CloudKit, or any other synchronization service. Its data stays on the Mac that created it and does not sync between your devices. This differs from some other Jamsoft applications; each app is governed by its own privacy policy.

15. APP STORE INFORMATION FROM APPLE

Because the App is distributed on the Mac App Store, Apple provides us with standard App Store reporting, such as aggregate download, sales, and territory figures, and, where you have chosen to share it with developers, aggregate app analytics and crash diagnostics. We receive this information from Apple in aggregate form and cannot use it to identify you. Its collection is governed by Apple's Privacy Policy, which you can review at https://www.apple.com/legal/privacy/, and you can change what you share in macOS under Privacy and Security, Analytics and Improvements.

16. CHILDREN'S PRIVACY

The App does not knowingly collect any personal information from children under the age of 13, or the equivalent minimum age in the relevant jurisdiction. Since we do not collect personal information of any kind, we have no way of determining the age of a user. CodeWhisper is a professional and educational developer tool intended for a general audience.

17. SECURITY

Security measures in the App include the macOS App Sandbox with read-only file access, the hardened runtime, Keychain storage for credentials, TLS with App Transport Security defaults for all network requests, redaction of detected secrets before prompting, treatment of analyzed code as data rather than as instructions in order to defend against prompt injection, and size and path-traversal limits on downloaded archives.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

18. YOUR CHOICES AND CONTROLS

You can use an on-device model, or a Custom Endpoint that you operate, to keep all analysis local to your machine or network.

You can review the preflight sheet before any whole-repository run to see exactly which files would be sent.

You can remove any stored API key or GitHub token in Settings.

You can delete projects, reports, and downloaded models from within the App.

You can deny or revoke folder access through macOS system settings.

19. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page. You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

20. CONTACT US

If you have any questions about this Privacy Policy, please feel free to contact us at:

Jamsoft Inc.

Email: support@jamsoftinc.com