Privacy Policy
Last updated: November 7, 2026
Gitwright is a local-first Git workbench for macOS, Windows and Linux. This policy describes what the application stores, when it uses the network, and what stays on your machine.
1. Summary
- There is no Gitwright account, sign-in or subscription. The application never asks for one.
- Your repositories, working tree, diffs and commit messages are read and written on your machine. They are not uploaded to us.
- The application contains no advertising SDK and no third-party analytics SDK.
- Network connections happen only when you configure or trigger one of the operations in section 4.
2. Data stored on your machine
| Data | Location | Purpose |
|---|---|---|
| Settings | macOS ~/Library/Application Support/Gitwright; Windows %AppData%\Gitwright; Linux ~/.config/Gitwright | Theme, language, Git binary path, diff and pull preferences, AI profile names, MCP port |
| Local database | Same directory | Recent repositories, repository catalog, application state. Stored in SQLite. |
| Logs | macOS ~/Library/Logs/Gitwright; a logs directory inside the data directory on other platforms | Troubleshooting. Rotated by size and count. |
| Recovery snapshots | A snapshots directory inside the data directory | Restoring discards, stash drops, aborted operations and force pushes |
| Forge and agent secrets | The operating system keychain | GitHub, GitLab, Gitea and Bitbucket Cloud tokens; ACP agent environment variables; the MCP bearer token |
Uninstalling the application does not delete these directories. Remove them manually if you want a full wipe.
3. What is never collected
- Repository contents, diffs, commit messages, branch names or remote URLs as analytics.
- The contents of files you stage, commit or discard.
- Passwords, personal access tokens or private keys in a readable form. Secrets live in the OS keychain, not in
settings.jsonor logs. - Application usage events. There is no event pipeline and no crash-reporting service.
4. Network connections
Gitwright opens a connection only for the operations below.
| Connection | Triggered by | What is sent |
|---|---|---|
| Git remotes | clone, fetch, pull, push | Whatever the system git sends for that protocol, using credentials already configured for the remote (credential helper, SSH agent) |
| Forge APIs | listing pull/merge requests, checks, comments, approvals, merges | Repository identifier, PR/MR number, and the comment or review text you wrote. Tokens are read from the OS keychain. |
| ACP agent | drafting a commit message, explaining a diff, reviewing a change set or a branch | Exactly the scope shown in the confirmation step. The agent process is one you installed and chose to trust. |
| Loopback MCP server | you enable it in Settings | Binds to loopback only and requires a bearer token. Nothing leaves the machine. |
| Update check | you enable automatic checks or press “Check now” | Current version, platform and channel. No repository content. |
Git commands are executed by the system git binary. Authentication, credential helpers, SSH agents and proxy configuration are therefore the ones already configured on your machine.
5. Logs and diagnostics
- Logs never contain diff bodies, note bodies, credentials, tokens or AI prompt contents.
- Git command output is redacted before it is written to the logs, where it could otherwise contain credentials or userinfo in a remote URL.
- A diagnostics export is a ZIP of logs, system information and the effective configuration. Review it before sharing; it can still contain local paths and repository names.
- On macOS and Windows, a crash log may be written next to the application logs. It follows the same local-only rule.
6. Third-party services
Gitwright has no payment processing and no accounts to provision. The third parties involved are the ones you choose to connect:
- Your Git hosting provider, through the system
gitclient. - A forge API (GitHub, GitLab, Gitea, Bitbucket Cloud) if you add a token.
- An ACP-compatible agent you install and configure.
- A local MCP client, which stays on the loopback interface.
Each of those services has its own privacy policy. Data you send to them is governed by that policy, not this one.
7. Your controls
- Disable automatic update checks in Settings.
- Disable the MCP server in Settings.
- Remove forge tokens and ACP agent variables from Settings or from the OS keychain.
- Delete individual recovery snapshots in the recovery centre, or let them expire.
- Delete the data directory to remove settings, the database, logs and snapshots.
- Build the application from source if you want to inspect every network call.
8. Children
Gitwright is a developer tool and is not directed at children. There is no account or profile to collect data from.
9. Changes
This policy may change when the application’s behaviour changes. The date at the top of this page reflects the current text.
10. Contact
Questions about this policy: contact@once.work.