← Back to homepage

Where your data lives

Klabauter is not 100% local — and this page shows completely and honestly: what stays on your Mac, what goes out, when, why, and to whom.

Stays on the Mac

  • → All scores and reports — as an open cache in .pumuckl right inside each repo (the open format is still historically named .pumuckl; readable, diffable, no lock-in)
  • → Finds (links/notes via ⌘⇧M) including embeddings — on-device via Apple NaturalLanguage, local SQLite DB
  • → Portfolio knowledge (capabilities/RAG), favorites, parked state, rekindled stamps
  • → Morning-greeting engagement learning (what you open, what you dismiss)
  • → Settings and watch-folder configuration

Goes out — and where to

  • · AI scoring (triage & deep analyses): project context — README, package manifest, git-log summary — goes to the AI endpoint of your choice. Default: kimi acp (Moonshot). Alternatives: any OpenAI-compatible endpoint or DeepSeek via jcode. Straight from your Mac, no moinsen.dev server in between.
  • · GitHub API: inventory, archiving, deleting, and cloning run through the gh CLI — with your own gh login. Klabauter never sees a token.
  • · That's it. No third destination. No analytics endpoint, no license server, no crash reporting.

Deliberately not built

  • No telemetry. Not even "anonymous usage statistics". Not crash reports either (Sentry or similar would be opt-in, if ever).
  • No accounts. No Klabauter login. There is nothing you could sign up for with us.
  • No analytics. No Google Analytics, no Plausible, nothing on the landing page beyond Cloudflare edge request logs.
  • No remote feature flags. What you installed is what's in the binary.
  • No Klabauter cloud. We can't sell or lose what we never have.

For compliance officers & data protection officers

GDPR Art. 28 (data processing on behalf)

Klabauter as a vendor does not process personal data of your employees on behalf of a controller. The software runs on the user's device; there is no Klabauter-side server processing.

Important and honest: for AI scoring, project content (README, manifest, git-log summary) is transmitted to an AI endpoint. Which one is configured by the user (default: Moonshot via kimi acp; alternatively OpenAI-compatible or DeepSeek via jcode). Whether a DPA is required depends on the chosen endpoint provider — check their terms. GitHub access runs through the gh CLI with the user's login; the GitHub terms you already have apply.

EU AI Act Art. 50 (transparency obligations)

Klabauter is not a "provider" of an AI system within the meaning of EU Regulation 2024/1689 (EU AI Act). The models used are provided by their respective vendors (Moonshot AI, DeepSeek, or whichever OpenAI-compatible provider you configure).

Klabauter is an interface to these models, not a model provider. Transparency and labelling obligations under Art. 50 fall on the respective model providers. The software itself classifies as a non-high-risk AI system (no area listed in Annex III).

Note: The statements above are the vendor's legal assessment based on current regulation texts. They do not replace your organisation's own legal review. Questions: developer@moinsen.dev

How to verify it yourself

This page describes intent. If you want to verify:

  • Open Activity Monitor → Network while using Klabauter. Outbound should be exclusively your configured AI endpoint and api.github.com (via gh).
  • Set Little Snitch to "ask on every connection". Klabauter should request exactly these two destinations — nothing more.
  • Read the .pumuckl files in your repos — it's your data in an open format, and you can trace every score.
→ Privacy Policy → Trust: four honest answers → GitHub: Issues & Discussions