What leaves your machine, in writing.

These live only on your machine. Rift never uploads, syncs, or backs them up:

• —Your stored transcripts and raw exports — ChatGPT, Claude, and Grok exports, plus captured Claude Code and Codex CLI sessions. The original files Rift reads are left untouched.
• —The vector index (LanceDB tables) and the local embeddings cache.
• —Your Voyage API key, in ~/.rift.env (mode 0600). Status output shows only the last 4 characters.
• —Your username, machine name, and home-directory paths — none of these appear in anything that leaves.

The stored copies never leave. The content inside them is sent out only for the optional paths you turn on — embedding (with a Voyage key) and AI processing (Codex enrichment or live capture) — that’s the next two sections. The files are local; the words travel only where it says they do, and only once you opt in.

Semantic search is optional and activates only when you add a Voyage API key. With a key, text is sent to Voyage AI for embedding two ways: when Rift indexes new content (snippets, one per chunk), and when you run a semantic search — the query text itself is embedded before the vector lookup. The returned vectors are stored locally. Without a key, search stays lexical/keyword and no text is embedded or sent. (A direct rift get --id lookup never embeds; keyword search never embeds; only a semantic search embeds the query first.)

Per-friend isolation. During the beta, every friend gets their own Voyage project and key, scoped and budgeted separately. You can ask Clem to revoke yours at any time — revocation is immediate.

Rift can do three kinds of language-model work — triage (what to keep, part of live capture), metadata extraction (titles, topics, decisions), and digest summaries. All of it is off by default: a fresh install makes zero Codex calls, even on a Mac with Codex already installed and signed in. Two separate opt-ins turn it on — Codex AI enrichment (metadata + digests) via rift onboard --enable-codex-enrichment, and live chat capture (which triages new sessions) via rift onboard --enable-capture. Once on, the relevant conversation content is sent to Codex/OpenAI under your own account.

Why Codex CLI when you do opt in? It needs no API key, costs you nothing beyond the subscription you already have, and produces materially better triage and metadata than the local models we’ve benchmarked. Prefer to keep enrichment fully local? Ollama covers metadata and digests today; local triage is on the roadmap.

About once an hour, the daemon checks registry.npmjs.org for the latest beta version, so rift status can tell you when an update is available. It’s a plain GET with no auth and no identifying headers — the same call any npm install already makes. No content, no installation ID, no key, no machine name leaves.

The feedback relay is off by default. You can turn it on during rift onboard. When it’s on, only your explicit rift feedback notes — plus optional non-content health metadata, never conversation content, paths, or secrets — flow to Clem. Audit every byte ever sent with rift feedback --history.

• —Telemetry to Rift — no install pings, no usage counters, no retention metrics, no crash reports beyond what you paste into a feedback note.
• —No analytics endpoint for your content — no anonymized snippets, no embeddings, no search logs sent to Rift or any analytics service.
• —No spend back-channels — Voyage cost is observed on Clem's dashboard against your project; Rift never phones home with numbers.

This is distinct from the Voyage and Codex calls above: those carry content to your Voyage project and your Codex CLI to make search and triage work — never to a Rift-owned channel.

rift uninstall stops the daemon, removes the launchd job, and reverses the MCP entries from every connected tool. Add --purge-data to erase every byte of local data too. Your Voyage key is left in ~/.rift.env until you remove it — the terminal prints the exact command, and Clem can revoke it server-side.