What CVC records — and what leaves your machine.
This is CVC's product consent model: what each channel records, where it lives, and the typed confirmations that gate anything leaving your machine. For the hosted platform's legal notice, see the Privacy page.
How your data moves
Four verbs, four boundaries.
- 1
Capture
Writes an interaction into the local SQLite database immediately, as the conversation happens. Content is scrubbed on the way in and is private by default. It exists nowhere in Git: a git push cannot transport it, and a clone does not receive it.
- 2
Link
The automatic post-commit hook records which commit a thought belongs to. Linking is provenance bookkeeping inside the local database; it has no effect on visibility or sharing.
- 3
Share
Records consent marks in the local database: these turns of this conversation are authorized for this exact destination. Nothing is exported and nothing touches Git. New conversations are never auto-shared; each is a deliberate decision.
- 4
Push
cvc push --manual (with its typed challenge), or a destination whose auto-push you acknowledged separately, is the only step that creates Git objects. It projects shared-but-unpublished content into refs/cvc/main and pushes that one ref. A thought never shared, or shared but never pushed, never becomes a Git object at all.
Git objects are the durable, hard-to-erase form of this data, and they are minted only at authorized publication — behind the last human gate. Everything before that point is locally deletable database state.
The consent model
Every phrase below is typed into an interactive terminal; non-interactive input is rejected, so nothing scripts its way past a gate.
Describes CVC 0.7.0.Commands and phrases match the publicCLI referenceandPrivacy.mdat the v0.7.0 tag. On 0.6.0, the Claude Code and share --push rows do not apply yet.
| Regime | Command | You type | Scope & effect |
|---|---|---|---|
| Local capture | cvc privacy acknowledge-capture | I UNDERSTAND LOCAL CAPTURE | Per repository. Gates the passive channels — the VS Code Copilot watcher and the Claude Code hooks: cvc harness install claude-code refuses without it, and every hook run refuses, visibly and without blocking the agent, if it is missing. Explicit channels (cvc run, MCP commit_thought) are not gated. |
| Sharing | cvc privacy acknowledge-sharing --remote origin | I AUTHORIZE SHARING <fingerprint> | Per destination; the fingerprint is the remote’s effective push URL. Changing the URL requires a new acknowledgement. Grants nothing by itself. |
| Auto-push | cvc privacy set-auto-push on|off --remote origin | I AUTHORIZE AUTO PUSH ON|OFF <fingerprint> | Off by default. Only with it on do a bare cvc push and the Git pre-push hook publish. With it on, cvc share --push publishes the shared snapshot without a second challenge; without it, the I PUBLISH challenge follows the I SHARE one. |
| Share a conversation | cvc share <id> --remote origin [--future] [--push] | I SHARE <id> <fingerprint> <count> <token> | An exact snapshot of one conversation for one destination; --future also shares later turns. cvc unshare (I UNSHARE …) affects unpublished turns only. |
| Publish | cvc push --manual --remote origin | I PUBLISH <fingerprint> <baseline> <count> | The only step that creates Git objects (refs/cvc/main). A bare cvc push is inert without the auto-push grant. |
| Suppress / redact | cvc delete-local <uuid> · cvc redact <uuid> --rewrite-plan … | I REDACT … · I PLAN HARD REDACTION … | Suppression, not erasure. A local delete never propagates; a redaction tombstone must be published to reach a destination. |
| Inspect | cvc privacy status --remote origin | — no confirmation | Prints capture_acknowledged, sharing_consented, auto_push, remote, and fingerprint. |
Where consent happens, per client
Command line
The commands above run in your terminal. Every acknowledgement needs an interactive TTY — scripts, IDEs, and MCP clients cannot type the phrase for you. From 0.7.0 the phrase is read from the controlling terminal itself and pending input is discarded before the prompt appears, so a pasted runbook or type-ahead cannot answer a challenge.
VS Code extension
The extension drives the same CLI challenges through a task terminal: Acknowledge Local Capture in Terminal, Share with Remote in Terminal, Refresh Privacy Status, and Check Setup. Its watcher stays off until capture is positively acknowledged.
MCP clients
commit_thought records what the client sends, privately (Attested tier). The MCP server cannot grant any consent — acknowledgement, sharing, and publishing all happen in your terminal through the CLI.
Claude Code
Native capture through Claude Code’s lifecycle hooks under the same acknowledgement: cvc harness install claude-code refuses without it, and a hook run that finds it missing refuses visibly without blocking the agent. Stop it with cvc harness uninstall claude-code. Hooks are per checkout — a worktree created by Claude Code’s own worktree option starts without them — while the database and consent state are shared across linked worktrees.
Capture fidelity
Each channel carries a tier, so you always know what a record is worth.
| Transcript | Verbatim I/O as the tool persists it (VS Code Copilot watcher; Claude Code hooks). |
|---|---|
| Attested | Agent-authored records via MCP commit_thought — what the agent chose to record. |
| Trace | Raw command I/O without structure via cvc run. |
The honest limits
- Scrubbing and .thoughtignore are defense in depth, not a guarantee that every secret is detected or removed.
- Tombstones and cvc delete-local are suppression, not erasure. Once content is published as Git objects, clones, forks, reflogs, caches, and backups may retain it.
- Consent state lives in $(git rev-parse --git-common-dir)/cvc/privacy.json — shared across a repository’s linked worktrees, and never synced to any remote.
- Transcript ingestion (Claude Code) records more than the other channels: exposed thinking as model_cot, tool-result text (size-bounded) as the next thought’s prompt, and tool arguments. .thoughtignore path: rules drop file-context items for excluded paths but do not search the tool output copied into prompt text; the built-in detectors and literal:/regex: rules cover that text. All of it stays local and private by default.
Known gaps
Current as of the released client. Stated plainly rather than papered over.
- There is no cvc privacy revoke-capture yet. To stop passive capture, uninstall the VS Code watcher, run cvc harness uninstall claude-code, or remove privacy.json by hand.
- cvc log is a flat dump without threading. Use cvc conversations to see conversations and their share state.