Safety and privacy

Published 27/10/2026

What leaves your machine#

Nothing, through ADE. ADE has no network code: no analytics, no update checks, no error reporting. Usage, logs and telemetry are written to .ade/ in your project and stay there. ade telemetry export writes them as OpenTelemetry-shaped files, still on your machine, for any tool you want to read them with.

The engines are a different matter. ADE starts Claude Code and Codex to do the building and reviewing, and they send your prompts and the code they read to their providers to be processed, under your own account and its terms. Each also has its own usage telemetry, error reporting and feedback features, and its own settings to turn them off. Read their pages before you point them at code that matters to you:

• Claude Code: Data usage explains what is sent, how long it is kept and whether it is used for training on each plan. DISABLE_TELEMETRY=1, DISABLE_ERROR_REPORTING=1 or CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1 turn off the optional traffic.
• Codex: the configuration reference covers analytics.enabled and feedback.enabled, and OpenAI's terms and policies cover how your data is handled.

ADE never changes these settings for you, and never sets an exporter that sends data anywhere.

What ADE refuses#

Four classes of action are blocked in every permission mode, by hooks that run before every edit and every shell command an agent makes:

• Reading secrets. .env files, private keys and similar are never printed. Pass them by path instead.
• Destructive deletes: removing .git or ADE's records, deleting far more than one card could own, or cleaning ignored files.
• Rewriting git history, including force pushes.
• Editing protected files, which you list in ade.toml, by default ade.toml, the generated Claude Code settings and agents, AGENTS.md and .git.

Everything else adds context rather than blocking. ADE uses at most five hooks, and each one is listed in the settings ade init writes.

Permission modes#

Your own Claude Code sessions in the project start in acceptEdits mode, and bypass mode is one line away in ade.toml. Builders and reviewers in lanes run in bypass mode by default, because each lane is an isolated worktree. The hooks above run in every mode, and nothing lands without review and the tests the graph selects.

Your settings#

ade init never touches your global Claude Code settings. The committed .claude/settings.json holds permissions only, each one with its reason in ade.toml. Hooks and the status line go in the gitignored .claude/settings.local.json, because how a machine finds ade is that machine's business.

Pushing#

ADE pushes only three things to your remote: your main branch, the ade-records branch and checkpoint tags. Every push is fast-forward only. There is no force option, and lane branches never leave your machine. Credentials are git's own, so ADE never sees them. If pushing your main branch would trigger a deploy workflow, ade init notices and turns automatic pushing off, and tells you why.