Declaration of Transparency

[ShalokShalom]

Hi 🙂

This looks nice, do you think you can document, if and how much data (specifically source code, and all that) is uploaded to some other people's computer, or if that all stays offline?

At least that one image shows a web browser and analytics in it, so I assume you can send the personal data to some server?

The other stuff looks more like its entirely offline, so I am a little confused.

[sonii-shivansh]

Hi @ShalokShalom 👋 Great question — transparency matters, and I should document this more clearly. Here's the full breakdown:

What stays offline (everything by default)

The entire core pipeline runs locally on your machine:

• File scanning & import parsing
• Dependency graph construction (PageRank-based)
• Git history analysis
• HTML report generation

No source code, metadata, or usage data is sent anywhere by default.

---

The one external request (just a JS library)

When you open the generated output/index.html in your browser, it loads the force-graph visualization library from: https://unpkg.com/force-graph

This is just a JavaScript library for rendering the interactive graph — similar to loading jQuery. It does not receive or transmit any of your source code. That's likely what you saw in the screenshot — the local HTML report open in a browser, which can look like an analytics dashboard but is entirely local data.

If you're in an air-gapped environment, you can replace this with a locally hosted copy of the library.

---

AI features (opt-in, disabled by default)

If you explicitly enable AI in .codecontext.json:

{
  "ai": {
    "enabled": true
  }
}

...and provide an API key, CodeContext will send snippets of your top files (up to ~3000 characters per file, selected by PageRank score) to either:

• Google Gemini (generativelanguage.googleapis.com)
• Anthropic Claude (api.anthropic.com)

The default config ships with "enabled": false, so this never happens unless you explicitly turn it on and add your own API key. Treat it the same as pasting code into ChatGPT or GitHub Copilot.

---

Summary

Feature	Data sent externally?
File scanning & graph analysis	❌ Never
Git history analysis	❌ Never
HTML report generation	❌ Never
Viewing the HTML report	Only force-graph JS lib loaded from unpkg
AI analysis (opt-in)	✅ Code snippets sent to Gemini/Claude API
Telemetry / analytics	❌ Never

---

I'll be adding a dedicated "Data & Privacy" section to the README to make all of this clear upfront. Thanks for raising this — it's exactly the kind of question an open-source tool should answer transparently! 🙏