Help

Data and privacy

What runs on your computer, what is sent to LoopCode's model service, what is stored where, and the controls you have.

#What runs on your computer

The LoopCode engine runs on your machine — inside the desktop app, the CLI or the VS Code extension. It reads and writes your files, runs your commands and tools, and keeps your conversations locally. Your repository is not uploaded or indexed on a server.

#What is sent to the model service

The models are hosted. For each step of a turn, LoopCode sends the model what it needs to answer: your messages, the project's instructions and memory, and the parts of files, command output and other tool results the agent is working with. Requests go to LoopCode's model service, which forwards them to the model you chose.

So code the agent reads is sent to the model in the course of the work; code it never reads is not. Use deny rules to keep particular files out of reach:

{ "permissions": { "deny": ["Read(./.env)", "Read(./secrets/**)", "Read(./customer-data/**)"] } }

Read and edit rules constrain those tools. They do not, by themselves, isolate shell commands or third-party MCP servers. Use the sandbox and review external tool access when sensitive files are present.

How Heksync handles your account and requests is set out in the privacy policy.

#Secrets

• LoopCode masks secret-shaped values — provider API keys, GitHub and AWS tokens, private keys, bearer tokens, and literal passwords assigned in text — in your prompts and attachments and in the conversation history it saves.
• File listings and searches skip sensitive paths.
• Instruction files cannot import private files from your home folder, so a cloned repository cannot pull your credentials into the context.
• MCP server credentials can stay in environment variables (${VAR}), so shared configuration files hold no secrets.

#What is stored, and where

All of it is on your computer, in files you can read, edit and delete. See Files and folders.

#Your account

Your LoopCode account holds your sign-in, your plan, and your usage, which is metered per request so the limits work across every device. Access tokens you create can be listed and revoked at any time with loopcode token.

#Remote control

Remote control is end-to-end encrypted: the key travels only in the QR code you scan, and the relay between phone and computer carries only ciphertext. See Control from your phone.

#Controls