Docs

Privacy and data

This page tells you where Pensieve keeps your data, and each time that Pensieve or your agent uses the network.

What stays on your computer

Indexing and search run on your computer. The search model always runs locally.
Pensieve keeps everything in ~/.pensieve: the index, the settings, the collected connection items and the feedback reports. To start again, remove that folder.
The backend listens on 127.0.0.1 only, port 8765 by default. Other computers cannot connect to it.
The app and the backend have no analytics and no account.
Pensieve never indexes files that look like secrets: password-manager kits, keys, .env files and credentials. The exclude_files setting lists the patterns.
Pensieve keeps its git data in ~/.pensieve/git. It does not write to your repos.

When Pensieve uses the network

When	What goes over the network	To
Install	The app download and the Python packages	GitHub Releases, the Python package index
First run, and when you switch models	Model downloads: the search model (550 MB), and the media parts if you switch them on	Hugging Face
Update checks	A request for the latest release	GitHub
Every 30 minutes	`git fetch` of the default branch of each indexed repo, to show how far your branch is behind. It does not change your working tree.	Each repo's own remote
When a thread shows PRs	`gh pr list` and `gh pr view`, if the GitHub CLI is installed, with your own login	GitHub
Connections that you switch on	Read calls to those MCP servers.	Each server
When your agent does Pensieve's pending work	The text of each job (a thread note, a summary, an insight) goes to your agent.	Your agent's model provider

Your agent

Pensieve is a tool that your agent calls. If you use a cloud agent, such as Claude Code or Codex, what the agent reads from Pensieve goes to its provider, the same as a file that it reads with grep. Pensieve sends nothing to the agent until the agent calls a tool. The Claude Code prompt hook is the exception: it adds context to each prompt in an indexed repo.

Shared threads: Pensieve saves a shared thread as a file in Downloads. It does not send it. Before you save, you see the thread and can edit it. A shared thread has no local paths, session ids, resume command, secrets or private messages (see What a shared thread keeps).
Feedback: reports from you and from agents stay in ~/.pensieve/feedback.jsonl. Settings → Feedback lists them. Send to GitHub opens an issue with the text filled in, and you read it before you post it.

Private messages

Items from direct messages, group messages and private channels are context for your own threads and agents only. A shared thread leaves them out whole. See Connections.

This website

pensieve.tools counts page views with GoatCounter, which sets no cookies. The app does not use it.

Something wrong or missing? Tell us on GitHub.