Privacy in plain words

Your work stays on your computer. This page says exactly what can leave it, when, and how to stop it.

What never leaves

Your chats, projects, files, notes and settings are stored in a folder on your own computer.
Your AI keys are stored there too, encrypted. Cockpit never sends them to us.
Models running on your computer (Ollama and similar) never send your text anywhere.

What leaves because you asked

When you use a cloud AI (Claude, Gemini, Codex, a free cloud model), your question goes to that company with your own key, as it would from their own app. Cockpit asks for your consent before spending money and shows a live meter.
A Power Button that uses a cloud AI asks before the first run, and does not send text that looks like a password or key.
The phone remote (Everywhere) passes your messages through our relay server so your phone can reach your home computer.

What we receive without you doing anything

What	What it contains	Stop it
Page views and downloads on this site	The page, the time, a hash of your address that changes every day (we cannot reverse it), your browser's name. Counted apart from crawlers.	Block the request, or use a browser that does.
Anonymous install progress (Full edition installer)	Which step the installer reached, whether it failed and the error text with your name and folders removed, your system and distribution, your CPU, memory and graphics card model. No name, no folder, no address.	Run the installer with `COCKPIT_NO_TELEMETRY=1`.
First-run signal (Full edition)	Two fixed words: that an install made its first account. Nothing about you.	Choose the Stand-alone edition, or set `COCKPIT_NO_TELEMETRY=1`.
Your account (only if you make one)	The name, e-mail and password hash you typed, your plan, and your machines' names and last-seen times, so you can recover an account after a reinstall.	Do not make an account: the free edition works without one, and Stand-alone never asks.
Model and price updates	Cockpit downloads a signed list of models and prices and sends nothing about you. It is off until you turn it on.	Leave it off.

Other hosts this site's pages load

Two outside companies serve a small part of these pages, so your browser contacts them directly and they see your address and browser details, as any web server would:

Google Fonts (fonts.googleapis.com): every page loads the icon font from Google. Google receives your address, your browser's name and the page that asked for it. Blocking that host only makes the small icons show as words.
Cloudflare Turnstile (challenges.cloudflare.com): only the Questions and answers and the translation-sending pages, where the form needs a check that you are a person. Cloudflare receives your address and browser details while the check runs; we receive only whether it passed.

The Stand-alone edition

Stand-alone is built to make no calls to our servers on its own after the very first installer lines. At the end of the install it may ask once whether to send a single anonymous "it worked" line; saying no is final. The one other time it contacts us is when you press Check for updates in About: it then sends only its build number and edition (Stand-alone or Full), and our server keeps a count row with a hash of your address mixed with the day, which changes daily, so presses cannot be linked across days. There is no persistent ID, and nothing is sent in the background.

The details above are checked against the shipped installer and the receiving endpoints. If you find a case where Cockpit sends more than this page says, that is a bug: please tell us.