> Privacy Policy


╔═══════════════════════════════════════════════════════════════════════════════╗
║                          > PRIVACY_POLICY.MD                                  ║
║                          Last Updated: 2026-08-08                             ║
╚═══════════════════════════════════════════════════════════════════════════════╝

> Introduction

At Wukong Code, we take your privacy seriously. This Privacy Policy explains how we collect, use, and safeguard your information.

// TL;DR: You provide the model API key. Prompts go to your chosen provider; Wukong does not upload source code or local evidence.

> Model Providers

Wukong does not run or host the AI model. The CLI sends model requests, which may include relevant code context, to the API provider you configure. That provider processes the request under its own terms and privacy policy.

> Local Execution Boundary

Wukong runs approved project commands in your current workspace with the permissions of your operating-system user. It is not a complete shell sandbox. Showing the exact command and working directory lets you review what Wukong will start, but does not prove that every child process, script, or PATH-resolved program is safe. Review the command, repository scripts, and workspace trust prompt before continuing.

> Information We Collect

[ACCOUNT] Email, display name, OAuth provider ID

[DEVICE LOGIN] When you choose account login, the CLI sends its hostname, device model, exact OS version, and a stable local device UUID to identify and secure that CLI installation; these fields are not sent during ordinary local BYOK use

[OPTIONAL CLI TELEMETRY] Random installation/session identifiers, event names, CLI version, platform, architecture, UI mode, and controlled primitive event properties

[TELEMETRY ENDPOINT] Product events use only POST https://telemetry-logs.wukong.today/v1/event; the CLI removes model aliases and hashes derived from tool arguments before transport

[TELEMETRY NEVER] Prompts, source code, diffs, local evidence, file paths, model keys, or model responses

[TELEMETRY RETENTION] Failed local queue files are mode 0600, expire after seven days while telemetry is enabled, and are cleared on opt-out. A verifiable remote deletion period is not yet defined publicly, so these events are not used as 0.1.0 cohort evidence

[FEEDBACK] Only the exact text fields shown for confirmation are transmitted when you submit `/feedback`; Wukong never attaches logs, prompts, transcripts, source code, file paths, or local evidence

[FEEDBACK RETENTION] Submitted feedback is scheduled for deletion no later than 90 days after receipt by an hourly retention job

[ABUSE CONTROL] Public OAuth and feedback endpoints transiently process the request IP to create a secret-keyed, daily-rotating digest. D1 stores only that digest, a short time bucket, and an aggregate count; the hourly retention job removes those buckets within one hour under normal operation

[WEBSITE ANALYTICS] Production pages use Plausible for page-view and controlled campaign/event measurements. Cloudflare hosting and Web Analytics/RUM may process request, browser, referrer, network, and performance data under Cloudflare's service settings

// The installer does not create a device identity or send install telemetry.

> Wukong Account & Models

The optional Wukong account uses a website-confirmed Device Login. Wukong does not currently provide a hosted model or inference endpoint, so the account model catalog may be empty. In v0.1.0, the managed account path does not receive prompts, model responses, tool arguments, source code, Finish Line contracts, verification criteria, trust grants, exact commands, or local evidence.

> Data Security

TRANSPORT: HTTPS/TLS | AUTH: OAuth + signed sessions | CONTROLS: CSRF checks + rate limits

We use modern transport encryption (HTTPS/TLS), access controls, and application-level protections (security headers, CSRF checks for state-changing requests, and request rate limits).

> Data Sharing

⚠ WE DO NOT SELL YOUR DATA. EVER.

Limited sharing: service providers, legal requirements, with consent.

> Your Rights

> Access, correct, delete, or export your data

> Opt-out of marketing communications

> Contact [email protected] from your account email; we verify control of the account before export or deletion and follow the documented operator runbook

> BACK_TO_HOME