QorvynNothing leaves your machine unless you share it
Qorvyn is local-first. On its own it sends only a weekly anonymous usage count, which you can turn off. With a team server, only what someone chooses to share is sent, signed by their device.
What can be sent to a team server
| What | When | Exactly what |
|---|---|---|
| An agent | Someone presses Share | Its definition: name, instructions, requested permissions, provider |
| A workflow | Someone presses Share | Its steps, the agents they use, their task text |
| A note | Someone presses Share on it | That note: title, text, tags, its file:line reference |
| Run status | Only when turned on for a run | Workflow name, run and step statuses. No outputs, code or diffs |
| Sign-in | When connecting a device | Your email or identity-provider identity and a device public key |
| Project link | When linking a repository | The repository's remote URLs, so teammates' clones match |
What never leaves your machine
- Source code, the search index, file contents, diffs and commits
- Run outputs, agent conversations and review results
- API keys and tokens (kept write-only in your OS keychain)
- Private notes you did not share, and your local settings
Coding agents and their providers
When you run an agent on Claude Code, Codex or another provider, that provider receives the prompt and the context Qorvyn gives it, under the provider's own terms. Qorvyn chooses what goes into the prompt: cited snippets, never sensitive files such as .env, keys or credentials.
Security
- Signed changes: every shared change is signed with the device's Ed25519 key and checked by the server.
- One order for everyone: the server orders changes per workspace; edits to the same item become visible conflicts, never silent overwrites.
- Agents in isolation: agents work in their own worktrees and commit to their own branches. A run that touches a sensitive or protected path is discarded.
- Approvals: writing, running commands or tests, network access, pushing, secrets and deploys always need a person's approval for each run.
- Removal is immediate: removed members and revoked devices are cut off at once.
Telemetry
Anonymous and opt-out. At most once a week Qorvyn sends counts of which commands and dashboard pages were used, provider kinds, how runs ended and error categories, with its version, OS and a random install id. Never code, file or repository names, prompts, outputs or emails, and no IP addresses are stored. A one-time notice tells you; qorvyn telemetry show prints the exact report; turn it off with qorvyn telemetry off, DO_NOT_TRACK=1 or your organization's policy. It is always off in CI. Every field.
Data governance
What the app, the team server and the statistics keep, where, for how long, who can see it, how it is protected and how to exercise your rights: Data governance.
Contact
Questions or security reports: factnsoftware.com.