Privacy notice

Last updated October 25, 2026

Cockpit Context is self-hosted software. This notice describes what this Cockpit Context server stores, why, and which outside services receive any of it. The person or organization that runs this server (the operator) is responsible for that data.

Who runs this server

This Cockpit Context server is run by its operator, not by the Cockpit Context project. The operator decides who may sign up, which AI model answers questions, and whether email and backups are set up.

What this server stores

Everything below is kept in this server’s database or on its data disk, and is used only to run Cockpit Context.

Account: Your name, email address, role and preferred language. Your password is stored only as a salted hash.
Two-factor authentication: If you turn it on, the authenticator secret and your backup codes, both stored encrypted.
Sign-in sessions: A session token, the IP address and browser (user agent) you signed in from, and when the session expires.
SSH keys: SSH keys you choose to save are encrypted at rest with the server’s encryption key; public keys and fingerprints are not. A key used once is held only for that operation, with a private temporary file removed afterwards. Passphrases are used in memory and never stored. Snapshot repository copies remain until you delete them; keep your key to restore or update them.
Known hosts: The host names, ports and SSH host-key fingerprints you confirm.
Agent connections: API tokens are stored only as a keyed hash, and OAuth access and refresh tokens only as hashes. Each connection keeps its name, its settings and when it was last used.
Packages and proposals: The dependencies in your list (identifier, git URL, version settings and your notes) and the packages your coding agents propose, with the reason they gave.
Conversations: The questions you or your coding agents ask, which can include code or details about your project; your steering and follow-up messages; every step the investigation agent takes, including the source code it reads; the answers; and the tokens and cost each run used.
Repository copies: Clones and checkouts of the git repositories your packages point to, with an AI-written overview of each checked-out version. Clones of public repositories and their AI-written overviews are shared on disk by every user of this server; private clones belong to one user. If you edit an overview, your edited version is stored for you alone: only you see it and only your investigations use it.
Background jobs and logs: Records of clone, fetch, checkout, overview and cleanup jobs, and a server log line per request with its method, path, status and duration. The log leaves out IP addresses, query strings and request bodies.
In your browser: The cookies that keep you signed in, and local settings such as theme, language and sidebar state. The section “Cookies and browser storage” lists each one.

Who else receives data

This server sends data to outside services only to do what you or your coding agents ask:

OpenRouter and the AI model provider: When an investigation or an overview runs, the question, the conversation so far, your notes on the package, your edited overview if you wrote one, and the source code the agent reads are sent to OpenRouter, which passes them to the provider of the model the operator chose. Your name and email address are not sent. Their own terms and privacy policies decide how long they keep it.
Git hosts: The server clones and fetches each package’s git URL (for example on GitHub), using your SSH key for private repositories. Checking a host key connects to the host you enter.
Package registries: Looking up a git URL or a version sends the package name, and sometimes the version, to npm, PyPI, crates.io or the Go module proxy.
Agent apps: When a coding agent connects with OAuth and identifies itself with a web address, the server fetches that address to read the app’s name.
Email provider (if set up): If the operator set up email, their email provider receives your address and the message: account verification, password reset, sign-in codes, invitations and, for administrators, operational alerts.
Backup storage (if set up): If the operator turned on backups, copies of the database, which contain everything above, are stored in the operator’s S3-compatible storage.
Hosting provider: The server and its database run on infrastructure the operator chooses.

Nothing is sold, and Cockpit Context includes no analytics, advertising or tracking services.

Who can see your data

You: In the app, only you can see your packages, conversations, SSH keys, tokens and connections.
Administrators: Administrators see the list of accounts (name, email, role and status), the background jobs, and on the storage page every repository’s URL and size, with the owner’s email for private ones. They can change your role, archive your account or delete it, and send you a one-time link to choose a new password. On a server with email that link goes only to your address; without email the administrator receives it to pass on to you, so they could use it to set your password themselves. An administrator's account never receives such a link. Every such link is recorded in the server log, and using it changes your password, so you would notice. Otherwise this server gives them no way to sign in as you, set your password or change your email address, so they cannot open your packages, conversations, keys or tokens in the app.
The operator: Whoever runs the server can reach its database and data disk directly, as with any self-hosted service.

AI-generated answers

Every answer in Cockpit Context is written by an AI model reading the dependency’s source code. Answers can be wrong or incomplete, so check them against the code before relying on them. The web app labels answers as AI-generated, and the tools Cockpit Context offers coding agents say so too.

How long data is kept

Conversations
Packages, SSH keys and known hosts: Kept until you delete them.
Tokens and connections: A revoked token or connection stops working at once. Expired OAuth tokens are deleted automatically.
Sessions and one-time codes: They expire on their own, and expired ones are deleted daily.
Repository copies: Checkouts and normal clones are removed automatically, least recently used first, above the storage limit, or by an administrator. Snapshot clones are excluded from automatic cleanup and remain until you delete their package or an administrator deletes the clone. Restoring them requires your SSH key.
Your account: There is no self-service account deletion yet; ask an administrator. Deleting an account deletes its packages, keys, tokens, connections, conversations and sessions.
Backups: If the operator turned on backups, copies of the database are kept for as long as the retention the operator configured on the backup storage, then deleted by it. Until a copy expires, anything deleted in Cockpit Context after that copy was taken, such as a conversation or an account, is still in it.
Copies outside Cockpit Context: Deleting something in Cockpit Context does not delete what an outside service already received, such as OpenRouter, the model provider or a backup.

Your requests

You can see and delete most of your data yourself in the app. To ask for a copy of your data, a correction or the deletion of your account, contact the operator.

Cookies and browser storage

Cockpit Context sets only what it needs to work. All of it is first-party: it is set by this server and read only by this server or by the app in your browser. There is no analytics, advertising, session replay or other tracking, and no third-party cookies, so there is nothing optional to allow or refuse and no cookie banner.

Sign-in cookies: Set by the sign-in system when you sign in: a session cookie that keeps you signed in for up to 30 days, and a signed copy of your session that expires after one minute so the server can skip a database lookup. Both are HTTP-only (scripts cannot read them) and are removed when you sign out.
Short-lived sign-in step cookies: While a sign-in step is in progress, such as entering a two-factor code, a signed cookie remembers that step. It expires within minutes and is removed once the step is done.
Theme: Your light, dark or system theme choice, kept in your browser’s local storage (“cockpit-context-theme”). It never leaves your device.
Language: The language you picked, kept in local storage (“cockpit-context-locale”) so the next visit opens in it. When you are signed in, the same choice is also saved to your account.
Interface preferences: Whether the sidebar is collapsed, kept in local storage (“cockpit-context-ui-preferences”). It never leaves your device.
App files for offline use: The app’s own code, styles, fonts and an offline page, cached by your browser so Cockpit Context loads quickly and can show an offline screen. They contain no personal data.
Update recovery (session storage): cockpit-context:stale-build-reload-at: the time of the last automatic reload after a new version was deployed, so a broken page cannot reload in a loop. It is removed when you close the tab.

You can clear all of this at any time in your browser’s settings. Clearing the sign-in cookies signs you out; clearing the rest resets those preferences to their defaults.

Children

Cockpit Context is a tool for software developers and is not directed at children.

Changes to this notice

When what this server stores or shares changes, this page is updated along with the date at the top.