Privacy

​

What stays on your machine

• Tasks, config, reports and notes live in .taskgraph/ in your project. TaskGraph uploads them only when you run a GitHub sync command.
• The usage and cost summary printed after an AI command is computed locally and not sent anywhere.
• The Claude Code plugin’s hooks run your installed taskgraph CLI, read .taskgraph/ in the project and keep the session start time in your temp folder. They turn off the update check and make no network calls.

​

What leaves your machine

• AI calls go through your own Claude Code, to Anthropic, under your Claude account and Anthropic’s privacy policy. TaskGraph sends the task text and project context the command needs: a short summary of the project (file names, a few package.json fields and README headings), and the files Claude reads in the project while it plans. loop runs Claude Code with permission prompts off, so it can read, run and send anything your Claude Code can.
• Updates: the CLI checks for and installs updates. It asks registry.npmjs.org for the latest version. When there is a newer one, it fetches release notes from raw.githubusercontent.com and installs the update from npm. Set TASKGRAPH_SKIP_AUTO_UPDATE=1 to turn this off. npm’s privacy policy applies.
• GitHub sync: taskgraph github push writes your tasks to GitHub Issues, and pull and import read issues, through your signed-in gh CLI. GitHub’s privacy statement applies here and to the release notes from raw.githubusercontent.com.
• Containers: loop --parallel --container installs TaskGraph from npm inside the container when its image doesn’t have it.
• Research: the research skill and command search and fetch web pages for the question you ask.

​

Questions