Privacy policy

Effective: 2026-05-14. Subject to change between releases; see the public changelog for material updates.

Unibench is a local-first developer tool. The short version: we do not collect your data. The long version below covers every place where any byte could conceivably leave your machine and what's actually sent.

What stays local, always

  • Your manifest. unibench.toml and every file in the project folder.
  • Service logs. stdout / stderr from every service the orchestrator supervises.
  • Service data. Postgres PGDATA, Qdrant collections, MinIO buckets — everything under <project>/.unibench-data/.
  • The audit log. ~/Library/Application Support/unibench/state.db records project + service lifecycle events. Local SQLite file; no transmission.
  • BYOK secrets. API keys (anthropic_api_key, openai_api_key) live in macOS Keychain. Unibench reads them only to forward them to the chosen AI provider's endpoint.
  • The dependency graph + inspector contents. All computed locally from what the orchestrator can see.

What we send (opt-in)

Two things, and only when you explicitly opt in:

Crash telemetry (Sentry)

  • Opt-out by default. The first-run dialog shows two options; the default is "No thanks". You can flip at any time with unibench telemetry disable.
  • Activated by a build-time DSN. Even with opt-in toggled, Sentry is silent unless UNIBENCH_SENTRY_DSN was set when the daemon started. Distributions that don't ship a DSN send nothing regardless of the user's choice.
  • PII-scrubbed before transport. A before_send filter strips every Sentry event field that could carry user data:
    • never sent: user, server_name, hostname, environment, tags, extra, breadcrumbs, request data, modules, contexts other than os and runtime.
    • sent: the panic message, the Rust stack trace, os.name/os.version, runtime.name/runtime.version.
  • Verified by test. The scrub_event unit tests build a maximally-dirty event and assert every PII field is gone post-scrub. The contract holds at compile-test time.

AI agent (BYOK)

When you use the agent (the Diagnose tab or unibench ask):

  • Direct to the provider's endpoint. Anthropic, OpenAI, or local Ollama. No proxy through Unibench infrastructure.
  • Your BYOK key authenticates the call. Unibench never sees your prompts or responses; we just forward them to the API you paid for.
  • Tools are read-only. The agent can call get_manifest, get_service_status, get_service_logs, get_service_config (secrets redacted), and get_dependency_graph. It cannot modify anything in v1.
  • No agent telemetry. Thumbs feedback is captured locally only. Decision 2.40's plan to piggyback an aggregate provider + confidence + reaction signal on the opt-in Sentry pipeline is not implemented in v1 (deferred).

Support bundles

unibench support-bundle produces a zip with the redacted manifest, per-service logs, the dependency graph, the resolved mise runtimes, and the recent audit log. The file is written to disk and never auto-uploaded (decision 2.32). The bundle's README restates this. You review and choose what to share.

The bundle's manifest.toml runs every inline-secret-looking field through secrets::redact_extras before writing — the literal value gets replaced with <redacted>; @keychain:<name> placeholders pass through (they're already non-sensitive).

The bundle's os.json carries os.name, arch, family, cpu_count, and macos_version. It deliberately does not include hostname or username — a unit test asserts these keys are absent.

What about the marketing site?

unibench.app is a Next.js marketing page deployed as static HTML with no first-party analytics or trackers. The host (Vercel / Cloudflare Pages / GitHub Pages) sees HTTP request logs the way any web host does; we don't add anything on top of that.

Children

Unibench isn't designed for children. Don't use it if you're under the age your jurisdiction requires for software like this.

Questions

Open an issue at https://github.com/0xhaz/Unibench/issues. Privacy questions about Anthropic / OpenAI / Sentry should go directly to those services — we're not party to those data flows.

Changes

If we materially change what data leaves your machine — adding a new sink, lowering the redaction bar, anything — we'll:

  1. update the version + effective date at the top of this file,
  2. note it in the public changelog, and
  3. surface a re-prompt for telemetry in the GUI's first-run dialog so prior consent isn't carried forward through scope changes.