Rootline is local-first and has no usage telemetry.
| Data | Local desktop | Hosted API | Product telemetry |
|---|---|---|---|
| Saved profile name and absolute source/target paths | Yes | Only after sign-in and explicit consent | Never |
| Profile exclusions and timestamps | Yes | Only with the saved profile | Never |
| Directory tree, file names, or file contents | Used transiently for local scans | Never | Never |
| Run history and selected plan | Yes | Never | Never |
| Device ID, cursor, epoch, mutation receipts | Yes | Protocol-scoped values only | Never |
| OIDC tokens/protocol state | Native encrypted vault | Token verified in memory | Never |
The CLI has no cloud profile feature and sends no product data. The desktop works without an account. Hosted sync is a convenience for complete saved profile documents, not a backup of filesystem content.
Profiles made before sign-in are not silently claimed. The user chooses whether to upload existing profiles or keep them local. Account switching clears the previous subject's cursor and queued mutations. Keeping local data on sign-out does not make it eligible for a later account automatically.
Because profiles contain absolute paths, they can reveal usernames, drive layouts, organization names, or project names. Use hosted sync only when that disclosure is appropriate. The API derives tenant ownership from the verified OIDC subject and never accepts a tenant selector from the client.
Local profiles remain until the user deletes them or chooses local-profile removal during sign-out/account removal. Deleting local profiles does not delete the capped run history; run history remains local and ages out only through its bounded-history policy. Hosted mutation receipts are physically retained for 90 days. Expired receipt rows are eligible for cleanup after 90 days and are purged opportunistically on a later sync. A compact content-bound deduplication record remains for the lifetime of the account epoch so replaying an expired receipt cannot create another revision. Deleting hosted account data removes profiles, tombstones, changes, receipts, and that deduplication record, then rotates the epoch so a stale device cannot silently restore them.
Production logs are metadata-only. Operators must not log bearer tokens, request bodies, profile fields, or absolute paths. Backups containing hosted profiles must be encrypted and governed by the deployment's retention policy.
- Security policy - Vulnerability handling and enforcement boundaries.
- Architecture - Local/native/API ownership.
- Hosted profile sync - Account deletion and reset protocol.
- Release process - Distribution gates that preserve these boundaries.