We don't collect what we don't need.

Rabbit IDE is local-first. The editor ships without analytics, crash reporting, or usage metrics. Cloud features (account, balance, auto-updates) are optional and collect only what they need to function.

1. What stays on your machine

Source code and file contents — never leave your device unless you explicitly send them to a model provider.
Project index and embeddings — stored in ~/.rabbit-ide/index/, never synced.
Chat history and agent sessions — stored locally in ~/.rabbit-ide/sessions/. We cannot access them.
API keys — stored in your operating system's native keychain (macOS Keychain, Windows Credential Manager, libsecret on Linux). Never transmitted to Rabbit servers.
Clipboard contents — never read or stored by the IDE unless you explicitly paste.

2. What we collect (with an account)

Without an account: nothing. If you create an account for cloud routing or subscriptions, we store:

Email address and password hash (bcrypt)
Account balance and subscription state
Per-request usage metadata — model name, token counts, cost — to power your usage dashboard and billing

Payment card data is handled entirely by Stripe and never touches our servers. We do not store prompts, code, or completion content.

3. What we do NOT collect

Code content, file contents, or diffs
Clipboard data
Keystroke or editing telemetry
Screen captures or screenshots
File system structure beyond what you explicitly share
Browsing or application usage outside the IDE

4. Third-party services

LLM providers (your own keys): When you configure Rabbit to call Anthropic, OpenAI, Google, or any other provider with your API key, prompts go directly from your machine to that provider over HTTPS. Rabbit has no visibility into those requests.

Rabbit Cloud proxy (optional): If you use the Rabbit Cloud proxy, requests pass through our servers to the upstream provider. We record usage metadata for billing but do not persist prompt or code content. Requests are forwarded in-memory and discarded after the response is streamed back.

5. Cookies

We use a single HttpOnly session cookie for authentication. We do not use tracking cookies, advertising pixels, or third-party analytics scripts. No cookie consent banner is needed because we only use strictly necessary cookies.

6. Data retention and deletion

Usage metadata is retained for 90 days after account deletion request.
You can delete your account and all associated data at any time from Settings → Account → Delete Account.
Local data (sessions, index, keys) is under your full control — delete the ~/.rabbit-ide/ directory to remove everything.

7. GDPR compliance

If you are located in the European Economic Area (EEA), you have the right to:

Access — request a copy of any personal data we hold about you
Rectification — correct inaccurate data
Erasure — request deletion of your data ("right to be forgotten")
Portability — receive your data in a structured, machine-readable format
Objection — object to processing based on legitimate interests
Restriction — request restricted processing under certain conditions

To exercise any of these rights, email privacy@rabbit-ide.dev. We will respond within 30 days.

8. Verification

Every release is published with a SHA256 checksum
The source is open — build it yourself with ./Deploy/rabbit.sh app
Run tcpdump on a fresh install without an account: no outbound traffic at idle

9. Changes to this policy

We may update this policy from time to time. Changes are posted on this page with an updated version number. Continued use of the Software after changes constitutes acceptance.

10. Contact

Privacy and data inquiries: privacy@rabbit-ide.dev

Security disclosures: security@rabbit.dev