Privacy Policy

The short version

Suvadu stores shell history, captured AI-agent sessions, and skills locally on your machine. Suvadu itself does not upload them: there is no account system, no telemetry, and no cloud sync. A connected AI client can retrieve that data through Suvadu's local MCP server and may send it to its model provider under that client's own settings.

What Suvadu stores

Suvadu records the following data locally, mostly in a SQLite database (history.db):

• Commands — the full command line, including its arguments. Arguments can contain file names, hostnames, or secrets; see Secrets protection below.
• Working directory, start and end timestamps, duration, and exit code of each command
• Executor type and name (terminal, IDE, AI agent, CI, script)
• Shell sessions: session ID, hostname, and creation time
• Your tags, notes, bookmarks, and aliases
• Agent prompts captured by supported hooks, attached to the commands they triggered (the latest captured prompt for each agent session is also cached as a small file in a prompts folder in the data directory)
• Native agent sessions imported from Codex, Claude Code, and OpenCode: your prompts, the assistant's responses, model names, and token usage reported by the provider, plus the working directory and import checkpoints. Redaction and length limits apply during import; private reasoning text and unrestricted tool output are not collected.
• Saved session summaries — text written by a connected AI agent, with the agent and model it declared and the IDs of the evidence it cited (only if you enable summary saving)
• Shared skills, their metadata, and pending or archived skill proposals from agents
• Backups — copies of the database made by suv backup and automatically before destructive deletes, stored in a backups folder in the data directory

Files you create with suv export, and native agent files written by suv skills sync, are written where you or the agent's configuration specify, as plain text.

Where data is stored

• macOS: ~/Library/Application Support/tech.appachi.suvadu/ (database, backups, and config.toml)
• Linux: ~/.local/share/suvadu/ for the database and backups, and ~/.config/suvadu/config.toml for configuration (or the $XDG_DATA_HOME / $XDG_CONFIG_HOME equivalents)

The data directory is restricted to its owner (0700), and the database file and backups to owner read/write (0600).

Secrets protection

Suvadu automatically detects and redacts sensitive values (API keys, tokens, passwords) before writing commands, captured prompts, and imported agent-session text to the database. Redaction applies known patterns before storage and can miss unrecognized secrets, so avoid putting secrets directly in command lines or prompts. Skill bodies are stored as provided; do not include credentials in shared instructions.

No network access

The Suvadu CLI does not make any network requests during normal operation. The only exception is the suv update command, which contacts downloads.appachi.tech to check for new versions. This is opt-in and only runs when you explicitly invoke it.

MCP server

The MCP (Model Context Protocol) server runs locally and communicates over stdio with AI agents on the same machine. It opens no network ports. Enabled tools and resources return data — commands, prompts, assistant responses, session details, summaries, and skills — to the connected client. That client controls how the data is used and may send it to its model provider under its own settings. Suvadu does not call a model provider itself.

The default tools only read. Two optional write tools are off by default and appear only if you enable them in config.toml: save_session_summary stores a summary the agent wrote, and propose_skill stores a skill proposal that stays pending until you approve it.

Skills sync

suv skills sync writes active instructions into agent configuration files for Claude Code, Cursor, and Codex. Those agents can read the generated files according to their own settings. Removing a skill from the database does not always remove previously generated content; see the skills reference for paths and cleanup behavior.

This website

This website (suvadu.sh) is a static site hosted on Cloudflare Pages. It makes one API call to GitHub to fetch the repository star count.

We use consent-first analytics (Google Analytics 4) to understand which pages are useful and how visitors find the site. Analytics are disabled by default and only activated if you explicitly accept the cookie banner. If you decline, no analytics cookies are set and no data is collected. You can clear your preference at any time by deleting the suvadu_analytics_consent key from your browser's localStorage.

Deleting your data

To remove all Suvadu data, delete the data and configuration directories listed above, plus any exports you created. Uninstalling the binary does not remove your history database. To remove a single captured agent session, use suv agent delete-session; this does not delete the agent's own transcript files.

Contact

Questions? Open an issue on GitHub.