Privacy and what gets indexed

The important boundary

ContextStream search is a hosted feature. Whether your editor connects through the hosted MCP URL or launches the local stdio server, eligible file contents are sent to ContextStream to build and operate the search index. The local helper validates the checkout and reads files on your machine; it is not a promise that indexed code stays on that machine.

If your policy forbids sending a repository to the service, do not index it. Use a separate project or exclude the sensitive paths before the first ingest.

The same boundary applies when an assistant is working with less supervision. Relevant context can surface automatically, but only from the authorized scope; grounding does not widen membership, override exclusions, grant execution permission, or make an external share safe without review.

What indexing excludes

The local ingest path applies all of these before upload:

• Standard, nested, and global Git ignore rules
• .git/info/exclude
• Additional patterns in .contextignore
• Known credential and editor-config directories
• Secret-looking filenames, environment files, certificates, and private keys
• Invalid UTF-8 files and individual files larger than 5 MB
• Binary and media files, unless you explicitly choose to index supported media

Absolute local checkout paths and credentials embedded in Git remote URLs are not included in the uploaded project metadata.

These protections are defense in depth, not a substitute for secret hygiene. Do not commit secrets, and review .contextignore before indexing a repository with tracked material that should remain outside ContextStream.

Review a sensitive repository before first ingest

Suppose a client repository contains ordinary source beside generated customer fixtures, exported support logs, and a folder of signed test certificates. Before indexing:

1. confirm the checkout belongs in the intended client workspace and project;
2. keep generated fixtures and support exports outside the indexed boundary with .contextignore;
3. make sure private keys, environment files, certificates, and credential directories are not tracked or relied on only as “probably filtered”;
4. decide separately whether screenshots, recordings, or PDFs should be added as media;
5. decide whether this editor may capture conversation transcripts.

Then run the initial ingest and inspect the indexed-file list. Ignore rules are easier to trust when you verify the resulting boundary instead of assuming a pattern matched.

If policy says no repository content may leave the machine, stop there and do not index it. Launching the standard-input server locally does not turn hosted search and memory into an offline product.

What the service holds

Project knowledge includes the decisions, lessons, plans, documents, tickets, and other records you or an authorized client save.

Search data is built from the eligible file contents sent during ingest. Removing a path from future sync does not rotate a secret that was already uploaded.

Transcripts and snapshots may include conversation content. Capture depends on the client and its configuration:

• Setup-generated editor configurations enable normal context and hook transcript capture unless you turn it off.
• A raw, unmanaged MCP configuration does not opt in merely by connecting.
• Your assistant may keep its own local or provider-side conversation history. ContextStream's capture switches govern ContextStream records, not another product's separate retention settings.

Controlling editor transcript capture

contextstream-mcp configure --transcripts off
contextstream-mcp configure --hook-transcripts off

The command updates configured editor files. Add --scope global, --scope project, or --scope all to choose where. --transcripts controls capture requested by normal context calls; --hook-transcripts controls supported editor-hook capture. You can disable either one independently.

If your policy forbids retaining conversation content, turn transcripts off and verify every connected client separately. An editor or assistant can retain conversation history independently of ContextStream.

Excluding more

Put ContextStream-only exclusions in .contextignore; use .gitignore when the files should be absent from both Git and indexing. Then run a fresh ingest or remove already indexed paths. Exclusions govern future reads; they do not undo disclosure of a secret, so rotate exposed credentials first.

Respond to an exposure in the right order

If a committed .env file or private key reached the index, treat the credential as exposed:

1. rotate or revoke it first;
2. remove the exact indexed path and refresh the project;
3. add the appropriate Git and ContextStream ignore rules;
4. inspect repository history and connected artifacts for the same value;
5. verify the replacement secret was not copied into a transcript, document, ticket, media asset, or capsule.

De-indexing reduces future retrieval. It does not make a credential safe again and it cannot retract a value already copied to another system or recipient.

Deleting

Documents, decisions, sessions, projects, and individual indexed paths have their own removal controls. Deleting a memory record and de-indexing source are separate operations. Deleting a workspace is the broadest operation and removes the workspace's contents.

If it doesn't work

A secret was indexed. Rotate it — that's the correct first move regardless. Then remove the indexed path and add an ignore rule. If it is tracked in Git, also treat repository history as exposed.

Indexing picked up build output. It isn't ignored. Add it to .gitignore, which fixes it for git as well.

I need a strict no-upload workflow. Do not index that checkout. Local stdio still uses the hosted search and memory service; it is not a local-only index.

Next

• Hosted or local
• Working as a team
• API access
• How the agent partnership works

Deep project learning (optional)

Deep project learning starts off and needs a separate affirmative consent. It records context use and feedback to improve guidance for your account. Setup defaults and assistants cannot grant that consent. Review or revert suggestions and forget guidance on the Learning page. Turn it off in Account → Privacy or run contextstream-mcp configure --account-learning off. Collection stops immediately; learned history and generated learning items are deleted from live systems within 30 days. Ordinary content you saved is preserved.

Learning events and activity signals have a 180-day retention window. Consent audit records document your choice. Learned data is never sold or used to train AI models. Service-managed providers for this feature have no-training terms. Your own connected provider remains governed by your agreement with it.

Learn about deep project learning.

Agent Coach Kit (coaching data)

The Agent Coach Kit stores coaching in your own account: workflows and their goal history, jobs and objectives, the drafts you were shown (text, links and media), your feedback verbatim with the agent's reading kept beside it, guidance and its history, any coaching-effort preference you state, and your verdicts. Coaching workflows are personal; only you can see them.

Coaching data is used only to coach your agents on that workflow. It is kept out of general memory, recall, deep project learning and distillation, and it is never used to train AI models. The agent you coach (ChatGPT, Codex or another client) reads it while it works on your job, under your agreement with that provider.

Signing in from a connector grants only read:coach and write:coach. An API key used with the kit has your account's usual access: create a key just for the kit and revoke it when you are done. Coaching permission is not permission to publish, share, contact anyone or spend money.

Export a workflow at any time as Markdown or JSON. Deleting a workflow hides it at once and erases it, with every job, version, feedback item and guidance item, from live systems within 30 days. Deleting your account erases all coaching data. Media links in coaching responses expire within 15 minutes.