Security & Privacy
Bonsai is local-first. The shipped product is designed so your code, worktrees, terminal output, and session history remain on your machine.
What leaves your machine?
| Data | Leaves device today? | Notes |
|---|---|---|
| Source code and diffs | No, through Bonsai itself | Bonsai manages local Git worktrees and local Git actions. |
| Terminal output and session history | No | Stored locally in Bonsai's SQLite history. |
| Anthropic traffic | Yes, via Claude Code | Claude Code communicates with Anthropic as part of its normal operation. |
| Telemetry | Not implemented today | If telemetry is added later, this page should describe the exact events and opt-out behavior before launch. |
| Team/cloud sync | Not implemented today | Team features are future work, not part of the launch product. |
Local storage
- Git worktrees are created on disk inside the selected repository workflow.
- Session history is stored locally in SQLite.
- Archived sessions, terminal output, and resume metadata stay local in the current product.
Credentials
Bonsai launches Claude Code locally. The current product promise is that Bonsai does not upload your source code or session history to Bonsai servers. Before public release, the exact credential storage path and any license or update checks should be documented here from the implementation, not inferred from marketing copy.
Known limits
Local-first does not mean finished. Long-session replay, paid-plan entitlements, and several Pro features are still incomplete.
Future changes
If Bonsai later ships team sync, telemetry, or cloud-backed features, this page should be updated before those features launch so users can see exactly what changes and what remains local.