Privacy

The CLI

The open-source atcr binary is local-first. It has no account system and no analytics backend, and your code never leaves your machine except to the model providers whose keys you configure. It is not, however, telemetry-free — there is one telemetry surface and two opt-in uploads, and this page discloses all three honestly:

• The usage ping (on by default, opt-out). When a review or reconcile run completes, the CLI can emit an anonymous usage ping carrying exactly four allowlisted fields and nothing else: event (which command ran), lang (primary language), lines (approximate change size), and status (run outcome). No source code, file paths, repository names, reviewer or model names, finding text, or token/cost figures can be in it — a field outside the allowlist is never placed into the event. The ping is fail-open: it never blocks, delays, or changes a run. Status: wired but currently inactive — the compiled-in ingestion endpoint is empty in this build, so the ping is a no-op and nothing is transmitted until a real backend endpoint is configured. It is on by default regardless; disable it with one environment variable (ATCR_TELEMETRY=0 — note the inverse boolean: =0 turns it off) or persistently with atcr config set telemetry false.
• Cloud sync (strictly opt-in). Passing --sync-cloud uploads a pseudonymous copy of the run's scorecard — schema version, run outcome, cost/token/latency metrics, and per-reviewer rows keyed by a one-way, unsalted SHA-256 hash of the persona name, never the raw name — to a cloud dashboard over HTTPS. Pseudonymous, not anonymous: because persona names are a small, enumerable, often publicly-known set, anyone who pre-hashes a list of known persona names can match a digest back to a name. Treat that digest as a stable pseudonym, not a secret. It requires both the flag and a valid ATCR_API_KEY, authenticates with that key as a Bearer token, and is never sent in the background. A missing or rejected key exits with a dedicated authentication exit code (3) rather than failing silently. This is not telemetry and is not governed by the opt-out above: it happens only when you explicitly ask for it.
• The community prompt-quality signal (off by default). A separate, content-free aggregate — hashed persona name, model slug, and two dismissal counts — that helps tune community reviewer prompts. It carries the same persona digest as the scorecard above, so it is pseudonymous on the same terms. It sends nothing unless you explicitly opt in (ATCR_QUALITY_SIGNAL=1 or atcr config set quality_signal true), --preview shows the exact bytes before you ever do, and its endpoint is likewise wired but currently inactive.

The full schema, opt-out semantics, and hashing model are documented in the repository at docs/telemetry.md.

What stays on your machine

• Your code and diffs — never uploaded anywhere except to the model endpoints you configure. --sync-cloud uploads a pseudonymous scorecard only; it carries no code and no diff.
• Review payloads, per-agent findings, and reconciled reports, written to .atcr/ in your repository.
• Provider keys, read from your environment and config — never transmitted to atcr.dev.

Model providers

When you run a review, your diff is sent to the model providers you configured. Their handling of that data is governed by their own privacy policies, not this one. To keep everything local, configure local models (Ollama, vLLM) and no code leaves your machine.

This website

atcr.dev is a static site. The pages themselves set no tracking cookies and embed no third-party analytics. Standard server access logs may be retained transiently by the host for security and operations. The one place this site collects information you submit is the Team Edition pilot signup form on team-edition.html — described in the next section.

Pilot signup (Team Edition)

The Team Edition pilot application form on team-edition.html collects four fields:

• Work email (required) — to reply to your pilot application.
• Team size (required) — to gauge the shape of the pilot cohort.
• Tech stack (required) — to understand the languages and tools you review against.
• Pain points (optional) — a free-text note on what is slow or unreliable in your current code review flow.

Submission is handled by Netlify Forms: the form data is transmitted to Netlify's form-handling backend, where it is stored so the pilot can be reviewed and you can be followed up with. Pilot signup data is retained for the duration of the pilot program and deleted within 30 days of the pilot concluding or upon your request. A hidden honeypot field is used to filter bot submissions; the form itself adds no other tracking. The information you submit is not sold or shared with third parties for marketing. To request access to or deletion of the data you submitted, email privacy@atcr.dev. For questions not involving personal data, you may also open an issue at github.com/samestrin/atcr.

Team Edition

Team Edition is a separate, opt-in hosted service. It stores only the rosters and reconciled reports you choose to share, under a separate agreement presented at signup. It never sits between the open-source panel and your diff. The pilot signup data described above is collected on the public site to evaluate pilot applications; it is distinct from the Team Edition service data governed by that separate agreement.

Contact

Privacy questions: privacy@atcr.dev. Other questions: github.com/samestrin/atcr.