What stays on your machine
Rofiant Code stores sessions, settings, and authentication locally in $XDG_DATA_HOME/rofiant (or the platform equivalent) as sessions.db, settings.json, and auth.json. The app itself doesn't upload any of it anywhere. auth.json gets mode 0600 on POSIX systems.
What reaches your model provider
Rofiant Code sends conversation messages, including resumed history, attached file contents,
and tool output, to whichever endpoint AI_BASE_URL configures. With a third-party key (BYOK), it sends that key as a Bearer credential directly
to that endpoint with each request. Rofiant does not see this traffic.
Signing in with Rofiant instead
Running /login and choosing the Rofiant option routes model requests through a relay Rofiant operates, using
Rofiant's own provider credential instead of one you supply. Your conversation content still reaches
the underlying model provider, but it passes through Rofiant's server first. Sign-in itself uses
Supabase auth (email or OAuth); Rofiant Code stores only your session token, locally, in auth.json.
Local tool access
File tools and shell commands run on your machine and can read local data. Their output
becomes part of the conversation, so Rofiant Code sends it to the provider under the rules
above. Shell commands the agent runs (or that you approve) can also transmit data on their
own, independent of the app, for example a curl or git push.
This website
code.rofiant.ca does not run analytics or tracking cookies. It serves static pages and links to the install scripts and source on GitHub.
Reporting a concern
Report a security issue privately through the GitHub Security tab rather than a public issue.