Privacy

Scope

Reviewed on 2026-10-25 against CLI v0.5.38 and the native client source at the same version. This notice covers the website, CLI and plugins. Source review is not runtime acceptance of a future official app package; it does not promise behavior for unimplemented features.

The native client obtains personal observations and public data through its bundled CLI; it does not itself read account credentials or transcripts. desktop --json --read-only reads existing data without recording history, refreshing accounts or starting background collection. publication --json can download and update the public cache.

Local reads and storage

The CLI can read Claude Code status-line input and transcripts, Codex session logs, OpenCode and ZCode usage databases, and your ~/.config/modelplan/local.json declarations. It selects model, effort, timing, token, quota and project metadata; it does not retain conversation text or tool contents in its usage ledgers. Reading a transcript still brings file contents through process memory.

Gemini and Qwen local history each require opt-in. When enabled, they build a bounded 35-day token view from their local directories without reading their credentials or using the network. Qwen aggregate exports require a separately selected file or directory. Even read-only runs can inspect configured key environment variables in memory to match existing quota caches.

The CLI can also read Claude account/organization IDs from ~/.claude.json (or the corresponding CLAUDE_CONFIG_DIR file). Those IDs, Codex account identity or a selected key can be used for local identity matching: locally keyed hashes map identities to random subscription references, and project roots produce keyed references. Project folder labels are stored locally by default. Not every local identifier is anonymized: plugin notice state can also retain thread IDs, reset boundaries and sent-notice flags.

Network requests and third-party tools

Public recommendations download anonymously from modelplan.ai by default; MODELPLAN_BASE or --base can change the CLI destination. Downloads include the CLI version and ordinary network information, such as the IP address visible to the server, but no personal usage payload. Contract v1 separates public publication data from local personal observations in desktop. Lineage-selection flags come from the public publication and do not prove personal quota or account authorization.

The optional quota readers below require an explicit connection. Keys are used during requests; ModelPlan does not save vendor keys in its own credential files. Cursor uses the editor's existing local sign-in state.

Kiro, Copilot and the separate Codex account reader invoke their installed CLIs, which manage sign-in and network destinations. The Kiro wrapper specifies a local ACP usage request, not a fixed HTTP host; this project's source cannot establish every external runtime host or credential path. Codex account refresh is on by default in ordinary CLI use; the native read-only command does not start these refreshes.

The optional CodexBar bridge delegates reads to CodexBar, which may use its settings, other CLI sign-ins, Cursor or browser cookies. Its pinned helper downloads from GitHub Releases by default; configuration can override the download base, and redirect destinations are not fixed by this project's source. Third-party sign-in storage and requests depend on those tools' implementations and settings.

Automatic app updates are not implemented in the audited native source. A planned update service is not an existing feature, and establishes no verified update host or retention period.

Plugins and assistant context

The CLI does not upload personal usage to ModelPlan's servers or call model inference endpoints. Plugins and Skills can nevertheless return requested local results to the host assistant. In v0.5.38, automatic hooks put a task brief and selected remaining-quota/reset facts into assistant context; the host may send that context with its own model requests. This is not a promise that all personal data always stays on your computer.

MODELPLAN_TASK_BRIEF=off stops these automatic context notices. It does not stop results from tools you explicitly invoke or every user-facing hint. Disable or uninstall the plugin to stop its hooks. ModelPlan does not store this assistant context on its own servers; the host service controls how it handles its requests.

Website and hosting

The website requires no account or sign-in. Followed models/plans, language, appearance and time-zone preferences are stored in browser storage. This privacy page uses site-hosted scripts and fonts, without third-party analytics scripts. Optional visitor analytics on other pages is off unless explicitly configured at build time.

Website, public-data and helper downloads still expose ordinary request information to servers/CDNs. Source does not establish that hosting providers keep no access logs or a verified log-retention period; we make no hosting-wide promise to collect nothing or delete on a fixed deadline. Information you choose to send by email, API or assistant goes to its corresponding recipient.

Stop reads and notices

Use modelplan disconnect NAME for each optional vendor (zai, opencodego, kimi, minimax, cursor, kiro, copilot). codexbar disable [NAME] clears legacy selections only; explicit connections still need disconnect. MODELPLAN_NATIVE=off and MODELPLAN_CODEXBAR=off disable their respective backends; MODELPLAN_CODEX_ACCOUNT=off disables the separate Codex account refresh.

modelplan usage gemini disable / usage qwen disable, or MODELPLAN_GEMINI=off / MODELPLAN_QWEN=off, stop the respective local histories. To stop the Qwen export view, also unset MODELPLAN_QWEN_USAGE_EXPORT and stop using --export. MODELPLAN_HISTORY=off stops history/performance recording and Gemini/Qwen history reads; it is not a universal file/network off switch.

MODELPLAN_IDENTITY=off stops account identity reads/references. modelplan project-labels off removes stored project names; hiding names in an app is not deletion. publication --json --offline reads only the public cache. Environment variables affect only processes that inherit them. Stop app, CLI and plugin invocations to stop the remaining readers.

Retention and deletion

Quit the app and stop CLI/plugin writers first. Delete ~/Library/Caches/modelplan on macOS (or your MODELPLAN_CACHE override) to remove public cache, observation ledgers, local identity keys and helper downloads. Delete ~/.config/modelplan/ to clear this project's settings, optional-source consent and local declarations. This does not delete vendors' original histories, sign-ins or third-party storage. Re-enabling reads can reread source history that still exists.

Default pruning windows: perf.json performance/session ledger 35 days; daily-long.json daily totals 371 days; speed.json 28 days; five-hour quota cycles 28 days and pace readings 35 days; longer cycles 84 days. Size caps can remove records sooner. These are pruning rules during writes, not scheduled disk deletion or a universal lifetime for settings and caches.

Current native snapshots are held in memory; preference-file and image-cache libraries take caller-supplied directories. Audited source does not establish one storage directory for a future official build, so no guessed deletion path or promise that an app clear button deletes CLI data is given here. Clear website preferences through the browser's site-storage controls.

Operator and contact

ModelPlan is an open-source project. Maintained by guanbear, published under the GitHub organization modelplan. The CLI and generic community client are MIT licensed; official visuals have separate terms. Privacy contact: [email protected].