Privacy and security

Vistara runs on your Mac and keeps its data there. This page lists what it reads, what it never does, what leaves your Mac and when, where its files are, and the permissions it can ask for.

What Vistara reads

All of this is read on your Mac only.

Source	What	Why
Hook events	What Claude Code and Codex send to their hooks: prompts submitted, tool calls and results, approvals, questions, turn ends.	Cards, Workstate, check results.
Agent transcripts	~/.claude/projects/…, ~/.codex/sessions/…, Cursor's agent transcripts and IDE chat database.	The session list and the live conversation view.
Agent session files	~/.claude/sessions/, ~/.claude/history.jsonl, ~/.codex/history.jsonl.	Which sessions are live, and confirming a reply arrived.
Process list	Running processes (ps).	Which agents and apps are running. No content.
Git	Branch and status of the folders your agents work in. When an agent stops with changes, Relay snapshots the working tree into a temporary worktree to re-run the repo's checks.	Workstate and repo verification.

Only if you turn them on (see Permissions):

Source	What
Browser tabs	Titles and URLs of open tabs in running browsers, and, for Chromium browsers (Chrome, Brave, Arc), the last-visit time of those pages from the browser's own History file.
Warp	Warp's local database: your Warp tabs and Warp's own agent conversations.
Window titles	Titles of Warp windows, and of the window in front when you send a reply or press Esc, to type into the right one and to return focus. They are not stored.

What Vistara never does

Not in the app at all

The app contains no screen-capture, screenshot, OCR, clipboard-monitoring, microphone or trading code, and no cloud AI client. These are not switched off with a setting: they are not in the build. Its Info.plist declares no camera, microphone, Bluetooth, speech or screen-recording use, so macOS never asks for those.

• It never records your screen or your keystrokes.
• It never reads files your agents do not touch.
• It never sends code, prompts, transcripts, file names or conversations anywhere.
• It never types into another app, switches tabs or raises a window except as the direct result of your click or keypress.
• It never reads your clipboard, with one opt-in exception: with Terminal typing and focus return on, when it pastes your reply into a Warp tab it reads the clipboard first and puts the old contents back afterwards. Nothing read is stored or sent. With that feature off (the default), the clipboard is only ever written, when you click a Copy button.
• It never sends your data to a remote model. If Ollama is installed, the app may use it locally for a one-line card summary.
• It never answers a permission prompt because of a message. See Agent permissions.

What leaves your Mac

Before you turn on your node: only a daily anonymous "installed" ping to the points server: a random install id, the app version and whether your node is on. It contains nothing about you or your work, and you can turn it off in ⚙ → Your privacy.

After you turn on your node, only this is sent to the points ledger:

• At sign-in: your device key's public address and a signature over a one-time challenge, your Mac's host name (as the device name), and your email if you chose to type one.
• For each verified task or active day: the device id, a random project id, the type, the time, whether tests and build passed (two booleans), a proof hash, the rule version, and the device's signature.

The full field list is on Points and Vistara Node. Every item sent appears under Rewards on the Points page.

Your model providers still receive what your agents send them, under your agreements with them. Vistara does not change that.

Where data is stored

Location	Contents
~/.vistara-relay/	relay.db (the event log and Workstate, SQLite; it includes the prompts you send and your agents' messages and tool calls, as reported by their hooks), local-token (the local bearer token, mode 600), policy.json (your policy, if you created one), events/ (daily card, reply and handoff events), verify/ (temporary worktrees for repo checks), node-days.json (uptime and agent time per day), and small logs and caches.
~/Library/Application Support/@pouncer/shell/	config.json (settings and permission choices), work-graph.db (the search index of sessions, terminals and, if enabled, browser tabs), beta-state.json (project status and, after activation, what was sent and the last sync), beta-device.bin and beta-session.bin (the device key and sign-in session, both encrypted by the macOS Keychain). The folder name comes from the app's internal package name.
~/Library/Logs/@pouncer/shell/	pounce.log, rotated at 5 MB, three files kept.
~/.vistara/handoffs/	Handoffs you sent to a new Claude Code or Codex session.
~/vistara-demo/	The sample repo, if you clicked Try it on the welcome card.
~/.claude/settings.json, ~/.codex/hooks.json	Vistara's hook entries, with a backup of each file from before the change.

Secrets such as API keys and tokens are redacted from events before Relay stores them. The event log itself is a plain SQLite file protected by your macOS account; it is not separately encrypted. ⚙ → Your privacy → Show what's stored opens these locations in Finder.

Deleting your data

1. Remove the hooks: open the overlay and click ⚙ → Disconnect my agents. If Vistara will not open, do it by hand: restore the settings.json.vistara-backup-<timestamp> file in ~/.claude/, or delete the hook entries that point at 127.0.0.1:47321/v1/hooks/claude, and in ~/.codex/hooks.json delete the entries whose command ends in codex-hook.
2. Quit Vistara from the menu bar.
3. Remove the MCP server if you added it: claude mcp remove vistara --scope user, and delete the vistara entry from Claude Desktop's claude_desktop_config.json.
4. Delete ~/.vistara-relay/, ~/.vistara/, ~/Library/Application Support/@pouncer/shell/, ~/Library/Logs/@pouncer/shell/ and, if you tried the sample, ~/vistara-demo/.
5. Delete Vistara from Applications.

Records already sent to the points ledger are held on the server. To have them deleted, email mayur@vistara.dev.

Permissions

The core product needs no macOS permissions: hooks and local files are enough to show cards and deliver answers. Three optional features need macOS consent. All are off by default, and nothing that could trigger a macOS prompt runs until you turn the feature on.

Feature (⚙ → Permissions)	What it enables	What macOS asks for
Browser tabs in search	Find open browser tabs from ⌘⇧Space and bring one forward.	Automation, once for each browser that is open.
Warp terminals and Warp AI	Warp tabs in search, Warp's agent in the session list.	Access to data from other apps (Warp's container).
Terminal typing and focus return	Type a reply into a visible Warp tab when an agent has no hook path (it reads the clipboard only to restore it after the paste); return you to your window after Esc.	Accessibility, and Automation for System Events.

Turning a feature off stops every call that could use it. If macOS refuses, Vistara shows that it was refused rather than failing silently.

Two other settings need no macOS permission:

• Keep the Mac awake while agents work. On external power only, prevents idle sleep while an agent is mid-task. The screen can still turn off, and closing the lid still sleeps.
• Keychain. Used only once you activate your node, to encrypt the device key and session.

Agent permissions

Vistara can answer an agent's permission prompt in two ways only:

1. Your click on an approval card. The answer goes back as the hook's response.
2. Your local policy. By default it approves routine reads, edits, tests and builds inside the session's working folder, and sends everything else to you. It never auto-approves destructive or system commands, anything outside the working folder, secret files, or changes to Vistara's or the agents' settings. You can turn auto-approval off with "autoApprove": false in ~/.vistara-relay/policy.json. See The local policy.

A reply you send as text, through a Claude inbox socket, a Stop-hook reply or terminal typing, reaches the agent as a message from you. It cannot approve a permission prompt. When Vistara writes to a Claude inbox, the message says it came from you through Vistara, so the agent treats it as an answer, not as an approval.

If you do not answer a held request within 60 seconds, or press Esc, the agent shows its own prompt. Vistara can delay an agent; it cannot wedge one.

Local endpoints

Endpoint	Address	Protection
Relay	http://127.0.0.1:47321	Bound to the loopback interface. Every request except the /healthz health check needs the bearer token from ~/.vistara-relay/local-token.
MCP server	http://127.0.0.1:47322/mcp	See below.

MCP endpoint security

• It listens on 127.0.0.1 only, so other machines cannot reach it.
• Every request needs Authorization: Bearer <token>, the same local token Relay uses. Requests without it get 401.
• Requests from browser origins other than localhost or 127.0.0.1 are refused with 403. A web page cannot reach it through DNS rebinding.
• It accepts only POST to /mcp, with bodies up to 1 MB.
• Its tools are read-only. They cannot start, stop, or reply to a session.

The token is a file in your home folder. Any program running as your user can read it, as it can read your agents' transcripts. Treat it like the transcripts themselves.

Diagnostics

⚙ → Export diagnostics writes a JSON file to your Downloads folder. Nothing is sent; you choose whether to share it.

It contains:

• a health snapshot: app version, Relay health and build, hook health counts, per-source session counts and timings, work graph size, number of workstreams, points account status, wallet address and last sync;
• the last 600 lines of the app log.

Before writing, Vistara redacts API keys, tokens, bearer headers and any 64-character hex string (anything that could be a private key). Log lines can still contain project folder names and session ids. Read the file before you share it if that matters to you.