candor · privacy
Everything runs
on your machine.
candor is a static-analysis tool family. Its privacy policy is short because the honest answer is short: your code, your reports, and your policies never leave your computer.
01 What the tools do — and don’t
The candor engines (JVM, TypeScript/JavaScript, Rust, Swift), the
candor-lsp language server, the IDE plugins, and the candor-mcp agent
server all work the same way: they read source or bytecode locally, write reports into
your project’s .candor/ directory, and evaluate your checked-in policy.
They collect no telemetry, require no account, and make no network requests while
analysing. This is not just practice but contract: the candor specification (§3.3) requires
that the tools work fully offline and never phone home — and candor’s
own effect analysis runs on itself in CI to hold that boundary
(deny Net Db Exec Ipc, the spec §7, item 12 self-gate).
02 The complete list of network activity
For completeness, the only times anything candor-related touches the network:
• Installing or updating a tool — the package managers you
invoked, fetching the software itself. The candor CLI’s update
and outdated commands (and the opt-in, off-by-default update notice) reach the
public package registries only — GitHub releases, crates.io, npm —
never a server of ours, with no payload beyond a normal download request.
• This website, which uses Cloudflare’s cookieless, aggregate
analytics beacon — no personal identification, no cross-site tracking.
That’s the whole list. Analysis itself — every scan, every report, every gate verdict, every editor lens — happens on your machine, with nothing transmitted, stored, or shared by us. We could not read your code or your reports if we wanted to: no infrastructure of ours ever sees them.
03 Auditing your app’s privacy
Separate from this policy: candor can also check the privacy posture of the code you
ship. The Swift engine classifies the Apple sensor surfaces — Location, Camera, Microphone,
Contacts, Photos, Notifications — and its privacy-manifest verb verifies an iOS
app’s Info.plist usage descriptions against what the code actually
reaches: an undeclared sensor fails the check, and if part of the app was invisible to the
scan, the verdict says it’s conditional rather than pretending to be complete.
Questions: github.com/tombaldwin/candor/issues · This page describes all candor tools published by Polymorphism, current as of July 2026.
Work with the team behind candor
candor is built and run by Polymorphism — a small senior team that designs, builds and runs large systems for enterprise and government. The judgement we put into AI-code safety here is what we’d bring to your platform.