Privacy Policy

CC Safety Net is open-source software that runs on your computer. It collects no personal data: there is no telemetry, no analytics, no crash reporting and no account. Nothing it records is sent to the maintainer or anyone else.

This policy covers the cc-safety-net npm package and the plugins that bundle its hook for coding agent CLIs. It does not cover the ccsafetynet.com website or its documentation.

The hook checks each command or file access your coding agent attempts and decides whether to allow it. It reads only that tool call and your local policy files, decides offline, and its code makes no network requests.

When your agent CLI starts the hook through npx, as the installs for Cursor, Droid, Kimi Code and several other CLIs do, npm itself asks registry.npmjs.org for the latest version and runs its security advisory check each time the hook starts. npm's requests carry the package name and version, your IP address and npm's standard headers, never the command it checks. The Claude Code plugin runs its bundled files and does not use npx.

The hook keeps an audit log under ~/.cc-safety-net/logs, readable only by your user account. Each record holds:

• the time, the decision, and the rule that matched
• the agent, the tool name, and the command or file path
• the session ID and the working directory

Recognizable secrets, such as tokens, passwords, API keys, private keys and credentials in URLs, are replaced with <redacted> before a record is written. Redaction matches known patterns, so a secret in an unusual format can still be written.

Logs are deleted after 30 days. Change this with audit.retention_days (1 to 365) in ~/.cc-safety-net/policy.json, or delete the logs folder at any time. Your policy, rulebooks and the update-check cache live in the same ~/.cc-safety-net folder.

The cc-safety-net command line connects to the internet only in these cases:

• Version check. doctor, install, rule commands and the policy GUI ask registry.npmjs.org for the latest version. Set CC_SAFETY_NET_NO_UPDATE_CHECK=1 to turn off the check that rule commands make.
• GitHub rulebooks. When you add or sync a rulebook from GitHub, the CLI downloads it from api.github.com and raw.githubusercontent.com. Only the repository you chose is requested, and no token is sent.
• Policy GUI star button. The GUI shows the repository's star count from api.github.com. Clicking Star on GitHub stars the repository through your GitHub CLI (gh), or gives you a link to GitHub when gh isn't set up. Nothing runs with your GitHub login until you click.

Running the CLI through npx also downloads the package from npm. These services receive what any web request carries, such as your IP address, under their own privacy policies: npm and GitHub.

cc-safety-net gui serves its page only on 127.0.0.1, protected by a random per-session token, and the page loads no remote fonts, scripts or images.

The maintainer receives no data from the software, so there is nothing to sell or share. CC Safety Net is a developer tool and is not directed at children.

Changes to this policy are published on this page with a new effective date. The source code that backs every statement here is public on GitHub.

Open an issue on GitHub Issues or email J Liew at jliew@420024lab.com.