Data and Permissions
Scope
This page describes only the data locations and transmission boundaries that can be verified in the current desktop application. It does not cover future website, download-CDN, support-system, or third-party distributor logs. Because no legal operator, launch regions, or privacy contact have been established, this page is not a Privacy Notice and does not promise request-handling times or compliance in a particular jurisdiction. See Distribution and Legal Status for the current release status.
Data stored locally
Captain Who uses the data directory assigned to the application by the operating system. It currently contains primarily:
- projects, conversations, messages, drafts, archives, and search indexes;
- Agent Runs, Tool traces, approvals, context summaries, and usage estimates;
- Automation tasks, Runs, attention state, and notification-delivery state;
- model, search, Skill, MCP, and interface settings;
- attachments, installed Skills, generated images, and managed browser data;
- some credentials or opaque references to credentials.
Model Tokens, the Tavily Key, image-generation credentials, and some sensitive recovery data are separated from SQLite configuration. Signed macOS releases use independent system-keychain namespaces, and SQLite retains only opaque references; unsigned development builds use a private development credential store beside the data root. If the backend is unavailable, the related capability fails safely rather than falling back to plaintext storage in SQLite. Settings reads return only configured, missing, or unavailable state and do not return stored credentials to the interface. Do not treat the entire application data directory as an ordinary diagnostic attachment.
Data that may be sent to third parties
| Feature | Recipient | Content that may be sent |
|---|---|---|
| Model conversations | The model Provider you configure | Current task instructions, necessary history, file contents read for the task, Tool definitions, and projections of results |
| Online search and web reading | Tavily | Search queries or target URLs, plus request information required by the service |
| Image generation | The configured image Provider | Prompt, generation parameters, and optional reference images |
| Manual/automated browsing | Websites you visit | Standard web requests, form input, uploads, Cookies, and site storage |
| External MCP | An MCP Server you install and enable | Tool names, invocation parameters, and data required for execution; the Server may continue to access other services |
| Skill installation | GitHub or an authorized local source | Repository/file requests required to obtain the selected Skill package |
The current desktop application implementation in this repository has no built-in product telemetry or automatic crash-reporting path. This does not affect the third-party services you choose to connect above. The current desktop application also requires no first-party account and provides no first-party cloud conversation sync. A future formal Privacy Notice must describe the website, distribution infrastructure, and user-selected third-party services separately.
Three task-permission modes
Default permissions
Primarily permits reading and writing inside the workspace. Commands, patches, and similar operations require approval, and commands run in protected mode. Suitable for everyday tasks.
Full permissions
Permits broader file reading and writing and can automatically approve commands and patches; commands use full-access mode. Enable it only briefly when you trust the task, project, and input sources.
Custom permissions
Lets you configure read, write, command, and patch behavior separately. Commands remain in protected mode. Custom permissions do not constitute an operating-system sandbox.
You can enable Full or Custom permissions and adjust their details under “Settings → General.” Each task must still select the mode it will actually use.
Automation permissions
When an Automation is saved, the current permissions are frozen into the task configuration and each Run. Turning off Full/Custom mode later blocks corresponding new Runs, but changing individual Custom settings does not automatically narrow previously saved tasks. To reduce permissions, edit each affected task or turn off the entire permission mode to prevent future launches.
Pausing an Automation affects only future scheduling; it does not stop an active Run. When background work requires approval, the user must still decide on the specific action.
Deletion and cleanup
- Deleting a conversation removes its in-app messages and related records.
- Removing a project deletes that project's local conversations and attachment records from Captain Who, but does not modify files in the project directory.
- “Clear Browsing Data” clears the browser session and site-icon cache managed by the application.
- Automation deletion uses tombstone records to preserve history consistency; there is currently no complete user-facing history-retention and cleanup policy.
- There is currently no “delete all local data” action or formal data-export wizard.
Deletion cannot recall data already sent to a Provider, MCP Server, website, or other third party. The relevant third party determines its retention rules.
Retention, backups, and legacy data
- There is currently no unified retention period or automatic-cleanup commitment for all local records.
- Backing up only
storage.sqlitedoes not include attachments, installed Skills, images, managed browser data, or system credentials. - Development credential stores, application data directories, and legacy database backups must all be treated as sensitive. Databases from versions before credential migration, or snapshots taken before the v20 upgrade, may still contain historical plaintext credentials.
- Local deletion of a conversation or project does not replace any separate deletion request that may be required from a third-party Provider, MCP Server, or website.