Privacy and local data

Farero hosts your workspaces and agent processes on your computer. Local hosting does not mean that model inference happens offline. The provider and tools you use determine which prompts, files, tool results, or other context are sent to external services.

Default application-state locations are:

Working checkouts normally live below ~/.farero/workspaces on macOS and Linux, and %USERPROFILE%\.farero\workspaces on Windows. Custom data directories change these defaults. Conversation history and working files are different data sets; back up what you need from both.

Coding providers receive the prompts, files and tool results their agents use. Auto routing can send the first prompt and submitted attachments to a configured routing model. Optional Questions and suggested replies sends selected recent native-chat content and pull-request status to TypeSafe AI; native-question passage selection can include saved reasoning. Browser voice sends audio, transcripts and selected tool context to OpenAI. Configured telephone access also uses Twilio. Turning off usage analytics does not disable these separately enabled features.

Open Feedback & support with the help icon in the Settings header to send a message to the Farero team. Reports are filed as private tickets in PostHog Support, hosted in the EU. Earlier reports remain in the team’s private GitHub repository until deleted. App feedback can omit an email where the form permits it; questions need a reply address. Sending feedback works even when usage analytics are turned off. Technical logs are off by default. When enabled, the form previews a summary of app version, host platform and client, view category, and up to 12 recent request categories, outcomes, status codes and timings. The summary excludes chat content, URLs, code, file paths, credentials and provider output. Your message text is sent as written. Viewing relay logs does not attach them to your report.

Enable ChatGPT connection in Farero Settings, then authorize the plugin through farero.ai and choose a computer. Read permission covers native workspaces and chats on that computer, including archived native chats. Individual query filters narrow results rather than create a separate permission boundary. Imported provider history is excluded.

Requests and results pass through the Cloudflare-hosted farero.ai relay to ChatGPT. Workspace and chat tools can return names, repository and branch information, prompt previews, recent messages, questions and selected brief evidence. Search can return excerpts of saved agent reasoning. The bounded Read chat tool excludes reasoning and tool activity. Returned content is not automatically redacted.

The plugin asks for approval of the exact destination and text before Send prompt. Farero saves the prompt and delivery receipt locally and the chosen coding agent handles the task. Turn off ChatGPT connection in Settings to stop new requests and revoke the computer’s grants when the account service is reachable. Disconnecting does not cancel accepted agent work or erase copies held by ChatGPT or the coding provider.

The app asks you to sign in with Google or GitHub before first use. The account identifies you. It does not give Farero access to your repositories or your coding providers, which keep their own sign-in.

farero.ai keeps your name, email address, avatar link and the provider’s account identifier, plus one record per installation with a hashed access token, the platform and the Farero version. The computer that runs Farero keeps the same profile and the plain installation token in account.json inside the application-state directory.

The account is linked to the installation, so every device that opens the app with the installation token sees the same account, including a phone over Tailscale. Sign out in Settings → General removes the local link and revokes the installation token at farero.ai.

Farero reports feature, model and provider usage, plus selected theme and settings snapshots, to PostHog. Reporting is on by default. Snapshots include unchanged defaults and are refreshed when you open the app, change preferences and while the app is active. During first setup, select Turn off all analytics before signing in, or turn reporting off later in Settings → General. New reports stop immediately and pending reports and retries are discarded. The switch does not recall reports already received.

Reports carry the Farero version, platform, update channel, installation identifier, and fixed choices, counts or size buckets. When Farero-owned browser code fails or its storage transaction hits an integrity failure, an error report may also carry a stable error category and standard error type; network, provider and upstream failures are excluded, and the original message and stack are never sent. Each browser or installed web app stores a random device identifier so device preferences and connected-device counts can be measured separately from people. Clearing browser storage creates a new identifier; separate browser profiles can count as separate devices. Your account links reports across installations, and email is sent only when updating that account link. No prompt text, code, file paths, branch names, repository names, workspace names or network names are sent.

farero.ai uses PostHog for page views, downloads and feedback-submission events. It stores a browser identifier in local storage and cookies, respects Do Not Track, and has session recording disabled. Its analytics are separate from the app toggle. The app also checks feature availability with an account or installation identifier, including when usage reporting is off. A development checkout sends usage analytics only when its developer configures an analytics key.

Authenticated app links and QR codes grant access. Treat them as credentials and remove them from screenshots and reports. Private Tailscale access restricts network reachability; it does not replace app authentication.

Archiving a workspace retains history and its branch. Removing the login service retains application data and worktrees. Neither action is an erasure request. Worktrees also do not isolate collaborators from files within their shared workspace.

The Privacy Policy describes recipients, retention and data-request controls. Disconnecting a service or turning reporting off stops future processing; it does not erase earlier data held by Farero or an external provider. The current app has no in-app deletion control for saved voice-call history. Use each provider’s account controls for its own copies.