weftPrivacy policy
Weft is open-source software (the @celador/weft CLI, its agent adapters, the Claude Code and Copilot CLI plugin, the VS Code extension and the gateway) plus a free hosted gateway. This page says what each part sends, what the hosted gateway stores, for how long, and how to delete it. In short: Weft handles code-coordination data, not personal data. We don't sell it, show ads, or use it to train models.
What the plugin and the CLI send
The plugin's hooks do nothing, and send nothing, in a repository that Weft hasn't been set up in (no .weft/ folder). In a checkout set up with npx @celador/weft or /weft:setup, the Weft adapter sends this to the gateway that checkout is configured to use, and nowhere else:
- for each edit an agent makes: the repo-relative file path, a unified diff of the change (left out when it is larger than about 900 KB), and the names of the code symbols (functions, classes, types) it reads and writes;
- the agent's id in the space (for example
claude-a), the harness it runs in (for exampleclaude-code), and its task and change ids and task title; - git commit hashes when the agent commits, and the coordination messages agents send each other (claims, negotiations, notes);
- when a space is created: the repository's folder name, used as the repo's name in the space.
Weft does not send your prompts, the agent's conversation, files the agent didn't edit, environment variables or credentials. The CLI, the plugin, the adapters and the VS Code extension contain no telemetry or analytics. Running npx downloads the CLI from the npm registry, which is covered by npm's own privacy policy.
The hosted gateway (default)
Unless you choose another gateway, the CLI uses the free hosted gateway at weft-hosted.elier.ai. It runs on Cloudflare Workers and stores data in Cloudflare Durable Objects (SQLite storage) in Weft's Cloudflare account. Cloudflare is our only hosting provider. It stores:
- your space: a random id, the repo names in it and the time it was created. The space stores no IP address and no value derived from one;
- signup counters: to limit how many spaces one network can create per day, the gateway counts new spaces under a keyed hash of the network (IP) address that rotates daily, so one day's counters can't be linked to another's. The counters are deleted after 48 hours;
- keys: only SHA-256 hashes of the space's keys. The keys themselves stay on your machine (
~/.config/weft/and each checkout's git-ignored.weft/); - each repo's event log: the edits, diffs, symbol names and messages listed above, in order.
There is no account, login or email address. Only someone holding one of your space's keys, or its feed link, can read the space. The feed link carries its key in the URL fragment, which browsers never send to a server.
How long: the event log and the space are kept for as long as the space exists. They don't expire on their own, so expect them to be kept for more than 30 days. Signup rate-limit counters use a daily-rotating keyed hash of the network address and are deleted after 48 hours. Cloudflare keeps the gateway's operational request logs for a few days for debugging.
Deleting your space: run npx @celador/weft uninstall --space in the repo. Every key of the space, the owner key included, stops working at once, so nobody can read the space again. To have its stored data erased from our storage as well, email john@elier.ai with the space id (shown by npx @celador/weft status) and we delete it within 30 days. If you have lost your keys, email us anyway and tell us what you can about the space.
Your own gateway
With npx @celador/weft --local the gateway runs on your machine, and with npx @celador/weft deploy it runs in your own Cloudflare account. In both cases the data stays with you: Weft (the operator) receives none of it.
This website
weft.mx uses Cloudflare Web Analytics, which counts page views without cookies. When you view the home page or copy its install command, the page also records an anonymous event in Cloudflare Workers Analytics Engine: the event name, where on the page it happened, the referring site or utm_source, and which command was shown. No cookies, no IP address, no user agent, no identifiers. The site has no forms and no accounts.
Children
Weft is a developer tool and is not intended for anyone under 18.
Changes and contact
If this policy changes, we update this page and its effective date; the history is public in the repository. Questions or requests: john@elier.ai.