Privacy and data

Code Mower CLI v1.x is local-first. Cloud sharing is optional, dry-run first, and metadata-only by default. CodeMower.com v1.1 does not change that boundary.

What does not upload by default

source code
raw diffs
raw model transcripts
raw stdout or stderr
auth probe output
secrets or full token values

What metadata can upload

Metadata bundles can include repository slug, install id, report kinds, event counts, reviewer/lens names, verdicts, useful finding counts, false-positive counts, latency, spend, and lane-policy recommendations when the local tool has that data.

How upload stays intentional

code-mower cloud upload stays in dry-run mode unless a user passes --yes. Report text is not included unless a user explicitly passes --include-reports, and the hosted service may still discard report text depending on retention settings.

The routine code-mower cloud dogfood command follows the same safety posture: it previews metadata by default and uploads only when a user reruns it with --yes.

How Lane Intelligence uses this metadata

Lane Intelligence pairs builders and reviewers by work type using only the metadata above: reported outcomes, verdicts, and cost/latency from your own repository. Work type is a metadata field the local tool reports per pull request; when it is absent the pairing shows "unspecified" rather than guessing.

Builder evidence and reviewer evidence are never blended into one score. Each keeps its own confidence and sample size, computed per repository, and a pairing with too few samples, missing cost data, or conflicting signal shows "collect more evidence" instead of a recommendation. CodeMower.com never compares your repository's pairings against other teams; there is no cross-customer benchmark. Enabling a lane or gating merges on it stays a decision you make outside the dashboard.

Token model

CodeMower.com uses team ingest tokens. The service stores token hashes and short prefixes, not full token values. Teams can revoke tokens without rotating every local installation.

Export, deletion, and retention

Signed-in team members can export their team's uploaded metadata from the dashboard. Team owners and admins can delete uploaded team metadata; associated report summaries and benchmark events are removed by database cascade. CodeMower.com keeps uploaded metadata until a team deletes it or the operator applies a future retention job. Report text storage remains disabled by default.

The public OSS data contract lives in docs/cloud-data-contract.md.

Ready to try it? Follow the early adopter setup.