Fine print — Privacy

Local means verifiable, not promised.

Last updated — 5 August 2026

Turnlog binds to 127.0.0.1 only. Check for yourself while it runs:

01What Turnlog does with your data

Turnlog reads the session transcripts your coding agents already store on your computer — Claude Code’s ~/.claude/projects/ and Codex’s ~/.codex/sessions/ — and builds a local search index from them. That index lives on your machine, in your user directory. Your prompts, code, and session content never leave your device.

02What the application collects

Nothing. The Turnlog application has no accounts, no analytics, no telemetry, and no error reporting. It runs a hardened server bound to 127.0.0.1 (loopback only) with a per-launch token and Host/Origin validation, and the only request it ever sends out is the version check described in section 03 — never your session content. The MCP server (turnlog mcp) is read-only and speaks only stdio: it cannot write and it cannot reach the network. (The website is a separate matter; see section 04.)

03The one outbound request

When the app starts, Turnlog asks the public npm registry whether a newer version exists, so it can tell you an update is available. That request contains no personal data and nothing from your sessions — it is a version lookup, the same one npm itself makes.

You can switch it off. Set TURNLOG_NO_UPDATE_CHECK=1 in your environment, or "checkUpdates": false in settings.json, and Turnlog makes no outbound connections at all.

04This website

The website at turnlog.dev is a static site served by Cloudflare, and it is the one place where anything is measured. It uses Google Analytics to count visits: that loads a script from googletagmanager.com, sets analytics cookies in your browser, and sends Google your IP address along with which pages you viewed. If you would rather not be counted, any content blocker or a browser set to reject third-party cookies stops it, and nothing on the site breaks.

This applies to the website only. The Turnlog application on your machine has no analytics of any kind — the two share a name and nothing else. Fonts are self-hosted, and there are no other third-party scripts. Server logs exist only at the CDN level.

05Payments

There are none. Turnlog is free and MIT-licensed — no checkout, no accounts, no card details, no payment processor. There is nothing to bill and nothing to store.

06Contact

Questions about privacy? Open a GitHub issue.