How Enigma handles your data.
Today, Enigma's bring-your-own-provider mode requires no Enigma account and does not route model requests through an Enigma backend. Enigma-managed AI is coming soon and will use a different service path for account, billing and usage-limit functions. Enigma does not intend to store your prompt content, selected files or model responses in its cloud.
The application
We do not collect application telemetry. Enigma Desktop does not send crash reports, file contents, prompts or product-usage analytics to us or to anyone on our behalf. The upcoming managed service will necessarily process account, billing and usage-meter records as described below.
Version check. Once every 24 hours the app requests https://enigma.studiocoder.com/latest.json to learn whether a newer release exists. Like any web request, that reveals your IP address and a user-agent string of the form enigma/0.1.0 to our web server. We do not store or analyse those requests beyond ordinary web-server logs.
Bring-your-own-provider mode. When you use an agent with a provider you configured, Enigma sends your prompt and the files the agent chooses to read directly from your machine to that provider using your own account or credential. That traffic does not pass through a server we operate. The provider's privacy terms govern its processing and retention.
External agents. Agents you host through the Agent Client Protocol (Claude Code, Codex CLI, Gemini CLI and others) are separate programs with their own network behaviour and their own privacy terms. Enigma launches and talks to them locally; it does not alter what they send.
API keys. Credentials for providers you connect are stored in ~/.enigma/providers.json on your machine, readable only by your user account. They are never transmitted to us and are not compiled into the application. Enigma-managed AI will not require you to supply a separate provider API key.
Local files. Threads, settings and agent memory are stored under ~/.enigma and ~/.config/enigma. Deleting those folders removes everything Enigma has kept.
Enigma-managed AI — coming soon
Request content. Enigma does not intend to retain prompt content, selected file contents or model responses in its cloud. Your local conversation history will remain on your device. Requests will be transmitted to the selected AI provider for processing and may pass through limited service infrastructure needed to authenticate the request, select a model, route traffic and enforce weekly or monthly usage limits.
Provider processing. AI providers necessarily receive the request content needed to generate a response. Their processing, security and retention obligations will be governed by our commercial and data-protection arrangements with them. Before managed AI launches, we will publish the providers or provider categories involved, relevant subprocessors, processing locations where known, retention terms and any available deletion controls.
Accounts and usage records. We expect to process the minimum account identifiers, plan status, model selection, token or cost measurements, weekly and monthly allowance balances, and security or fraud signals needed to operate the service. These records will not include local thread content. Exact retention periods will be published before launch.
Billing. Stripe will process checkout and payment information. We expect to receive customer and subscription identifiers, payment status, billing contact details and limited transaction information, but not full card numbers. Stripe processes payment data under its own privacy policy. Payment, tax, fraud-prevention and accounting records may need to be retained after cancellation where required by law or legitimate business needs.
Local deletion. Because thread history is stored locally, you can remove it from your device. Deleting local history cannot delete information an AI provider independently retains. Provider-specific retention and deletion options will be disclosed before managed AI launches; we will not promise provider-side deletion unless our provider arrangements actually support it.
This website
enigma.studiocoder.com sets no cookies and runs no third-party analytics. Web fonts are loaded from Google Fonts, which receives your IP address when they are fetched; you can block that with any content blocker and the site remains fully usable.
If you use a notification or managed-AI waitlist form, we keep the email address and topics you submitted for the sole purpose of sending the notifications you asked for. Every message includes a way to be removed, and asking us directly at the address below works too.
Your rights
You may ask us to access, correct or delete personal data we control, subject to identity verification and any records we must retain by law. You can delete local Enigma threads and settings from your own device. Requests concerning data held independently by a provider may need to be directed to that provider. Contact enigma@studiocoder.com.
Changes
We will update this policy before Enigma-managed AI becomes available, including the final data path, provider disclosures, processing locations and retention periods. Material changes will be dated here and identified in the release notes for the version that introduces them.