AnxCorTexHQ

TRUST

Privacy

AnxCorTex HQ is local-first. It runs a local backend on 127.0.0.1, stores its data on this machine, and has no account system. Data leaves the machine only when you configure and enable a cloud provider.

Verified against v0.9.8-rc.1 source and the packaged build · 2026-09-25

Summary

  • Application data is stored on this machine.
  • There is no AnxCorTex-operated server.
  • There is no account system, and no sign-in.
  • No telemetry or analytics SDK ships with the application.
  • Cloud inference is off by default, and the default routing policy is local-only.
  • API keys are protected by OS-level storage and are never shown to the interface.

What stays on this machine

The packaged application keeps its state in one folder under %APPDATA%. These are the exact locations:

Application database
%APPDATA%\anxcortex-hq\anxcortex.db
Recovery snapshots
%APPDATA%\anxcortex-hq\recovery\
Mission Git workspaces
%APPDATA%\anxcortex-hq\mission-workspaces\
Integration workspaces
%APPDATA%\anxcortex-hq\integration-workspaces\
Window state and zoom preference
Stored in the same application folder, %APPDATA%\anxcortex-hq.
Plugins
%APPDATA%\anxcortex-hq\plugins\
Credentials
%APPDATA%\anxcortex-hq\credentials\

The database holds mission records and executions, change sets, validation plans and runs, conversations, Git baselines, reintegration records, the provider request ledger, memories, War Room messages, timeline events, and settings.

Uninstalling the application does not delete this folder. %APPDATA%\anxcortex-hq remains on this machine until it is removed manually.

Cloud providers (opt-in)

HQ ships adapters for two cloud providers only: OpenAI (https://api.openai.com/v1) and OpenRouter (https://openrouter.ai/api/v1).

Nothing is sent to a cloud provider unless all three conditions hold:

  1. An API key for that provider is stored.
  2. The provider is enabled in Settings.
  3. The routing policy allows cloud use and the route selects a cloud model. The default policy is local-only, under which cloud models are never auto-routed and explicit cloud requests are rejected before any content is sent.

Background provider catalog refresh is also gated on the provider being configured and enabled.

What is transmitted

When a cloud request is made, HQ transmits:

  • the assembled prompt — system instructions plus the task or conversation prompt and any bounded mission, context, or code excerpts the planner includes;
  • the selected model id;
  • output limits;
  • request options such as temperature and streaming.

The API key is sent as an Authorization: Bearer header. OpenRouter requests additionally send an X-Title: AnxCorTex HQ header. HQ sends nothing else, and the local database is never uploaded.

When a cloud provider is used, prompts and context can leave this machine, and the provider processes them under its own terms of service and privacy policy. Provider billing applies.

Credential protection

  • HQ prefers Electron safeStorage, which protects keys at the OS level (DPAPI on Windows) and ties them to the user account.
  • Where OS-level storage is unavailable, a fallback file vault encrypts keys with AES-256-GCM under a random 32-byte key held in a separate, restrictively permissioned key file.
  • Keys never reach the interface or the database. The interface receives only a masked hint and boolean configuration state.
  • Secret material is redacted from provider error text before it is stored or displayed.

Local AI and voice

  • Local inference runs through Ollama and llama.cpp, and local runtimes are addressed on 127.0.0.1.
  • Speech is transcribed locally by the bundled whisper.cpp runtime and is never sent to a cloud service.
  • Recording .wav files and transcript .txt files are deleted after every transcription attempt, including failures.
  • Speech-synthesis output is deleted on completion, error, or cancellation.

No telemetry or analytics

No analytics or telemetry SDK ships with the application, and no analytics service endpoints exist in the build.

The only outbound destinations in application code are the OpenAI and OpenRouter endpoints you configure, and local runtimes on 127.0.0.1.

The word telemetry in HQ refers to local diagnostics only: startup timing marks and routing and latency accounting, persisted as local records.

Logs and evidence

Execution output kept as evidence passes through redactors that cover:

  • authorization headers;
  • common token formats;
  • api_key, access_token, password, and secret assignments;
  • PEM private keys.

Cloud HTTP diagnostics record the provider, method, final URL, status, and content type only. They never record the API key, and they never record request or response bodies.

Your controls

You can, at any time:

  • set the routing policy to local-only;
  • disable a provider;
  • remove a stored key;
  • delete %APPDATA%\anxcortex-hq to remove local data — this also removes mission history and workspaces.

Removing the folder is irreversible, and it should be done with the application closed.

Limits of this disclosure

This disclosure describes v0.9.8-rc.1 only and is verified against that build. It is not a guarantee about providers you choose to enable, and it will be revised when behavior changes.