The short version
StackHatch is a static, local-first application. It has no user accounts, product analytics, application database, or API for receiving your maps. Projects, messages, repository evidence, and preferences stay in your browser profile.
Data on your device
StackHatch stores workspace data in browser storage. It does not sync that data between devices. Clearing site data, resetting the browser profile, losing the device, or using private-browsing storage can remove it. Back up all maps from All maps or Settings if you need a portable copy.
Backups include your maps and app settings but exclude provider credentials and your GitHub token. Each provider's key (Anthropic, OpenAI, Google Gemini, or OpenRouter) and the optional GitHub token stay in memory for the browser session by default. If you explicitly choose to remember one, it is stored in this browser profile until you forget it, use Clear all local data, or clear site data.
A repository scan's evidence is stored with its map on the device and is included in map and device backups. Treat backups of private-repository maps as confidential.
Direct provider requests
StackHatch contacts no provider while you edit a blank map. Repository scans and AI actions go straight from your browser to the service below, only when you start them.
| When you | Your browser contacts | What it sends |
|---|---|---|
| Scan a repository | GitHub (api.github.com) | The repository reference. GitHub returns bounded evidence: repository metadata, languages, topics, the default branch and its current commit, the file tree, the README, and a small number of configuration files. Public repositories need no token. Private repositories need a fine-grained, read-only GitHub token, sent in the Authorization header on every scan. |
| Run an AI action | The AI provider you selected: Anthropic, OpenAI, Google Gemini, or OpenRouter | The selected model, this map's latest committed nodes and connections, its chat history, your custom subtype vocabulary, any requirements brief, and the bounded GitHub evidence above, including the file tree, README, and configuration files from private repositories, with your key for that provider. |
When you set a GitHub token, your browser sends it only to api.github.com. It never reaches StackHatch and is never sent to an AI provider. No AI provider key is sent to GitHub.
Entering a key is the approval for the requests your actions make; nothing is sent until you act. StackHatch does not proxy or retain that request. GitHub and the selected provider process these direct requests under their own terms and privacy policies; the provider bills usage to the account that issued the key. If you select OpenRouter, it forwards each request to the provider of the model you chose, under OpenRouter's terms.
Static hosting
The StackHatch host serves only the application's HTML, JavaScript, fonts, images, and styles. It sets no application session cookie and runs no product analytics. Like any web host, the hosting and network infrastructure may temporarily process ordinary request metadata such as an IP address, user agent, requested path, timestamp, and security events to deliver and protect the site. It has no application endpoint for project content or provider keys.
Network boundary
The published host policy permits application connections only to the StackHatch origin, GitHub's API, and the APIs of Anthropic, OpenAI, Google Gemini, and OpenRouter. Imported files, repository content, and model output are treated as untrusted text and cannot add executable assets or new network destinations.
Your controls
Settings lets you export a full backup, forget a remembered key, and clear all StackHatch data in this browser. Restore backups from All maps. Because StackHatch never receives the workspace, there is no remote account or project record for us to retrieve, correct, or delete. Self-hosted forks and third-party hosts set their own operational practices.