Where does my data go?

Diagnostics

Off by default. Switched on, Innesta records sanitised technical events and keeps them on your Mac. In the current version there is no automatic transmission to Innesta or to anyone else.

What is never recorded, whatever the setting, in the app’s own words: repository names, paths, remote URLs, file contents, diffs, commit messages, hashes, credentials, or email addresses.

The search index

The full-text index lives in .git/innesta, inside the repository. It is a cache, it is deletable, and it holds nothing that is not already in the repository.

Spotlight

Innesta gives macOS a named index of the newest commits and of all branches, so that a commit can be found from Spotlight. It is on to begin with, and Show projects in Spotlight in General settings turns it off. Navigation from a result goes through opaque catalogue-backed identifiers and exact local or remote refs rather than through paths.

Deletion is explicit. Remove from Projects deletes that repository’s entries; switching the setting off deletes every entry Innesta has made, and stops the recovery extension — which otherwise rebuilds the index when it and the repository disagree — until the setting is on again.

Credentials

In the macOS Keychain: HTTPS tokens, SSH passphrases, and OAuth access and refresh tokens. Not in a preferences file, not in the repository.

An SSH host key is not in there. When you trust one, OpenSSH writes it to the known_hosts file your configuration names; the approval itself is never stored, and lasts only for the operation it let through.

Commit message AI

This is the one that leaves the machine, and only if you make it.

Apple Intelligence runs on your Mac. Nothing is sent anywhere.

Claude Code or OpenAI Codex are CLIs you installed and authenticated yourself. Innesta runs one locally, with your explicit consent, and passes it the staged diff; what that provider does with it is governed by your relationship with them. Innesta can forward the OpenAI and Anthropic authentication variables from your environment, from an allowlist, and only when you switch it on.

Requests have a timeout, the output is sanitised, and the diff is passed with prompt-injection mitigations.

The Privacy Manifest

Innesta ships Apple’s Privacy Manifest in the bundle, which declares this in the form Apple’s tooling reads.