# Terms of Use **Codescry** — last updated 2026-09-04 These terms cover your use of the Codescry desktop application ("Codescry", "the Software"). The Software's source code is licensed separately under the MIT License (see [LICENSE](LICENSE)); nothing here narrows the rights that license grants you. By installing or running Codescry you accept these terms. Codescry is a local-first tool. It has no accounts, no sign-in, no telemetry, and no server component that we operate. We do not receive your code, your findings, or any usage data. See [§4](#4-data-and-network-use) for the two narrow exceptions. These terms cover the application. The codescry.app website is separate: its home page keeps a cookieless, aggregate visitor count, described in [PRIVACY.md](PRIVACY.md#the-website). The application itself stays analytics-free. --- ## 1. No warranty **The Software is provided "as is", without warranty of any kind, express or implied, including but not limited to the warranties of merchantability, fitness for a particular purpose, and noninfringement.** In no event shall the authors or copyright holders be liable for any claim, damages, or other liability, whether in an action of contract, tort, or otherwise, arising from, out of, or in connection with the Software or the use or other dealings in the Software. This mirrors the disclaimer in the MIT License and applies to the packaged application, not just the source. ## 2. Findings are advisory, not authoritative Codescry's output is generated by a statistical language model running on your machine. It is a starting point for your own judgement, not a verdict. - Findings, severities, and health scores can be **wrong, incomplete, or misleading**. A clean report is not evidence that a project is correct, secure, or production-ready. - Codescry is **not a security scanner, license-compliance tool, or audit of record**. Do not rely on it to satisfy a regulatory, contractual, or customer obligation. - Generated project ideas may resemble existing products or be encumbered by third-party rights. Verify novelty and freedom to operate yourself. - You are responsible for reviewing every change you make on the basis of a finding. ## 3. Acceptable use You agree not to use Codescry to: - Scan or analyse code, repositories, or files you do not own and are not authorised to access. Point it only at directories you have the right to read. - Violate applicable law, or the license terms of the code you scan. - Build or refine attacks against systems you do not own or lack written permission to test. Codescry surfaces weaknesses so they can be fixed, not exploited. - Circumvent the acceptable-use policy or license of the language model you have installed (see [§5](#5-third-party-models-ollama)). - Misrepresent Codescry output as a professional audit, certification, or the work of a human reviewer. Because Codescry runs entirely on your machine, we have no ability to monitor or enforce this section. It states your obligations, not our controls. ## 4. Data and network use Everything Codescry produces stays on your device: the SQLite database, scan history, and reports live in the application's local data directory. Deleting the app data directory deletes your data. We hold no copy and cannot recover it for you. **Codescry makes exactly two categories of outbound request**, both listed below and both stopped by "Go fully offline". ### 4.1 Registry version checks Made only when the Outdated-tech axis is enabled: Codescry queries public package-registry APIs to compare the dependency versions declared in your project against the latest published versions. The endpoints are: | Ecosystem | Endpoint | | --- | --- | | npm | `https://registry.npmjs.org//latest` | | PyPI | `https://pypi.org/pypi//json` | | NuGet | `https://api.nuget.org/v3-flatcontainer//index.json` | Notes on these requests: - They send **package names and nothing else** — no source code, no file contents, no file paths, no identifiers about you or your machine beyond what any HTTP client necessarily reveals (your IP address and user agent). - **Package names can themselves be sensitive.** A private or unpublished dependency name discloses that the name exists in your project. If that matters to you, leave registry checks off. - These registries are operated by third parties under their own terms of service and privacy policies. We do not control them, we make no promise about their availability or the accuracy of what they return, and your requests are subject to their rate limits and logging. - The checks are **opt-in and revocable**: turning on "Go fully offline" in Settings stops them immediately. ### 4.2 Update check Once per launch, the desktop app asks GitHub whether a newer release exists: | Purpose | Endpoint | | --- | --- | | Update check | `https://api.github.com/repos/makr07-sec/codescry/releases/latest` | Notes on this request: - It sends **no code, no project data, and no identifier about you** beyond what any HTTP client necessarily reveals (your IP address and user agent). It is a read of a public endpoint, not a report of anything about your machine. - It is **not telemetry**: nothing about your usage, projects, or findings is transmitted, and we operate no server that receives it. GitHub is a third party under its own terms and privacy policy, and it may log the request. - **Codescry never downloads or installs an update on its own.** If a newer release exists, the app shows a notice with a link that opens the release page in your browser; obtaining and installing the update is your action. - It is **revocable**: turning on "Go fully offline" in Settings stops it, as does running the app without network access. You can also trigger the check manually from Settings. With both categories off, Codescry makes no network requests at all and is fully functional offline. Codescry also talks to a local model server on `127.0.0.1:11434` (Ollama). That is loopback traffic on your own machine and never leaves it. ## 5. Third-party models (Ollama) Codescry does not include, distribute, or host a language model. It connects to a [Ollama](https://ollama.com) server that **you** install and run, using a model that **you** download. **You are solely responsible for the model you obtain and use**, including: - Choosing it, downloading it, and complying with its license and acceptable-use policy — model weights are often distributed under terms distinct from MIT, and some restrict commercial or specific-purpose use. - Any output it produces. Model output may be inaccurate, offensive, or reproduce training material; we neither generate nor review it. - The compute, storage, and network cost of running it, and any effect on your machine. - Verifying the model's provenance. Downloading weights runs third-party data through your system; obtain them from sources you trust. Ollama is a separate project under its own license and terms. We are unaffiliated with Ollama, with any model provider, and with any package registry named above; naming them is not endorsement or a claim of support. ## 6. Your responsibilities - **Keep backups.** Codescry suggests changes to your projects; you apply them. Use version control and verify diffs before committing. - **Secure your machine.** Local-first means your data's security is your device's security. - Comply with any obligation you owe to employers, clients, or license holders in respect of code you scan. ## 7. Changes to these terms These terms may change with new releases. The version that ships with your installed release governs your use of it; the current text is published at [codescry.app/terms](https://codescry.app/terms) and mirrored by this file. Continuing to use a new release after an update constitutes acceptance of that release's terms. ## 8. Interpretation If any provision here is unenforceable, the rest stands. In any conflict between these terms and the MIT License with respect to rights in the source code, the MIT License controls.