# Privacy

Read this before installing profiles, inspecting a trace, or sharing an export. The repository must never contain runtime data, credentials, OAuth/MCP configuration, keys, databases, raw-vault files, generated exports, or logs.

The private and free profiles are separate directories and have separate Pi configuration. UltraPi never reads, copies, or links another profile's `auth.json`.

Analytics JSONL is sanitized before it reaches SQLite. Raw task text and verification evidence are local-only AES-256-GCM vault data, protected by `vault.key`; HMAC identifiers use a separate `hmac.key`. Weekly exports never include the raw vault.

`/ultra-config report [YYYY-Www]` asks for explicit confirmation and atomically writes a sanitized, joinable analysis bundle. It contains structured task classification, agent/delegation lifecycle, model token/cost data, tool timing, verification, outcomes, metrics, cohorts, and provenance. Exact task text, source code, paths, tool arguments/output, provider payload, and reasoning stay out of the report. `/ultra-config export preview [YYYY-Www]` shows every line before writing the same bundle.

`/ultra-config trace <run-id> raw` and `trace ... raw-live` are local diagnostic features, not shareable telemetry. They can display raw task or tool detail in the active UI; use them only in a trusted local session and never copy their output into an issue, chat, screenshot, or commit.