RosmarOps app: privacy policy

Last updated: 28 October 2026.

This policy covers the RosmarOps program for Windows. This website has its own policy: Privacy and cookies.

In short

RosmarOps never connects to the network. It never sends telemetry. Not anonymous, not aggregated, not opt-in. It never changes your files, settings, repositories, keys or agents. What it finds stays on your computer.

What it reads

To draw its exposure map, RosmarOps reads, on your computer:

  • the configuration of your AI coding agents. For Claude Code: its settings at every level, permission rules and modes, hooks, MCP servers, CLAUDE.md and rules, and the environment settings that choose where it sends your requests. For Cursor: ~/.cursor and each project’s .cursor: permissions, sandbox, MCP servers, hooks and rules;
  • Cline’s MCP servers, and which AI agent extensions are installed in VS Code;
  • credentials: .env files in your repositories, MCP env blocks, agent settings and common credential files (npm, AWS, GitHub CLI, git, Railway, Supabase);
  • the configuration files of the AI agents it detects, including Codex, Antigravity, Hermes Agent and Claude Desktop, and the keys kept in them (such as Codex’s auth.json and Hermes Agent’s .env files);
  • your repositories: keys in tracked files and in git history, hooks and workflows;
  • from Windows: the list of scheduled tasks and Windows Defender’s exclusions, so it can tell you when a new one appears, and whether Windows allows notifications; from VS Code, the list of installed extensions. It reads them through Windows’ own tools and never changes them.

It reads configuration at rest. It does not see what an agent does while it runs.

What it writes, and where

It writes only inside ~/.rosmarops/ and the reports folder you configure (by default ~/.rosmarops/reports/). There it keeps:

  • its configuration, config.json;
  • its state, state.json: a fingerprint of its own program and of its configuration, to check its integrity on every run; what it saw last time, to tell you what is new (including the names of scheduled tasks with a fingerprint of each, and Defender’s exclusions); and a random value that only this computer has, used to fingerprint keys;
  • in the reports folder: the reports of each run, the map of what each agent can reach, your score history and the memory of past findings.

The reports include paths on your computer and the shortened view of each key found (see below).

It never creates scheduled tasks.

What it sends

Nothing. The program contains no networking code at all: not to send data, not to check for updates, not for anything. There is no switch, because there is no code that could send anything.

Two things can leave your computer, only if you take them out yourself:

  • the «Copy for your AI» text, if you paste it into an AI in the cloud. It contains no secret values or shortened previews, and replaces your user folder with ~. It may include the id RosmarOps gives a key (cred_ and 16 characters), which cannot be turned back into the key;
  • the share card, if you publish it. It contains only the score, the band, the counts, the date and the method version.

What it keeps of your keys

It never shows a secret in full: not in the report, not in its logs, not in its state. A detected secret is shown as its first 4 characters, « … », and its last 4; one shorter than 8 characters is shown as ****. The map of what each agent can reach stores only a salted fingerprint of each key, never the value.

Windows notifications

When a scheduled review that you created finishes, Windows shows a notification with an agent’s name, its score and the counts: no repositories, services, paths or secrets in its text. Windows keeps it in its notification center with the path to the report. If a scheduled review cannot finish, or does not run, the notification says only that, with no other data.

How to delete everything

Delete the ~/.rosmarops folder. If you chose a reports folder somewhere else, delete it too. Outside these folders, Windows may keep the review’s notification in its notification center, the weekly review task if you created it (remove it with Unregister-ScheduledTask -TaskName 'RosmarOps weekly review' in PowerShell), and your browser’s history entry for the report. Uninstalling or deleting the program does not delete these folders: delete them yourself.

Who is responsible

Albert Garcia Pujadas. Contact: legal@rosmarops.com.

Changes to this policy

When this policy changes, the date at the top changes.

Cookie settings