Privacy policy.

♬ The short version

ConductorScore reads your Claude Code transcripts on your own machine and uploads only counts, hashes, and categorical labels (tool names, MCP server/tool names, plugin command names, model IDs, slash-command names, plan-signal names). Your prompts, code, file contents, file paths, and tool arguments never leave your machine. Everything else on this page is the long version of that sentence.

+ What we collect

For each Claude Code session in your last 30 days, the client emits a structured record. Every field is either a number, a 16-character SHA-256 hash prefix, a boolean, or a categorical label:

• Device metadata — a random per-device identifier (a uuid4, not derived from your hostname, username, or MAC address), the client and wire-schema versions, the 30-day window length, and the timestamp the scan ran. This is the small device block on every upload; it carries no personal data
• Hashes — SHA-256 prefixes of the session ID and project root (16 hex chars, not reversible)
• Timestamps — epoch-millisecond start/end of each session
• Counts — edit ops, lines edited, files modified, tool calls, tool errors, reverts, auto-compaction events, token totals (input/output/cache, per model), AFK / HITL / idle minutes, parallelism numerators
• Per-device config counts — number of installed MCP servers, hooks, custom slash commands, and plugins, plus the line count of your global and per-project CLAUDE.md files (the file contents are not sent)
• Categorical labels — built-in tool names (e.g. Bash, Edit), MCP server and tool names in plaintext (e.g. mcp__github__create_issue), plugin command names in plaintext (e.g. my-plugin:deploy), Anthropic model IDs (e.g. claude-opus-4-7), slash-command names from your user messages (e.g. /plan), and plan-signal names (e.g. EnterPlanMode, TodoWrite>=3). These are identifiers you (or your tooling) configured — we collect the names only, never their arguments, inputs, or outputs
• Approval signatures — for the redundant-approvals signal, a privacy-safe signature for repeated tool approvals, so we can group like with like. It carries no file paths, command arguments, or secrets; the exact derivation is in WIRE_FORMAT.md
• Booleans — whether the session was planned, whether a rage-quit event was detected, whether the session crossed the significant-edit threshold
• Intervals— minute-granularity AFK interval boundaries, and the minute-granularity start/end of your longest AFK streaks (for the “longest agent run” table; seconds are dropped before sending)

The exact wire format is in our public client repo as a versioned schema document: WIRE_FORMAT.md. You can also inspect the live schema, field-by-field, at /inspector.

− What we never collect

• No transcript content — neither your messages nor Claude's responses, beyond the specific named identifiers listed above (slash-command, MCP, and plugin names)
• No code — neither the files you edit nor the diffs
• No file paths — only the SHA-256 hash of the project root
• No tool arguments or outputs — only tool names, counts, and the approval signatures described above
• No CLAUDE.md content — only the line count
• No prompts or planning text — only structural signals (which plan-signal names fired, whether a plan artifact was produced)

This is guarded by a privacy-invariant integration test that runs in CI on every push and pull request. It feeds synthetic transcripts seeded with planted secrets in every place content could leak — user prompts, file paths, tool inputs, slash-command arguments, assistant text, and inline Bash environment variables — through the real scanner, then fails the build if any planted secret appears in the upload payload. The client itself is open source, so anyone can audit what gets read locally and what gets emitted. Someone already did: Claude independently audited the client against this policy, traced every network egress path, and ran its own leak probe — confirming only counts, hashes, booleans, and categorical labels cross the wire.

⌖ How we use it

The data is used for exactly one thing: to compute your ConductorScore — a 0–100 composite across five anchored components (Leverage, Craft, Customization, Output, Efficiency). Each sub-metric maps your raw numbers to points using documented thresholds, not a peer ranking. We don't sell it. We don't share it. We don't train models on it. We don't enrich it with third-party data.

▦ Third parties

• GitHub— identity provider. There is no server-side GitHub login: identity is established by the installed client's GitHub device flow, which requests only the narrow read:user scope, uses the token to prove who you are, and never transmits any other GitHub credential (for example, a local gh CLI token) or ingests repository contents.

Encrypted in transit (TLS) and at rest. We don't use third-party analytics, ad networks, or session-replay tools. No Google Analytics, no Mixpanel, no Hotjar.

⏱ Retention

We keep your computed scores for as long as your account exists. That's deliberate: your ConductorScore is a longitudinal signal, and keeping the full score history is what lets you see your trajectory over months and years and compare against your past self.

Your underlying session records are a 30-day rolling window — each upload overwrites the prior one, so what we hold at any moment is bounded to your recent activity. We never silently expire your account. When you're ready to be done, email us (see “Your rights” below) and everything goes.

↳ Your rights

• Delete your account — email us at hello@conductorscore.com from the address tied to your GitHub account and we'll permanently remove your profile, session records, and scores.
• Inspect the wire format — the /inspector page shows every field the client is capable of sending, with descriptions and a sanitized example payload. The full schema lives in WIRE_FORMAT.md in the public client repo.
• Request your data — email us at hello@conductorscore.com and we'll send you a JSON export of everything we have about you.

@ Contact

Questions about privacy, security disclosures, or data requests: hello@conductorscore.com. We aim to respond within 3 business days.

ConductorScore is operated by Flatiron Consulting, a New Jersey limited liability company.