Privacy Policy

Effective 2026-05-22 · Catalyst AI Research, Haifa, Israel

Hokmah is built on a simple principle: the engine answers questions about public code in public repositories. The integrations we ship — the VS Code extension, the Open VSX extension, the Chrome extension, and the GitHub Action — are thin HTTP clients to mcp.hokmah.dev. They are written so the smallest possible amount of information ever leaves the user's machine.

What the integrations do not collect

No file contents are ever read or transmitted by any Hokmah client.
No telemetry, no analytics, no crash reporting, no fingerprinting.
No identifiers (cookies, advertising IDs, device IDs, IP-based tracking).
No background network activity. Requests are only made when you explicitly trigger a command.

What is stored locally on your machine

Chrome extension: your optional PRO API key, stored in chrome.storage.sync (synced via your Chrome profile if signed in to Chrome, never sent to us). The most recent analysis result is cached in chrome.storage.local for the popup to display.
VS Code / VSCodium extension: your optional PRO API key, stored in vscode.SecretStorage (the OS keychain — macOS Keychain, Windows Credential Manager, libsecret on Linux).
GitHub Action: nothing. All inputs are passed at workflow runtime; nothing is persisted on the runner.

What is transmitted to `mcp.hokmah.dev`

The public GitHub repository URL (e.g. https://github.com/owner/name).
The branch name (e.g. main).
A short natural-language description of the change you want analyzed (you type it; we don't auto-extract it from your editor).
Your PRO API key only when invoking PRO tools (hokmah_generate_tests, hokmah_generate_code). The FREE hokmah_analyze tool sends no key.

The MCP server processes the request, traverses its graph of the indexed repository, and returns the result (risk score, affected files, etc.). The transcript of the request and response is retained on the server for up to 30 days strictly for debugging and abuse prevention, then deleted.

What is processed server-side

The Hokmah graph engine reads the public repository's commit history via the GitHub API the first time the repo is connected (via hokmah_connect_project). Only public data is fetched.
No private code is read. If your repository is private and you have not granted Hokmah access, no graph can be built and the tools return an error.
No third-party tracking, marketing, or analytics services run on hokmah.dev or mcp.hokmah.dev.

PRO accounts and payments

If you sign up for a PRO key on hokmah.dev, we store your email address and PayPal subscription identifier (Stripe is not configured at this time). Payments are processed by PayPal under their own privacy policy; we never see your card details. You can request deletion of your account and all associated data at any time by emailing [email protected] — we reply within 7 days.

Cookies

The marketing site hokmah.dev uses one strictly-necessary cookie for the dashboard session. No advertising or analytics cookies are set. The integrations described above never set cookies.

Your rights (GDPR / CCPA)

Access: request a copy of any data we hold about you.
Rectification: ask us to correct any inaccurate data.
Erasure: ask us to delete your account, PRO key, and all stored data.
Portability: receive your data in a machine-readable format.
Objection: withdraw consent for any non-essential processing.

To exercise any of these, email [email protected] from the address tied to your account. We do not require identity documents for routine deletion requests.

Children

Hokmah is a developer tool not intended for users under 13 years of age, and we do not knowingly collect data from minors.

Changes

If we ever change what data we collect, we will update this page and bump the "Effective" date above. Material changes will additionally be announced on hokmah.dev at least 14 days before they take effect.

Contact

Catalyst AI Research · Haifa, Israel · [email protected]