Data and Privacy
DesireCore is local-first. Agents, skills, conversations, configuration, audit records, and caches are stored on your device by default. AI inference requests are sent only to the model providers you configure.
Data Location
| OS | Path |
|---|---|
| macOS | ~/.desirecore/ |
| Windows | %USERPROFILE%\.desirecore\ |
| Linux | ~/.desirecore/ |
| Directory | Content |
|---|---|
agents/ | Agent repositories, persona, principles, memory, skills, workflows |
users/ | User profile, preferences, relationship memory |
skills/ | Global skills, including built-in and imported skills |
config/ | User settings, compute configuration, provider references |
runs/ | Conversations, execution records, receipts, audit data |
market/ | Marketplace cache |
cache/ | Rebuildable cache |
logs/ | Local logs and troubleshooting data |
Usage Statistics
Settings → Data & Privacy → Send Usage Statistics is the single switch for installation and product-usage statistics. It is enabled by default in the current version. You may turn it off at any time without affecting core functionality.
When enabled, DesireCore sends two categories of pseudonymous statistics:
| Category | Sent | Never sent |
|---|---|---|
| Installation statistics | A device identifier derived from hardware identifiers with SHA-256, version, operating system, and CPU architecture; after success, it is not sent again during the same UTC day | Name, email address, conversations, prompts, or files |
| Product-usage statistics | A hardware-independent random UUID, UTC date, version, platform, and daily numeric counts for tasks, outcomes, and delivery signals | Conversations or prompts, outputs, Agent names or identifiers, task titles, usernames, email addresses, filenames, or paths |
The two identifiers are not derived from one another and never appear in the same request. Product statistics are aggregated locally by day and sent on the following day or when connectivity returns. The unsent queue is retained for no more than 30 days. Agent identifiers used to calculate the number of distinct Agents remain local; only the count is transmitted. The statistics implementation does not read or send user identity profiles, conversations, prompts, model outputs, file contents, Agent names, or task titles.
Turning the switch off immediately stops both reports and local product-usage counting, and deletes the local random statistics identifier and pending queue. Re-enabling it creates a new random identifier. Turning it off does not automatically delete data already transmitted. Server-side deduplication records may be retained for up to 400 days; numeric aggregates with device-level identifiers removed may be used for long-term trend analysis.
When connected to a remote instance, the settings page reads both this machine and the connected instance. A disagreement is shown as a mixed state; if the remote value cannot be read, the UI explicitly reports that its state is unknown. Turning the switch off attempts to apply the choice to both sides. A remote write failure does not roll back the setting on this machine.
Agreement Versions and Re-consent
The Privacy Policy and Terms of Service have independent version numbers. DesireCore records the version and acceptance time for each agreement locally. On first use, when a record is missing, or whenever either agreement publishes a new version, the app presents the current versions and requires explicit agreement again before opening the main interface. The app and website show only the currently effective versions and provide no historical-version viewer.
Exporting Data
Open Settings -> Data and Privacy to export data. Exports can be selected by category.
Backup vs. Device Migration
Export Data and Migrate to New Device have different semantics:
| Regular backup | Migrate to New Device | |
|---|---|---|
| Primary purpose | Create a restore point for this device and identity | Carry identity and data to another device |
| Identity handling | Does not replace or remap the user identity | The target can replace its identity or merge into its current identity |
| Required content | Categories are selectable | Agents and system configuration are required; other categories are optional |
| API keys | Not included | Eligible user-managed compute Provider API keys can be included explicitly and encrypted |
| Conflicts | Handled by imported category | Merge mode resolves user data, Agents, Teams, and keys as semantic units |
Use a regular backup as a same-device restore point. For another device, use the migration wizard so the package contains source identity and version metadata. That metadata lets the target correctly handle identity-scoped profiles, preferences, private memory, and related data.
| Category | Includes |
|---|---|
| Agents and Teams | AgentFS repositories, persona, principles, memory, skills, workflows, team definitions, and relationship memory |
| Skills | Global and custom skills |
| Conversations | Session messages, receipts, history |
| System Configuration | User settings, non-plaintext compute configuration, UI preferences |
| Media | Media resources created or referenced in conversations and tools |
| Local mail data and rules | |
| Workspace Files | Selected work directory files |
| Audit Logs | API audit, tool-call audit, and related metrics |
Exports exclude or separately handle runtime directories, caches, device identifiers, and the original local secrets store.
Before upgrading or bulk-editing Agents, create a regular backup. When migrating onto a device that already contains data, the import flow also requires a restore point unless you explicitly accept the risk and skip it.
Optional Compute API Key Migration
API keys never follow a regular backup automatically. The device-migration wizard can optionally carry only keys that you entered for a compute Provider, manage yourself, and that can be explicitly bound to that Provider configuration.
It excludes:
- DesireCore account sessions and official cloud-compute credentials
- Credentials managed by OAuth, a CLI, or another external sign-in flow
- Sign-in state managed by subscription or command-line tools such as Claude or Codex
- Object storage, code hosting, mail, and other non-compute-Provider credentials
When you opt in, DesireCore still never archives the original config/secrets.json. Eligible keys are deduplicated into a separate encrypted payload. The migration passphrase is processed with scrypt (N=2^17, r=8, p=1) and the payload is protected with AES-256-GCM authentication and encryption. The passphrase must contain at least 12 characters. DesireCore neither saves it nor can recover it if lost.
On import, you may skip keys without affecting any other migrated data. To import them, unlock the payload with the migration passphrase. An incorrect passphrase, tampered package, or damaged payload prevents key import. If the target already has a key for the same Provider, choose per key whether to keep the local value or use the imported value. Replace mode defaults to the imported value; merge mode defaults to the local value. Imported keys are marked unverified, so verify connectivity and permissions again on the new device.
Encryption reduces exposure if the package leaks; it does not replace careful handling. Store the package separately from its passphrase, do not import an untrusted or suspicious package, and securely remove copies you no longer need. Copying the entire data root manually instead of using in-app export may also copy the local secrets store, so treat that copy as credential-bearing data.
Importing Data
DesireCore reads the package marker and distinguishes a regular backup from a migration package. A backup lets you choose categories to restore. A migration package enters the identity-migration flow. It checks structure, duplicate Agents, skill or Team conflicts, large workspace files, and path accessibility.
For a migration package from a different identity, choose one of two modes:
- Use as this device's new identity: use the package identity and data; data under the current identity is no longer accessed as the active identity
- Merge into current identity: retain the local identity, remap imported user data to it, and resolve conflicts item by item
When the target already has user-created Agents, the flow requires a regular backup as a rollback point unless you explicitly accept the risk and skip it. Import stops the Agent service and interrupts running tasks. Restart the app after migration completes.
Clearing Local Data
You can clear local data by category:
| Category | Includes |
|---|---|
| Conversations | Chat messages, session history, receipts |
| Agents | Agent configuration, persona, memory, and skills |
| Skills | Global skills; built-in skills reinstall automatically |
| Compute | LLM providers, model lists, compute nodes |
| Storage | S3 or object storage connection settings |
| Code Hosting | GitHub, Gitee, Gitea connection settings |
| User Profile | Identity, avatar, memory library, approval preferences |
| Market Data | Marketplace repository cache |
| Cache and Logs | Usage indexes, relation graph cache, logs, rebuildable data |
Clearing data is irreversible. For troubleshooting, clear cache and logs first instead of deleting agents or user profiles.
Privacy Guarantees
- Local storage: core data stays on your device by default
- Key protection: in-app export always excludes the original local secrets store; eligible compute API keys enter a migration package only as a separate encrypted payload after explicit opt-in
- Transparent calls: AI requests, tool calls, and external service interactions can be audited
- Minimal telemetry: installation and product-usage statistics contain only device/random identifiers, version, platform, and numeric counts; they exclude conversations, prompts, outputs, Agent names, task titles, and file paths, and can be disabled with one switch
- Exportable audit: audit logs can be exported as an independent category
Sensitive Scenario Advice
- Use local models or trusted private model services for highly sensitive content
- Review API Audit in Activity to confirm which provider receives data
- Keep confirmation enabled for command execution, file writes, and external sends
- Use a regular backup for same-device recovery and the migration wizard for moving devices
- Create a rollback point first, and keep a key-bearing migration package separate from its passphrase