Privacy and Data

Aesop runs locally. The browser interface binds to 127.0.0.1, uses a per-process access token, and rejects foreign origins and hosts. Keep its local access URL private. It does not require a hosted Aesop account.

What the Archive Contains

Conversations may include private text, source code, file paths, attachments, tool inputs and outputs, and secrets pasted into a conversation. Collector allowlists exclude known credential files, but cannot guarantee that transcripts or opaque application stores contain no sensitive information.

Choose backup locations and their access permissions accordingly. Aesop does not encrypt the archive itself; use storage encryption and access controls appropriate to the data. Do not commit personal archive data to a public repository.

Browser Authentication

Optional browser collectors use dedicated profiles below state_root, outside the archive. Those profiles hold authentication state and are not mirrored. Sign in through aesop login <source>; do not copy cookies or point the collector at your everyday browser profile.

Reading Transcripts

The reader disables active transcript HTML, remote images, and external navigation. Full-text search uses a local index (parsed/.search.sqlite) that stores word tokens, not transcript text, and is never mirrored to backup destinations.

Cursor IDE chats are extracted from Cursor's state database into state_root/derived/cursor/composers/ before they are archived. Those extracted copies contain the same conversation content as the archive, stay outside it, and are not mirrored. Opening an interface does not launch collection. Collection, parsing, backup, and verification are explicit actions.

Sharing Diagnostics

Logs redact common credential fields, but may still include private paths, source identifiers, and error details. Review them before sharing an issue. Prefer a minimal synthetic example for parser reports and never upload a personal account export to a public issue.

Removing Aesop

aesop service uninstall removes managed app and service files. Package removal does not erase archives, browser profiles, configuration, or logs. Retain those while migrating; delete them separately only after confirming you no longer need the contents.