The default
Agent conversation content does not leave your machine by default. For a session on your desktop, Fredrin's servers see metadata about a run and nothing else. One per-project setting can change that, off unless you turn it on: Struggles (scrubbed step excerpts sent for classification). Fredrin relays those excerpts and stores none of them.
What counts as content
Gated. Stays on the machine that ran the session, unless the project turns on Struggles (below).
- Terminal output and the scrollback buffer.
- The chat transcript: your prompts and the agent's replies.
- Screenshots and screen recordings of your running app.
- The raw output tail of an acceptance-check command.
- The agent's replies on the ticket timeline.
What counts as metadata
Ungated. Always flows, because the board cannot work without it.
- Status, exit code, timestamps, heartbeats.
- Token usage.
- Lifecycle and column events.
- The paths of project-context files a Worker read. Paths only, never bodies.
The line is drawn at anything that could carry your code or your conversation. Metadata is what the board needs to know a ticket is running; content is what was said and written while it ran.
Carve-outs
Remote agents always mirror. A job dispatched to a paired remote machine sends its conversation through the server, because that is the only way the transcript can reach the app you are watching it from.
If you need a run to stay entirely on one machine, run it on the machine you are sitting at. The gate governs local desktop sessions; it cannot govern a session that is by definition somewhere else.
Struggles relays excerpts, if a project turns it on. It is off by default, and only a project admin can turn it on. Then each Worker step's secret-scrubbed excerpt (the command, part of its output, and the messages, code included) is sent through Fredrin to TypeSafe's Jev classifier on Vercel's AI Gateway with zero data retention. Fredrin stores none of the excerpts: only each struggle's kind and timing, and the root-problem briefs the Analyze run writes in its own words.
Secret redaction
Separate from the gate, and unconditional. Secrets are scrubbed from agent output on the way out, both at capture and again server-side at ingest.
This applies to every session, because redaction and the gate solve different problems: the gate decides whether content leaves, redaction decides what is stripped from it if it does.
Erasure
Projects that once synced conversation history no longer do. To remove what was already stored, Delete stored history in Project settings purges the project's persisted conversation content, including agent-captured screenshots and recordings.
Artifacts you attached yourself are treated as yours and stay, which is why automated captures carry a marker distinguishing them from things you uploaded on purpose.
Your code
Worth stating separately, because it is the question people actually mean.
Fredrin does not upload your repository. Workers run on your machine, in a worktree on your disk, against a git remote you control. Fredrin holds tickets, plans, and board state, not your source.
Next steps
- Security and data handling - the trust boundaries.
- Brain - what does live in your repository.
- Remote agents - the carve-out, in context.