Raven node and CLI
Identity, contacts, keys, and local message state are held on the host. The supported peer path does not require a central account directory or message database operated by Raven.
legal/privacy
Privacy and local control.
How the Raven terminal software, optional agent integrations, and this website handle information. Updated 8 September 2026.
privacy/scope
Three distinct data paths.
The Raven peer protocol, the agent services configured in RDAP, and visits to this website do not share one data handling model.
RDAP and model providers
RDAP stores its own agent keys and team state. The operator chooses carriers and model providers. Hosted providers receive the requests and context sent to them; inspect those settings before delegating sensitive work.
This website
This website is hosted by Vercel. Loading a page sends standard HTTP request information, including an IP address and request headers, to the hosting infrastructure. The site code does not include advertising trackers, analytics scripts, or a visitor login.
privacy/identity
Your host holds your profile.
Raven does not ask for a centrally registered account to create a local identity.
Public identity
You choose which peers receive your public address, public key, fingerprint, and any local name you share. Private identity material must stay in a protected profile or a backup you control.
Local protection
File permissions, operating system controls, disk encryption, and the selected storage implementation determine local protection. Identical storage bound to hardware is not assumed on Linux, Windows, and macOS.
Removal and recovery
Stop the node before removing its profile, message data, keys, and backups. Uninstalling a binary does not necessarily remove those files. There is no central account recovery service; losing the keys can mean losing the identity.
privacy/communication
Messages go to the peers you choose.
The normal Raven envelope path requires authenticated session setup and seals message content locally before a carrier forwards it.
Endpoint and relay copies
Peers may retain messages they receive. Store and forward hosts may retain sealed envelopes according to their queue and expiry policy. Deleting a local copy does not delete the copies or backups that peers keep.
Metadata
A carrier or network observer can see information such as timing, traffic volume, and reachable endpoints. Payload encryption does not remove all network metadata.
Retention
Local data retention depends on the configuration of the host and the copies its operator keeps. Relay and provider policies depend on the selected services. This page makes no universal retention or remote erasure guarantee.
Libraries run within the selected implementation.
A software library is different from a hosted service. The Cargo manifests identify the actual components and enabled features.
Cryptography
The Rust workspace declares libraries including the dalek Ed25519 library, chacha20poly1305, and zeroize for signatures, payload protection, and the handling of sensitive buffers. Their presence is not a completed security audit.
Peer transport
The Raven swarm crate uses libp2p. Bootstrap and relay hosts are network participants; a library dependency does not determine their operator or retention policy.
Local state
The core uses rusqlite and SQLite. SQLCipher is available behind an explicit build feature; encrypted storage must not be assumed for every default SQLite database.
Seed storage backed by the OS
The identity seed uses macOS Keychain or a DPAPI protected file on Windows. On GNU/Linux it uses the desktop keyring (Secret Service) when one is unlocked, and otherwise a file encrypted with a passphrase you choose. There is no recovery without that passphrase.
Core dependencies and storage feature flags · Platform storage details
privacy/integrations
Optional services have their own boundaries.
Review the services you configure and the external links you choose to open.
RDAP carriers
Direct HTTP tasks are signed but unencrypted. HTTPS or a protected network layer is needed for confidentiality. A shared Git repository has its own access rules and retention. The experimental plaintext mailbox is disabled by default.
Configured external processing
Optional RDAP integrations may send task content and permitted project context to a service the operator selects. Review the policy and configuration of that service; the core peer protocol of Raven does not make external processing local.
Website and source hosting
Vercel serves website requests; GitHub serves the linked repositories. Their own privacy policies govern those services. The local peer architecture of Raven does not imply that website hosts receive no connection data.
privacy/contact
Questions and changes.
Questions about privacy? Write to us. Policy changes are published on this page with an updated revision date. Security reports should follow SECURITY.md.