> ## Documentation Index > Fetch the complete documentation index at: https://docs.coderabbit.ai/llms.txt > Use this file to discover all available pages before exploring further. # Data, privacy, and network access > See what the CodeRabbit IDE extension for VS Code and VS Code-based editors sends and stores, how to keep secrets out of reviews, which hosts it connects to through firewalls and proxies, how telemetry works, and how to remove local data. This page lists what the extension sends to CodeRabbit, the hosts it connects to, and what it keeps on your computer. Use it to review the extension for security approval, to configure a firewall or proxy, or to remove all local data. ## What a review sends For each file in the review, the extension sends: * the file path * the full current content of the file * the diff * whether the file is new, renamed, or deleted Each review also sends: * the first of `.coderabbit.yaml`, `.coderabbit.yml`, or `.coder.yaml` at the root of the workspace folder, if there is one * for a [follow-up review](https://docs.coderabbit.ai/ide/review.md#review-again-after-more-changes), the files and diffs from the previous review, and CodeRabbit's internal state from it * your CodeRabbit user ID, username, and email, your user ID at your Git provider, and a client ID for the editor installation * the selected organization's ID and its Git provider * the `origin` remote URL, or the first remote's URL if there is no `origin`, with any credentials removed, and your Git provider's host URL * the editor type and the extension version * the head and base commits With [self-hosted CodeRabbit](https://docs.coderabbit.ai/ide/self-hosted.md), reviews go to your instance instead of CodeRabbit Cloud. **Fix with AI** sends nothing to CodeRabbit. It hands the finding's prompt to the agent you chose, inside your editor, and that agent's own data terms apply. ## Keep secrets out of reviews The extension doesn't scan files for secrets, so it sends a file such as `.env` unless the rules below keep it out. Its built-in exclusions skip `*.pem`, `*.pub`, and Terraform state files, but not `.env` files, other key files, or credential files. Which of those files a review sends depends on Git: * With `coderabbit.respectGitIgnore` on, which is the default, an untracked file that `.gitignore` covers isn't sent. * A tracked or staged file is sent with its full content, even if `.gitignore` lists it. * A new file that Git doesn't ignore is sent with its full content. To keep a secrets file out of reviews, add it to `.gitignore` before Git tracks it, and don't commit or stage it. An ignore rule doesn't exclude a file that Git already tracks. For uncommitted changes to such a file, clear its checkbox in **Uncommitted changes** and start the review with the review button, because **CodeRabbit: Start Review** from the Command Palette [reviews every uncommitted file](https://docs.coderabbit.ai/ide/review.md#start-a-review). **All changes** and **Committed changes** have no checkboxes, so in those scopes a changed tracked file that holds secrets is sent. [Path filters](https://docs.coderabbit.ai/configuration/path-instructions.md#path-filters) such as `!**/.env*` keep a file out of the review itself, but CodeRabbit applies them after the upload, so the file is still sent. ## How CodeRabbit uses your code CodeRabbit uses the uploaded files to review your changes. With the Essentials plan or higher, it can also clone the repository from your Git provider for codebase context; see [Which review configuration applies](https://docs.coderabbit.ai/ide/review.md#which-review-configuration-applies) for when. Your code isn't used to train models. Review caching follows the same rules as for other reviews; see [Caching](https://docs.coderabbit.ai/reference/caching.md), including how to turn it off. For data security and retention, see the [FAQ](https://docs.coderabbit.ai/faq.md#data-security). ## Network access The extension needs outbound HTTPS and WebSocket traffic on TCP port 443. It needs no inbound firewall rules. | Host | Protocol | Purpose | When | | - | - | - | - | | `app.coderabbit.ai` | HTTPS | Sign-in, account, organizations, plan, and usage | Signed-in sessions in the US region | | `ide.coderabbit.ai` | WSS | Review connection | Every review in the US region | | `app.eu.coderabbit.ai` | HTTPS | Sign-in, account, organizations, plan, and usage | Signed-in sessions in the EU region | | `ide.eu.coderabbit.ai` | WSS | Review connection | Every review in the EU region | | `cli.coderabbit.ai` | HTTPS | Public configuration, and the CLI download during CLI setup | Startup, and **CodeRabbit: Set up CLI and skills** | | `storage.googleapis.com` | HTTPS | Check for a new extension version | Every startup | | `k.coderabbit.ai` | HTTPS | Usage telemetry and the **Give feedback** survey | When telemetry is on, or when you open **Give feedback** | | `us.i.posthog.com` | HTTPS | Uninstall event | After the extension is removed | | Your Git provider's avatar host | HTTPS | Your account picture in the sidebar | When the sidebar shows your account | The telemetry host comes from the public configuration; `k.coderabbit.ai` is the default. If `storage.googleapis.com` is blocked, the update check fails silently and nothing else breaks. With self-hosted CodeRabbit, sign-in and reviews go to your instance URL and `/ws`, and the extension doesn't contact the `app`, `ide`, or telemetry hosts, or `cli.coderabbit.ai` outside CLI setup. It still contacts `storage.googleapis.com` for the update check, and `us.i.posthog.com` on uninstall if that computer was ever signed in to CodeRabbit Cloud. In a workspace you haven't trusted, the extension ignores the self-hosted URL and uses the CodeRabbit Cloud hosts instead; see [Restricted Mode](https://docs.coderabbit.ai/ide/settings.md#restricted-mode). The extension has no proxy setting of its own. It relies on your editor's proxy support for extensions, such as `http.proxy` in VS Code. In a remote window, connections start on the remote machine, so its proxy settings apply. Your proxy must allow WebSocket connections to `ide.coderabbit.ai`, to `ide.eu.coderabbit.ai` in the EU region, or to your instance. For the CodeRabbit CLI, see [CLI network requirements](https://docs.coderabbit.ai/cli/network-requirements.md). ## Data stored on your computer | Location | What it holds | | - | - | | The editor's secret storage, in your operating system's keychain | Sign-in tokens, the Git provider, the SSO workspace, and the GitHub token for self-hosted CodeRabbit | | Your editor user settings | `coderabbit.selfHostedUrl` and any other CodeRabbit settings you changed | | The extension's global state in the editor | Your profile, including your email, the selected organization, plan details, the client ID, and which prompts you dismissed | | The editor's workspace storage for each workspace | Every review, including the full contents of reviewed files, the diffs, findings, and your base branch and scope choices. They stay until you clear them in **History** or run **CodeRabbit: Cleanup previous reviews**; uninstalling doesn't delete them. | | `user-data.json` in the CodeRabbit app data folder | Client ID, user ID, username, email, organization ID, editor, extension version, and Git provider, written when you sign in to CodeRabbit Cloud and deleted when the extension is uninstalled | | `.reinstall-flag` in the same folder | User ID and client ID, written when the extension is uninstalled and read when it's installed again | | `coderabbit-instructions-.txt` in the operating system's temporary folder | Long **Fix with AI** prompts for terminal agents, deleted after the agent run succeeds and kept if it fails or is stopped | The CodeRabbit app data folder is in your home folder on the machine where the extension runs: * macOS: `~/Library/Application Support/CodeRabbit/` * Windows: `%APPDATA%\CodeRabbit\` * Linux: `~/.config/coderabbit/` ## Telemetry Usage events, such as sign-ins, applied suggestions, and **Fix with AI** handoffs, follow your editor's telemetry setting, such as `telemetry.telemetryLevel` in VS Code. Error events replace error messages and stack traces with a generic label. These are sent regardless of the editor's telemetry setting, and no setting turns them off: * an install event, once per installation, after you sign in * a user identification call each time you sign in to CodeRabbit Cloud * the creation of your extension profile, when you sign in to CodeRabbit Cloud * an uninstall event, sent to `us.i.posthog.com` after the extension is removed, if `user-data.json` exists With self-hosted CodeRabbit, the extension sends no usage events, and the install event goes to your instance. When the extension sets up the CodeRabbit CLI, it passes your editor's telemetry choice to the CLI installer and the CLI. ## Remove local data To remove the stored reviews, sign-in data, and files the extension keeps, do these steps in order: **1. Delete stored reviews** In each workspace where you used CodeRabbit, run **CodeRabbit: Cleanup previous reviews**. **2. Sign out** Run **CodeRabbit: Logout**. This removes your sign-in tokens and the self-hosted GitHub token from secret storage, and clears the self-hosted URL from your user settings. **3. Uninstall the extension** Uninstall CodeRabbit from the Extensions view and restart the editor. On restart, the extension's uninstall step deletes `user-data.json`. **4. Delete the remaining files (optional)** Delete `.reinstall-flag`, and `user-data.json` if it's still there, from the CodeRabbit app data folder listed in [Data stored on your computer](#data-stored-on-your-computer). **5. Delete leftover prompt files (optional)** Stop any terminal agent that **Fix with AI** started, then delete the `coderabbit-instructions-.txt` files that remain in your operating system's temporary folder on the machine where the extension ran. These steps don't clear everything. The extension's global state in the editor, such as the client ID and which prompts you dismissed, and any CodeRabbit settings you changed other than the self-hosted URL, can remain. Reset those settings in your editor's settings. The extension doesn't uninstall the CodeRabbit CLI or its skills. Remove them separately as described in the [CLI documentation](https://docs.coderabbit.ai/cli.md). ## What's next > **[Update or uninstall](https://docs.coderabbit.ai/ide/update-uninstall.md)** > > Update the extension, check which version you have, or uninstall it. > **[Self-hosted CodeRabbit](https://docs.coderabbit.ai/ide/self-hosted.md)** > > Send reviews to your organization's self-hosted CodeRabbit instance instead of CodeRabbit Cloud. > **[Troubleshooting](https://docs.coderabbit.ai/ide/troubleshooting.md)** > > Fix connection errors, including reviews that can't reach the reviewer through a proxy. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.