Knot Privacy Policy
There is no Knot server. Your code stays on your machines and goes only to the people you pair with, encrypted on the way.
Knot reports nothing to PointBreakLab. What leaves your machine goes to your own peers, to the Tor network, or to a service you set up yourself.
1
Who makes Knot
Knot is written and maintained by one developer in Würzburg, Germany, publishing under the name PointBreakLab (pointbreaklab.com).
PointBreakLab does not receive the data you work on with Knot. It stays on your machines and on the machines of the people you share a project with, so you, or the team or company you use Knot for, decide what happens to it.
Contact: mail.roshankumargupta@gmail.com
2
What PointBreakLab collects
Nothing.
Knot has no account and no sign-up. It contains no analytics, no crash reporter and no update check, and it never opens a connection to a PointBreakLab server, because there isn't one.
You download Knot from GitHub Releases, where GitHub's privacy statement covers the download itself. The pointbreaklab.com website runs no analytics script.
3
What stays on your machine
These never leave your computer unless you copy them yourself:
Identity The Ed25519 key that identifies your device, created on first run. You can protect it with a passphrase (Argon2id and XChaCha20-Poly1305).
Settings ~/Library/Application Support/knot on macOS; ~/.config/knot and ~/.local/share/knot on Linux.
.knot folder Each project's event journal and agent-session records, including the prompt a coding agent received if you installed Knot's hook. Excluded from commits.
Logs The daemon log, written on your machine only.
API keys Keys for a cloud AI provider you add yourself, kept in the operating system's keychain, never in a settings file.
4
What goes to your peers
Knot sends data only to devices you paired with and to people you gave access to a project. It is encrypted in transit: through Tor onion services, or, on your own network, over an encrypted channel the two devices set up between themselves (the Noise protocol). A device still on an older version of Knot connects to the others on your local network without encryption until it updates. Once two devices have connected encrypted, neither accepts an unencrypted connection from the other again. What they receive:
• The files and commits of the projects you share with them, and, if mirroring is on, your changes as you save them.
• With every commit, the author name (and email, if you set one) from your Knot settings, plus a device label made of your computer's login name, its operating system and a short fingerprint of your public key, for example "alex@macos (pubkey:1a2b3c4d5e6f)". This becomes a permanent part of the project's history on every copy.
• Chat messages, voice messages and files you send, and the project memory file (knot.md).
• Whether you are online, which files you are working on, and the nickname you gave your device.
So that your devices can find each other, Knot also announces your device on any local network you have marked as trusted: its nickname, its public key and its Tor address. Everyone on that network can see this announcement, and it is not encrypted. Offline mode stops it, and so does not trusting the network.
Once a peer has received something, they have their own copy. Revoking their access stops future syncing; it cannot pull back what they already have.
5
The network
Apart from your peers, these are the only connections Knot makes:
Tor On by default in the installed app. The bundled Tor connects to the Tor network and publishes an onion address for your device. The Tor relays you connect through see your IP address but not your content, and your peers do not see your IP address. The Tor Project's privacy policy covers that connection (torproject.org).
LAN presence Knot announces your device nickname, public key, onion address and Knot version on your local network, but only on networks you marked as trusted, and never in offline mode.
mDNS The peer-to-peer layer also announces itself with mDNS, and currently does so on every local network, including untrusted ones: a technical peer ID derived from your device key, and the local addresses Knot listens on. Anyone on the same network can see it. Setting the environment variable KNOT_DISABLE_MDNS=1 switches it off.
Coordinator Only if you set one up, your own or someone else's. It learns which project IDs you host, your peer ID and the addresses you can be reached at, never your code. If an organisation's coordinator requires single sign-on, you sign in with the identity provider that organisation chose.
Relays Only if you use one. A relay forwards encrypted bytes between peers and sees which peers are connected, not what they send.
6
AI features
None of these are on by default.
Knot AI Writes commit messages and summaries using a model server on your own machine or network, for example Ollama or llama-server. The diff does not leave that machine.
Knot Ask Can use a cloud model only if you add a provider yourself (for example Anthropic, OpenAI or any compatible API). Your question and the code you ask about then go to that provider, under that provider's terms.
Coding agents Tools such as Claude Code or Cursor that you connect through Knot's MCP server talk to Knot locally. What those tools send to their own vendors is up to the tool and its settings.
7
VS Code extension
The Knot extension is installed from Microsoft's Visual Studio Marketplace, and Microsoft's terms apply to the Marketplace and to VS Code itself. The extension contains no telemetry library and talks only to the Knot daemon on your own machine. Its "Download Knot" prompt opens pointbreaklab.com/knot.
8
Keeping and deleting data
Everything is on your machines, so you delete it yourself:
• Delete a project folder to remove that project from your computer.
• Uninstall Knot and delete its folders (listed in section 3) to remove your identity, settings and logs.
• Copies your peers already received stay with them. Ask them to delete theirs.
PointBreakLab stores nothing about you, so there is nothing to delete here.
9
Security
Traffic between peers is encrypted, and your identity key can be protected with a passphrase. Knot is pre-alpha and has not had an outside security review.
A security report reaches one person at mail.roshankumargupta@gmail.com. Please write before disclosing publicly, and expect a slow reply. There is no bug bounty.
10
Your rights
Under the GDPR you have rights of access, rectification, erasure and data portability. PointBreakLab holds no personal data about you from Knot, so there is nothing on this end to exercise them against. If you use Knot for a team or company, that organisation is responsible for the data shared in its projects.
11
Changes to this policy
If Knot starts sending anything new off your machine, this page is updated and the date at the top changes.