We never receive your data, because there is nowhere for it to go.
RevenueOS is software you run, not a service you send things to. This page lists every destination the product can reach, every file it writes, and what stays your responsibility.
Who is responsible for what
RevenueOS is open-source software (MIT) that you install and run on your own machine or your own server. The RevenueOS project operates no backend for it. There is no account to create, no server your install reports to, and no path by which the project could read your workspace. You are the data controller for everything RevenueOS touches; the project is not a processor of it, because it never holds it.
Licensing is not an exception. A RevenueOS licence is an HMAC-signed key checked locally by the software itself — installing or verifying one contacts no licence server.
What is never collected
- No telemetry. No usage counters, no feature pings, no heartbeat.
- No crash or error reporting. Tracebacks stay in your
logs/directory. - No analytics SDK anywhere in the product or on this website.
- No phone-home. Not at install, not at first run, not on licence check, not ever.
That is a claim about code, so it was checked as one: every literal HTTP(S) host and every network
primitive in the shipped tree — httpx, urllib, socket,
smtplib, imaplib and every subprocess call, vendored code
included — was enumerated and accounted for. The complete result is the next section. No
RevenueOS-operated host appears in it, because none exists.
What leaves your machine
Every row below happens only because you configured it, and most of the product works with none of
them switched on. With REVENUEOS_LLM=off and nothing connected, a RevenueOS run reaches
exactly one host: your own website.
| Destination | When it is contacted | What is sent |
|---|---|---|
Your model provider — Anthropic's API with your ANTHROPIC_API_KEY, the Claude
Code CLI you are already signed into, or any OpenAI-compatible endpoint you point
REVENUEOS_LLM_BASE_URL at |
Any model-backed step | The worker prompt: your business canon from company-context/, recent entries
from learning-loop/CORRECTIONS.md, and the material being analysed — page text,
ad-export rows, lead rows, a draft email, or text extracted from a document you dropped in.
REVENUEOS_LLM=off sends nothing to any model. |
| Your own website, and any URL you hand a worker | init --from, demo, seo, measure |
An ordinary HTTPS GET. Nothing about you is sent beyond a User-Agent. |
| Hacker News — the Algolia search API and the public item API | The monitor worker |
The search seeds from your own product brain. |
| Ahrefs' free domain-rating endpoint | The seo worker |
Your domain and the competitor domains you listed. |
| OpenStreetMap Overpass mirrors, and the business websites found through them | Public-data lead discovery in discover |
A geographic and category query. No list of yours is uploaded. |
| The GitHub API and PyPI's download-stats API | The growth worker, if you use it |
A public repository or package name. |
| Accounts you connect: Stripe, Google (Ads, Search Console, Analytics, Calendar), Meta, WordPress, GitHub Pages | Only after you run revenueos connect and authorise them |
API calls to your own account, under that provider's own privacy policy. Connections are
read-only until you separately pass --allow-changes. |
| Your SMTP host, and your IMAP host | Executing an approved outreach action; the inbox worker |
The email you approved, and a read of your own mailbox. Leave SMTP_PASSWORD
unset or set REVENUEOS_DRY_RUN=1 and approved mail is written to
data/outputs/ instead of sent. |
| PyPI | Installation only, including the first run of the Claude Desktop extension | The usual package download. |
What is stored, and where
All of it is plain files inside the workspace directory you chose. Nothing is stored anywhere else.
- company-context/
- Your business canon as twelve Markdown files: offer, customers, differentiators, pain points, voice. Written at onboarding and edited by you.
- revenueos.yaml
- Website, competitors, channels, sender identity, and the SMTP/IMAP host and username. Passwords are read from the environment and are never written into this file.
- data/revenueos.db
- SQLite. Actions and their evidence, leads with their contact details, email drafts and sends, replies and bounces, measured outcomes, metrics, and a record of documents read.
- data/connections.json
- OAuth tokens and API keys for the accounts you connected, at file mode
0600. Plaintext JSON unless you setREVENUEOS_TOKEN_KEY, which seals the secrets with Fernet. If those credentials matter to you, set that variable. - data/exports/, data/outputs/, data/reports/, data/documents/, logs/
- The CSVs you drop in, deliverables and dry-run emails, generated reports, extracted document text, and run logs.
- learning-loop/CORRECTIONS.md
- Your corrections, never deleted, injected into worker prompts for thirty days.
- accounts.json (hosted mode only)
- One record per account: email address and a PBKDF2-HMAC-SHA256 password hash at 200,000
rounds, at file mode
0600. Passwords themselves are never stored.
Documents you give it
Files dropped into data/inbox/documents/ — a price list, a brand guide, a business
plan, a competitor report — are parsed entirely in-process by pure-Python libraries. There is
no upload, no conversion service, and no shelling out to an external binary. The document itself
never leaves the machine.
Only the extracted text is sent onward, only to the model provider you configured, and only if a credential is present — the same path as any other worker prompt. The intake worker never edits your canon on its own: it queues a correction for you to approve.
Outreach, and the people in your lists
If you use RevenueOS to send email, the prospects in your lists are your data subjects and you are their controller. RevenueOS helps — it appends a CASL-compliant footer, keeps a suppression list, enforces a daily cap, and refuses to draft to anyone it has not qualified — but the lawful basis for contacting them, and honouring every opt-out, is yours. No worker sends anything: only an action you approved and then executed does.
Deleting things
Deletion is file deletion, because that is all there is. Remove the workspace directory and
everything is gone. Remove individual files under data/ to drop just that.
revenueos disconnect <provider> erases that provider's stored tokens. One
exception worth keeping: leave the unsubscribes table alone — dropping it would let
outreach contact someone who already asked you to stop.
This website
The pages you are reading are static files served by GitHub Pages. They carry no analytics script, set no cookies, use no browser storage and make no third-party requests. GitHub keeps its own server logs for the domain, under GitHub's privacy policy; we neither see nor receive them.
Changes, and how to reach us
If this policy changes, the change lands in the public repository with the commit that made it, and this page is rebuilt from that commit. Questions, corrections, or a claim on this page you think is wrong: open an issue — that is the only channel, and it is public by design.
Last updated 14 September 2026, verified against the source tree on the same date. RevenueOS is MIT-licensed; see NOTICE.md for the vendored components and security & approval for how the approval gate works.