Privacy & Security

​

Core Privacy Principle

​

How It Works

​

Local Mode (Direct File Access)

1. Next.js server component reads files directly from ~/.claude/ directory
2. Data is loaded using Node.js fs module (src/lib/load-data.ts)
3. Data is passed to client components for rendering
4. No network requests are made (except for Next.js dev server)
5. No external APIs are called

// From src/lib/load-data.ts:17
const CLAUDE_DIR = path.join(process.env.HOME || "~", ".claude");

export function loadAllData(): DashboardData {
  return {
    stats: loadStatsCache(),
    sessions: loadSessionMetas(),
    history: loadHistory(),
    memories: loadProjectMemories(),
  };
}

​

Upload Mode (Client-Side Processing)

1. Run node scripts/export.mjs locally to create a JSON export file
2. Export file is generated entirely on your machine
3. You manually upload the file to the web app via drag-and-drop
4. File is processed entirely in your browser’s JavaScript runtime
5. No upload to any server occurs
6. Data stays in browser memory and localStorage only

// From scripts/export.mjs:102-114
const data = {
  stats,
  sessions,
  history,
  memories,
  account: Object.keys(account).length > 0 ? account : undefined,
  exportedAt: new Date().toISOString(),
};
fs.writeFileSync(OUTPUT, JSON.stringify(data));

const sizeMB = (fs.statSync(OUTPUT).size / 1024 / 1024).toFixed(1);
console.log(`\nExported to: ${OUTPUT} (${sizeMB} MB)`);
console.log("Upload this file at: https://claude-analytics.vercel.app");

​

Architecture Details

​

Client-Side Only Rendering

All components use "use client". The server component (page.tsx) only reads files from disk — all chart rendering and interaction is client-side. This means the app works as a static export with uploaded files.

"use client";

import { useState, useMemo } from "react";
import type { DashboardData } from "@/lib/types";
// ... rest of imports

​

No Database

No data is ever sent to external servers. There is no database.

• No database
• No authentication system
• No user accounts
• No server-side data storage
• No analytics or tracking
• No telemetry

​

Data Storage

​

Where Claude Code Stores Data

​

Browser Storage (Upload Mode)

1. Browser Memory — Active data for current session
2. localStorage (optional) — Multi-profile data persistence

// From src/components/client-page.tsx
// Profiles are stored in localStorage with key "claude-analytics-profiles"

• Stays on your device
• Never syncs to cloud
• Can be cleared anytime via browser settings
• Only accessible by JavaScript from the same origin

​

Export File Handling

​

What’s Included in Exports

1. stats-cache.json — Pre-aggregated statistics
2. session-meta/*.json — All session metadata
3. history.jsonl — All prompts (full text)
4. memories — Project memory files with content (max 5000 chars per file)
5. account info — Your account UUID and organization UUID (from statsig cache)

​

Export File Security

const data = {
  stats,
  sessions,
  history,
  memories,
  account: Object.keys(account).length > 0 ? account : undefined,
  exportedAt: new Date().toISOString(),
};
fs.writeFileSync(OUTPUT, JSON.stringify(data));

• Are created locally on your machine
• Contain unencrypted JSON data
• Should be stored securely (treat like source code)
• Can be deleted anytime after viewing
• Are never required to be shared or uploaded anywhere

​

Network Activity

​

Local Mode

• http://localhost:3000 — Web UI (local only)
• http://localhost:3000/api/session-messages — Reads session transcripts from disk

​

Upload Mode (Hosted)

• Serves static HTML/CSS/JavaScript files
• All JavaScript runs in your browser
• File reading happens via browser File API
• No fetch/XHR requests to external services for data

​

Code Verification

​

Data Loading (Local Mode)

export function loadStatsCache(): StatsCache | null {
  try {
    const raw = fs.readFileSync(path.join(CLAUDE_DIR, "stats-cache.json"), "utf-8");
    return JSON.parse(raw);
  } catch {
    return null;
  }
}

​

Dashboard Component

const filteredSessions = useMemo(
  () =>
    selectedProject === "all"
      ? data.sessions
      : data.sessions.filter((s) => s.project_path === selectedProject),
  [data.sessions, selectedProject]
);

​

Upload Component

// File is read using FileReader API
const reader = new FileReader();
reader.onload = (e) => {
  const data = JSON.parse(e.target.result as string);
  // Data stays in browser memory
};
reader.readAsText(file);

​

What Data Contains

​

Potentially Sensitive Information

• Project paths — Full directory paths on your machine
• Prompts — Every prompt you’ve sent to Claude Code
• Code context — Pasted code snippets from your projects
• File names — Names of files you’ve worked on
• Commit messages — From git operations
• Memory files — Project-specific context that Claude maintains
• Account UUID — Your Claude account identifier

​

Not Included in Data

• Your actual source code files (only filenames and line counts)
• Passwords or API keys (unless you pasted them in prompts)
• Email address or name
• Payment information
• IP addresses
• Device information (beyond what Claude Code tracks)

​

Multi-Profile Privacy

• Each profile’s data is isolated
• Stored separately in browser localStorage
• Switching profiles doesn’t mix data
• Deleting a profile removes its data from localStorage

// From src/components/client-page.tsx
interface Profile {
  id: string;
  name: string;
  data: DashboardData;
}

​

Recommendations

​

For Maximum Privacy

1. Use local mode — Run npm run dev and access via http://localhost:3000
2. Keep export files secure — Treat them like source code or credentials
3. Don’t share screenshots — Redact project paths and prompts first
4. Clear localStorage — Delete profiles when done analyzing
5. Review export contents — Inspect the JSON file before sharing

​

Safe Practices

​

Unsafe Practices

​

Open Source Transparency

• Source code: https://github.com/1shanpanta/claude-analytics
• MIT License
• All code is auditable
• No obfuscation or minification in repository

​

Compliance Considerations

​

GDPR

• Processes no personal data on servers
• Stores no data in databases
• Has no data controllers or processors
• Requires no consent mechanism
• Cannot be subject to data breaches (no central storage)

​

Data Retention

• Local mode: Data persists in ~/.claude/ until you delete it
• Upload mode: Data persists in browser until you clear localStorage
• Export files: Persist until you delete them from your filesystem

​

Questions & Concerns

1. Review the source code — All privacy claims are verifiable
2. Check browser DevTools — Monitor network activity yourself
3. Use local mode — Eliminate any upload concerns entirely
4. Report issues — File issues at https://github.com/1shanpanta/claude-analytics/issues

​

Summary

​

Next Steps