Privacy Policy

zzop collects nothing. The short version: your code never leaves your machine, and no data about you or your usage is gathered, transmitted, or stored by zzop.

What zzop does with your data

• All analysis is local. The zzop CLI, the zzop-mcp MCP server, and the npm packages run entirely on your machine and read only the repository paths you point them at.
• No network access. The analysis binaries make no network requests of any kind — by design, they carry zero HTTP dependencies. This is verifiable from the source and the dependency tree.
• No telemetry. There is no usage tracking, no crash reporting, no analytics, and nothing about you or your code is ever sent anywhere — not by the binaries, not by the MCP server, not by the Claude Code plugin. One network call is not covered by that sentence and is named here rather than buried: the plugin's SessionStart hook asks api.github.com for the latest release tag, on every session, so it can report that a newer version exists (it never installs one). That request carries your IP and reveals that a session started; it carries nothing else. The analysis binaries themselves make no network requests at all.
• No accounts, no keys. zzop requires no sign-up, no API key, and no credentials.
• MCP communication stays local. The MCP server speaks JSON-RPC over stdio with your MCP client (e.g. Claude Code / Claude Desktop) on your machine. What that client then does with analysis results is governed by that client's own privacy policy, not this one.

Third-party services you may touch while installing

Downloading release binaries or npm packages involves GitHub and npm's infrastructure, governed by their own policies:

• GitHub (releases, repository): GitHub privacy policies
• npm (package registry): npm privacy policy

Changes

If zzop's behavior ever changes in a way that affects this policy, this page changes in the same commit, in the public repository history.

Contact

Questions: open an issue at github.com/eezz4/zzop/issues.