Data boundary

Revue has one decision plane with two deployments. Local mode runs on your machine. Hosted mode uses the Revue service.

Local mode

Local mode sends nothing to Revue hosted services. The service binds to 127.0.0.1, and local decision memory stays in the owner-only event log on your machine. Local and hosted memory are separate and are not synchronized.

Local mode stores configuration and credentials in owner-only files under ~/.config/revue. It writes service logs to ~/.local/state/revue/service.log and durable events as plaintext JSONL to ~/.local/share/revue/events.jsonl. Do not expose the local service port to a LAN or the public internet.

Hosted mode

Hosted mode sends decision questions, human answers, explicitly shared context, and the small route-proof fields needed to audit delivery to the configured Revue hosted plane. Browser-approved machine credentials and the human-answer session are stored under ~/.config/revue.

Decision text, answers, evidence, and explicit context are user content. They may contain personal or confidential data. Secret redaction runs when events are appended, but it cannot guarantee that user content contains no sensitive information. Avoid submitting personal data that Revue does not need, and treat retained decision memory as sensitive.

What Revue does not send in either mode

Ambient Amp lifecycle events do not include prompts, assistant text, tool inputs or outputs, shell commands, working directories, or touched file paths. Revue does not read historical Amp logs or backfill work from before the plugin or MCP client connected.

This boundary applies to ambient lifecycle metadata. Content that you intentionally put in a decision, answer, evidence field, or shared context follows the selected plane. In hosted mode that content leaves your machine. In local mode it stays in the local event log.

Retention and logs

Corrections append new events. They do not delete the original question, answer, or context. Revue does not currently provide selective event deletion or automatic retention expiry, and upgrades do not rewrite older event logs.

Before deleting all local history, export a portable owner-only JSONL copy:

revue export
revue export ./backups/revue-memory.jsonl

The default destination is ./revue-export.jsonl. Revue writes the file with mode 0600 and refuses to overwrite an existing export. Export is available only to the local human owner; it does not export a hosted workspace.

To erase the complete local event log, follow the stop-delete-restart sequence in Configuration. Revue cannot delete individual events.

Operational logs are separate from decision memory. Revue avoids intentionally logging prompts, answers, email addresses, and workspace names. It records operation names, timings, counts, and opaque request, workspace, user, and session identifiers for diagnosis and security auditing. Those identifiers are pseudonymous metadata, not anonymous data.