CodeInOven keeps its own state to itself. The app writes what it needs under its configuration directory, on this computer, and it does not write into your repository unless you or an agent asks it to. This page describes what is stored, what a run sends out, and what to look at before you point the app at something private.
App state has its own directory
Settings, projects, threads, chat history, plans and reviews, checkpoints, terminals, speech recordings and transcripts, learned corrections, and logs all live in the app's configuration directory. Your repository is a separate thing that the app opens rather than a place it stores itself in.
That rule holds for the smaller pieces too. An imported speech model is recorded as a reference to a folder you own, not copied. A worktree the app creates for parallel work is derived inside its own directory rather than in your project. When a harness leaves a session file in a project folder, the app moves it into its own state on the next run and keeps the checkout clean.
The vault
Accounts and keys go into an encrypted vault. Provider API keys, GitHub access, the passwords and private keys for an Oven, and the credentials a tool asks for are all stored there, encrypted on this computer.
Values in the vault are used by the app on your behalf and are not handed to a model. When an agent needs a credential, it asks for it by name, you paste the value once, and the agent receives a reference to it instead of the value itself. The secret does not appear in the conversation, in a plan, or in a diff.
Repositories and threads stay here
Your repositories are on your disks and stay there. Threads, history, checkpoints, and branches belong to this computer, so a thread you never run on a remote machine never touches one. Git operations happen where the repository is.
What a run sends out
A run is your conversation with an agent. When you send a message, the agent and the provider behind the model receive what that turn needs: your messages, the instructions the agent is following, the parts of the project it reads, the results of the commands it runs, and its own replies. That traffic goes to the account you connected, under that provider's terms.
What a run does not carry: other projects, other threads, your vault, and anything you did not give the agent access to. Audio from dictation stays out of it while a local speech model is installed. Attachments reach the model only when you attach them.
Speech cleanup works the same way. Local cleanup is on by default and runs on this computer. Sending cleanup to a conversation model is a separate switch that is off until you turn it on, and when it is on, only the transcript and a little formatting context go with it.
When a model runs on your own machine
The app connects to local model servers through a base URL, using either an OpenAI-compatible or an Anthropic-compatible API. When the model answering a run is on a server you run yourself, the prompt and the reply travel over your own network and do not reach a model provider.
When the work runs on a remote Oven
A thread can run on another machine you added as an Oven. In that case the work happens there: the checkout is cloned onto that machine, the agent runs there, and the files it writes are written there. From this computer, the app sends what the thread needs over the SSH connection it already holds, and the account credentials you selected for setup travel the same way, once, into that machine's account directory with owner-only permissions. Transcripts, caches, and local account homes are not copied across.
Your provider account and its terms
CodeInOven does not run a service between your machine and the provider you connected. Provider usage, retention, and training policies are set by that provider, not by this app. If a run needs to leave the machine, it leaves through the account you gave it.
Before you open a sensitive repository
Work through this list once, before the first message, and again whenever the project changes.
- Check which agent and which model the composer is set to. That pair decides where the work goes.
- Check the permission level. It decides what the agent may do on its own without asking you first.
- Look at the Oven control. It should say Local if the work must stay on this computer.
- Confirm that remote speech cleanup is off if the transcripts are sensitive.
- Confirm that Enable voice recording is off, unless you mean to send audio to a conversation model.
- Read the project's own secrets situation. A key committed to the repository is visible to every agent that reads the project, and the vault does not cover it.
- Keep anything that must never leave this machine out of the folders you add, rather than out of the conversation.
- Remember that an agent works inside the repository by design. It reads files you gave it access to, and a run may write to them.
None of that is a reason to avoid the app. It is the shape of the deal: your state stays in its own directory, your keys stay in the vault, and what leaves the machine is what the selected agent and provider need for the turn you sent.