@clauderecallhq/cli 0.74.0 → 0.75.0

package/README.md

@@ -22,7 +22,7 @@ Claude Recall indexes every Claude Code session you've ever run, surfaces what m
 
 <br />
 
-<sub>100% local. No cloud. No account. No telemetry. Your conversations never leave your machine.</sub>
+<sub>Your session content stays on your machine. No cloud. No account. Opt-in telemetry, off by default.</sub>
 
 </div>
 
@@ -504,7 +504,7 @@ All writes are rate-limited (default 60/min), zod-validated, and audited to `~/.
 
 <div align="center">
 
-<img src="https://cdn.clauderecall.com/marketing/privacy-trust.gif?v=hd3" alt="Local-first design — daemon binds to 127.0.0.1, no telemetry, no outbound network calls" width="640">
+<img src="https://cdn.clauderecall.com/marketing/privacy-trust.gif?v=hd3" alt="Local-first design — daemon binds to 127.0.0.1, session content stays on your machine" width="640">
 
 </div>
 
@@ -513,20 +513,21 @@ All writes are rate-limited (default 60/min), zod-validated, and audited to `~/.
 Claude Recall is **local-first by design**, not as an afterthought.
 
 - **The daemon binds to `127.0.0.1` only.** Never `0.0.0.0`, never a public interface.
-- **No telemetry. No analytics. No background phone-home.** The daemon, file watcher, indexer, and web UI never make outbound network calls. Your session content never leaves your machine.
-- **The only outbound calls are user-initiated**, never automatic, and never transmit your session data.
+- **No session content is uploaded — ever.** The daemon, file watcher, indexer, and web UI never transmit your session data. Search, context re-injection, and the web UI are fully local.
 - **No cloud. No account.** Your data lives at `~/.recall/` and nowhere else.
 - **Source sessions are never modified.** Claude Code's JSONL files at `~/.claude/projects/` are strictly read-only to Recall.
 - **Never-delete-data invariant.** Every write enforces three independent durability layers: SQLite with history columns, plain-text mirror on disk, and source JSONLs untouched. Renaming, clearing, or removing anything is always additive; the prior value is archived, never destroyed.
 
-The two user-initiated outbound calls:
+The daemon's full outbound network surface — metadata only, never session content:
 
-| Command | Endpoint | What it sends | What it gets |
-|---|---|---|---|
-| `recall activate <key>` | `clauderecall.com` | The license key only | A signed JWT for offline validation |
-| `recall semantic install` | `huggingface.co` | Nothing about you | The `bge-base-en-v1.5` ONNX model file |
+| Trigger | Endpoint | What it sends | What it gets | Automatic? |
+|---|---|---|---|---|
+| `recall activate <key>` | `clauderecall.com` | License key only | A signed JWT for offline validation | No — only when you activate |
+| Pro license revocation check | `clauderecall.com` | Anonymous license fingerprint | OK / revoked status | Yes — daily, after activation |
+| `recall semantic install` | `huggingface.co` | Nothing about you | The `bge-base-en-v1.5` ONNX model | No — only when you opt in to vector search |
+| Anonymous install ping | `clauderecall.com` | One anonymous nonce, no PII, no fingerprint, no cross-month linkage | Nothing | Yes — once a month, only after `recall telemetry on` (off by default) |
 
-Both are optional and not required for core indexing, search, or context re-injection. Skip them and Recall is fully air-gapped.
+Activate is required for Pro features. Telemetry is opt-in. Without activation and without telemetry, the daemon's automatic outbound surface is zero — Recall is fully air-gapped for indexing, search, and context re-injection. Full telemetry disclosure: [clauderecall.com/telemetry](https://clauderecall.com/telemetry).
 
 <br />