Skip to main content
Handshake stores session and project data on your computer.

​
Local access controls

  • The daemon accepts only a loopback listen address.
  • Browser requests with a non-loopback origin are rejected.
  • ~/.handshake uses owner-only permissions.
  • SQLite database, WAL, and shared-memory files use owner-only permissions.
  • HTTP request bodies are limited to 32 MiB.

​
Stored information

Handshake can store:
  • Session messages and metadata.
  • Working directories.
  • Git state and related commits.
  • Summaries and settled decisions.
  • Factual project knowledge.
  • AI-authored project documents.
  • Cached release-check status.
See Data locations.

​
Release check

The daemon requests the latest GitHub release at most once every seven days after a successful check. After a failed check, it can try again after one hour. The request sends a Handshake user-agent header. It does not send session or project data. get_handshake_update_status reads the cached result and does not make a network request.

​
Anonymous usage events

Release builds can send: The events do not create a person profile. They do not contain session content, prompts, project names, repository data, or file paths. Local development builds do not send events when they do not contain the release telemetry key.

​
Disable anonymous events

Set:
Any non-empty value disables the events. Handshake does not create ~/.handshake/telemetry_id while this setting is active.

​
Delete local data

Run:
Confirm deletion of ~/.handshake only when you want to remove the session database, knowledge bundles, authoring configuration, and anonymous ID.