We see how much you code.
Never what you code.

npx buddybrawl init adds exactly three things, all inside your own home folder:

• ▸~/.buddybrawl/config.json — the server URL and a random sync token (a password unique to this install).
• ▸~/.buddybrawl/buddy-sync.mjs — the sync script itself. It's plain JavaScript; you can open it and read every line.
• ▸One entry in ~/.claude/settings.json — tells Claude Code to run the sync script when a session ends.

What this means for you: Nothing system-level, no background services, no admin rights. To remove BuddyBrawl completely: delete the ~/.buddybrawl folder and the buddy-sync line in ~/.claude/settings.json. That's the whole uninstall.

At install time:

• ▸A hashed machine ID (a one-way fingerprint of your computer + username) and the CLI version. No email, no name, no personal info at install.

After each Claude Code session:

• ▸Your git email and name (from git config) — this is your player identity. The email is only used to find your account: we store a one-way hash of it, never the email itself. Your git name becomes your public display name on the leaderboard.
• ▸Session stats: how long the session ran, how many tool calls and messages, which tools were used.
• ▸A count of how many distinct files you touched — sent as opaque hashes (tokens like f3a9b2c1), never the file names or folder paths themselves. They exist only so we can count unique files.
• ▸Your companion's identity from ~/.claude.json: its name, species, and your Anthropic user ID (used so your buddy looks the same here as in Claude Code). Nothing else is read from that file — no conversations, no settings.

What this means for you: Is this dangerous? Honestly: not very. Your git email is already stamped on every commit you push to a public repo — most developers' is public knowledge. And file and folder names never leave your machine: they're hashed to opaque tokens before anything is sent, so our database can't reveal what your projects are called or how they're laid out — only how often you code.

• ▸Your source code or the contents of any file.
• ▸Your prompts or conversations with Claude.
• ▸Your API keys, tokens, or credentials of any kind.
• ▸Your GitHub password — sign-in is OAuth, GitHub never shows it to us.

What this means for you: This isn't just policy — it's enforced in the sync script itself (which you can read on your own disk): it reads your Claude Code session transcript locally only to count tool calls, messages, and how many distinct files changed — the counts are what leave your machine, never the transcript itself. File paths are hashed to opaque tokens before they're sent, and input sizes are capped. There is no code path that reads your project files.

• ▸Signing in on the web uses GitHub OAuth. We store your GitHub username, display name, and avatar — the same things anyone can already see on your GitHub profile. These appear publicly on the leaderboard.
• ▸We set only login-session cookies (from Supabase, our database provider). Their one job is keeping you signed in.
• ▸Zero analytics, zero trackers, zero ads. No Google Analytics, no pixels, no fingerprinting scripts. We don't follow you around the internet — we couldn't even if we wanted to.

What this means for you: If you never sign in on the web, we never see your GitHub account at all — syncing and battling stats work from the hook alone.

Worst case — an attacker gets full access to our database. Here is the complete, honest inventory of what they would and wouldn't have:

They would see:

• ▸Player display names (usually your git name) and hashed identifiers derived from git emails — not the emails themselves; those are never stored.
• ▸Session stats (durations, counts) and opaque file-count hashes — no readable file or folder names.
• ▸GitHub usernames and avatars (already public on GitHub).
• ▸Game data: buddies, items, battle history, ELO.

They could not get:

• ▸Your source code or prompts — they were never sent, so they can't leak.
• ▸Your GitHub password — we never had it (OAuth).
• ▸Access to your machine — sync tokens are stored one-way hashed on our side and each token is locked to a single buddy, so even a stolen database can't impersonate your computer or touch other accounts.

What this means for you: Realistic worst outcome: a stranger knowing your display name and how often you code. Annoying — not dangerous. Your code, your Claude conversations, your email inbox, and your accounts stay yours.