The whole list
Checked against the Orcyx source tree at c339cf993 on 2026-09-14. Where this page describes something the build does not do yet, it says so in place rather than describing the intention.
Orcyx is a local-first desktop application. This page lists every category of network call the app itself makes, read from the code at the stamp above. Calls your own CLIs make to their providers are yours — Orcyx is never in that path and adds nothing to it.
| Call | To | When | Carries |
|---|---|---|---|
| Sign-in and licence check | auth.orcyx.dev, api.orcyx.dev | At launch and on a timer while signed in | Your account session; the plan and status the desktop is admitted under |
| Plan catalogue and credit balance | api.orcyx.dev | When the billing panel or account menu opens | Your account session |
| Update manifest | downloads.orcyx.dev | At launch and every 24 hours | Nothing about you; the app version, so a newer signed package can be offered |
| Hosted features you choose | Orcyx's hosted service | Only when you pick a hosted engine or feature | The audio, prompt or session that feature works on; metered in credits and named in the interface |
| Release telemetry | An endpoint you configure | Never, unless you turn it on AND an endpoint is set | Redacted events (see below) |
| Crash reports | Nowhere | This build has no crash endpoint | Kept on disk; the panel says so and offers to discard them |
Every one of these goes through the same proxy configuration (Settings → Network), so an HTTP proxy, a custom CA or a bypass list applies to all of them at once.
Release telemetry
Off by default. The switch is in Settings → Privacy → Telemetry, and even switched on the pipeline is a no-op until a telemetry endpoint is configured; the shipped default endpoint is empty. When it does run, every event is passed through the same redactor the MCP audit log uses (API keys, JWTs, bearer headers, PEM blocks), stack traces are cut to five frames, file paths are reduced to basenames, and the session id is a random value generated per install that you can rotate by deleting its file. Events queue locally and are sent in batches; a failed send is kept on disk and retried, never dropped silently.
Crash reports
Crash capture can be switched on in Settings, and captured reports are listed there with a count. This build has no crash endpoint, so nothing is transmitted: the button reads "Discard queue (no endpoint yet)" rather than "Send", because a send that only cleared the queue would be a fake success. When an endpoint ships, this page changes first.
What never leaves the machine
- Your code, your terminals, and what agents type into them.
- The Vault — the markdown knowledge graph — and its search index, which runs locally.
- Provider secrets, which live in the OS keychain; the app persists only a reference to them.
- Voice transcripts, which are PII-redacted on your machine before any hosted send, and never sent at all on the local engines.
- Time-travel checkpoints, which are a shadow repository beside your workspace.
- The Ledger, the pane-activity board and swarm state, which are files under your workspace.
Orcyx is proprietary software and does not publish its source. That is precisely why this page exists: what you cannot read, you should at least be told plainly.