October 20, 2026 · Privacy · 3 min read

Local-first, for real: what Bumeter reads, writes and sends

#privacy#local-first#security

"Nothing leaves your machine" is easy to write on a landing page. This post backs it up with specifics: every place Bumeter reads from, everything it writes, the three times it goes online, and how to remove all of it. If you would rather check than trust, the last section tells you where to look in the source.

No account, no telemetry, no server

Bumeter has no sign-up and no server of its own. It does not collect analytics, crash reports or usage statistics, and it never sends your prompts, code, file names or token counts anywhere. It does not read your Anthropic or Kiro account either: everything it shows comes from files your AI tools already wrote on your disk.

What it reads

If your tools keep their data somewhere else, the log folders can be changed in config.toml (claude_projects_dir, kiro_sessions_dir, opencode_db). Bumeter never writes to any tool's logs or database.

It also runs two local commands when they are installed: claude plugin to list the skills that come with your Claude Code plugins, and kiro-cli chat --no-interactive "/usage" to read your Kiro credit balance. The second one does not call a model and does not create a session.

What it writes

Almost everything goes into one folder:

• Linux: ~/.local/share/bumeter/
• macOS: ~/Library/Application Support/bumeter/
• Windows: %APPDATA%\bumeter\

On Linux and macOS that folder is created readable by you only (mode 0700), and the socket the CLI uses to talk to the app is 0600.

Outside that folder, Bumeter changes things in two places, and only when you confirm a plan that lists the change first:

• ~/.claude/settings.json, when you turn limit tracking on or off. Only statusLine.command changes, the original is backed up first, and Remove restores it.
• ~/.claude/skills/, when you disable, enable, install or uninstall a skill. Each change is journaled and can be undone.

The three times it goes online

That is all. The bum CLI and the Claude Code status line hook never touch the network. The app's window loads its interface from inside the app, not from a website.

Removing everything

1. Turn off limit tracking first: Settings → Limit tracking → Remove. That puts your Claude Code status line back exactly as it was. (If you skip this, the record-only form keeps working without Bumeter, but the "show" form needs it.)
2. Uninstall the app the usual way for your system. On Windows the uninstaller also takes bum off your PATH.
3. Delete the data folder listed above. With Homebrew, brew uninstall --zap --cask bumeter removes it along with the app's caches and preferences.

Your AI tools' own files are untouched throughout; Bumeter only ever read them.

Check it yourself

Bumeter is open source under GPL-3.0, so none of this has to be taken on trust. A few places to start:

• Every network address in the code: search the repository for https://. Outside tests and comments you will find the update endpoint, skills.sh and github.com.
• Where files go: crates/bum-core/src/paths.rs.
• What is stored: crates/bum-core/src/store/schema.rs.
• How settings.json is edited: crates/bum-adapters/src/claude_code/statusline.rs, with its tests next to it.

Or watch it: run Bumeter with your firewall's logging on for a day. You should see the update check go to GitHub after each start, and nothing else unless you went looking for skills.