On your machine.
Review sessions live in SQLite on your Mac. Every displayed source line is read from git. Your review document contains only what you write or explicitly keep.
What leaves your machine.
Model calls go to Anthropic through your Claude Code login and claude.ai subscription. Airlock has no server that sees your code.
The app checks airlock.build for updates and verifies their signatures before installing them. We count those checks and downloads as daily totals, and record nothing that identifies your Mac.
Your licence key is verified on your Mac. Airlock does not need access to your code to check your licence.
Two things go to GitHub, and only when you press the button that sends them. Both go from your Mac through your own gh login, and Airlock’s servers receive neither. Send as draft review sends your review document — only what you wrote or kept — as a pending review on the pull request, which nobody else can see until you submit it on GitHub. Sign off on GitHub sends a status on the commit you read that says only “Signed off in Airlock”: no notes, no counts, nothing from your review.
You choose where to post your review.
Airlock never posts your review on its own. Edit what you kept, preview what will copy, and export Markdown to paste wherever you like.
Or send it as a draft review and submit it on GitHub yourself, choosing whether to comment, approve or request changes there. Airlock never submits a review for you. The sign-off’s green airlock/review check links to one page on this site, the same for every pull request, so nothing about yours reaches us when someone clicks it.
This website walkthrough.
The slides use illustrative text and diagrams. They make no model calls, access no repositories and collect no review questions or notes.
If you send us a report from the feedback page, we store what you wrote and which page you came from. An email address is optional and is only used to reply. Nothing else about you is stored with it — no address, no browser fingerprint, no identifier.
This website counts visits on its own server: which pages are viewed, which site sent you here, the campaign tag on the link you followed, whether you’re on a phone or a computer, and how many people download the app. We keep those as daily totals only — no address, no identifier, nothing stored in your browser — and use no third-party analytics or tracking scripts. Hosting and access services operate separately.
If you open a WhatsApp chat from this site, we count that the link was followed, as a daily total like the rest. The conversation itself happens in WhatsApp, under its own terms.