K0lmenIA privacy policy
How K0lmenIA, the open source QA agent plugin for Claude Code, handles data.
Summary
- It runs on your machine. K0lmenIA's agents, skills and scripts run locally inside your Claude Code installation.
- We don't collect your data. k0lmena runs no servers that receive what the plugin processes, and the plugin includes no telemetry or analytics.
- You decide what connects. Data only leaves your machine for services you use or configure: Anthropic (the model behind Claude Code) and the integrations you enable.
- Secrets stay in your
.env. It is never committed, and agents never ask for tokens in the chat.
Scope
K0lmenIA is an open source project (MIT license) by the QARMY and Underc0de community, published as part of the k0lmena suite. This policy covers:
- The K0lmenIA plugin: the agents, skills, templates, scripts and MCP connector configuration included in the repository.
- This website (
k0lmena.com), in the This website section.
It does not cover Claude Code or Anthropic's services, or the third-party tools you connect to the plugin. Each is governed by its own privacy policy.
What data the plugin processes
K0lmenIA only works with what you give it or ask it to read. Depending on the task, it may process:
- Project inputs: user stories, bugs, API contracts, documents in
input/, the application repository (read-only) and Figma designs. - Content from the tools you connect: issues, comments, epics and pages from Jira, Confluence, Azure DevOps, Linear, ClickUp, monday.com, Asana, Trello, Notion, YouTrack, Shortcut, GitHub, GitLab or Bitbucket, and test cases and results from Xray, QMetry, AIO Tests or Azure DevOps Test Plans.
- What it observes while testing: pages, screenshots, API responses, test emails (Mailpit), database records, server logs and, if you ask, camera video streams.
- Local configuration: the variables in your
.env(URLs, users and tokens) used to connect to those services. - Usage metrics:
npm run metricasestimates token usage per agent from information already on your machine. The calculation is local and is not sent anywhere.
Everything the agents produce (test cases, reports, evidence, automation scripts) is saved on your machine, in output/ and herramientas/k0lmena/, or in the test management tool you choose.
Third-party services
K0lmenIA sends no data to k0lmena. Data may reach these third parties, always through services you use or enable:
| Service | When it receives data |
|---|---|
| Anthropic (Claude Code) | Whenever you use an agent: your requests and the context the agent reads are sent to the Claude model under your account (Pro, Max, Team, Enterprise or API) and Anthropic's privacy policy. |
| MCP connectors (Atlassian, Figma, GitHub, GitLab, Azure DevOps, Linear and others) | Only if you configure them. The agent reads and, when you ask, writes to those tools with your own credentials. |
| Xray, QMetry, AIO Tests, k0lmena TMT | When you ask it to upload test cases, cycles or results. |
| Slack and Microsoft Teams | Only if you set SLACK_WEBHOOK_URL or TEAMS_WEBHOOK_URL. Without a webhook nothing is sent. |
| BrowserStack | Only if you set BROWSERSTACK_* to run mobile tests in the cloud. |
| The applications you test | Execution agents browse, call APIs and submit test data to the environments you point them at. |
The tools the plugin installs or uses (Playwright, Newman, k6, JMeter, OWASP ZAP, Lighthouse, ffmpeg and others) run locally. Downloading them from npm, PyPI or Docker Hub is subject to those registries' terms.
Credentials and secrets
- Secrets live in a single
.envat the repository root, listed in.gitignoreso it is never committed. - Agents read credentials from there and never ask you for tokens or passwords in the chat.
npm run doctorchecks your configuration without displaying secret values.- We recommend always using credentials for test environments, with the minimum permissions needed.
Where data lives and for how long
Artifacts, reports and evidence stay on your machine until you delete them. Each tool keeps its last 5 runs to compare results; older ones are discarded. To remove everything generated, delete the relevant output/ folders. Anything uploaded to external tools or sent to Anthropic is subject to each service's retention.
Personal data in tests
You are responsible for the data you give the plugin and for having authorization to test each system. We recommend:
- Using test or anonymized data, not real customer or user data.
- Testing in development, QA or staging environments, not production.
- Running security tests and pentests only with written authorization from the system owner.
- Reviewing reports before sharing them, since they may include screenshots or responses with sensitive information.
This website
k0lmena.com uses Google Analytics to measure visits in aggregate (page views, country, device). Google may use cookies for this, under its privacy policy. You can block them in your browser or with the opt-out add-on. The site has no forms or user accounts: if you message us on WhatsApp, the conversation is governed by WhatsApp's policies and we only use it to reply to you.
Your rights
Since the plugin sends us no data, we hold no information about you from its use. If you contacted us and want to access, correct or delete the data from that conversation, write to us and we will do it. For data processed by Anthropic or other services, exercise your rights directly with them. In Argentina, the Agencia de Acceso a la Información Pública is the supervisory authority under Personal Data Protection Law 25,326.
Children
K0lmenIA is a professional tool for QA teams and is not directed at minors.
Changes to this policy
If the way the plugin handles data changes, we will update this page and its effective date. Changes are also recorded in the repository history.
Contact
For privacy questions, open an issue on GitHub or message us on WhatsApp. If you find a security issue, don't post it in an issue: tell us privately.