Privacy of reports and usage
BAS sends a skill's author reports, not conversations, and counts, not transcripts. This page says exactly what leaves your Mac when an agent logs a use or reports a problem. The full privacy policy covers your account and everything else.
What a report contains
- Its category, severity and summary, and the details and suggested fix if the agent wrote them.
- The skill and the version it was filed against.
- Who filed it: the account signed in to BAS.
Nothing else is attached: no transcript, file contents or repository name. The CLI removes secrets such as API keys, tokens, private keys and passwords in URLs from the text before the report is saved, so the outbox never holds an unredacted report.
When a report is sent
- Preview each report (the default): the app lists waiting reports, and you edit, send or discard each one.
- Send automatically: the app sends reports as they arrive, even with its window closed.
Reports about a skill of yours that was never published, or about a GitHub skill whose sharing with maintainers is off, are never sent. They stay on your Mac and show on the skill's page.
What usage counts contain
Each bas used call adds the skill's version and the time to ~/.bas/usage.jsonl on your Mac. Every 5 minutes the app sends only the number of uses per version and day, then removes what it sent. What the skill was used for never leaves your Mac.
Counts are not sent for a skill of yours that was never published, or for a GitHub skill whose sharing is off. You can turn usage sharing off in Settings; the app then discards the counts instead of sending them, and reports still work.
Who sees them
- Installed skills: only the skill's owner, the person who published it.
- Your skills: only you. Your own uses of a changed skill count as a draft, apart from the published versions.
- Skills from GitHub: the repository's verified maintainers, BAS users with write access to the repository, while you leave Share uses and reports with the maintainers on. It is on by default, and you can turn it off for each GitHub skill.
- Skills BAS does not manage: nobody. They have no footer line, and the CLI refuses to log for them.
If you delete your account, reports you filed stay with the skill's author with your name removed.