Transparency

Effective October 22, 2026.

Code Maverick is built on a simple promise: candidates should know exactly what is captured during an interview, why it is captured, and what is not. The sync client is interview-scoped and inspectable.

This document is the source of truth for what the Code Maverick sync client does and does not do. If the product ever contradicts this document, this document is the contract. The Privacy Policy at codemaverick.dev/privacy explains who is responsible for the data once it is captured.

What we capture

When you run npx code-maverick@alpha join <interview-public-id> from your exercise directory, the client captures:

  • File contents for files inside the directory you ran the command in, when those files change.
  • File path and content hash for each synced file, so the interviewer can see what changed.
  • Sync events: when the connection starts, when it disconnects, when files are updated, when files are deleted, and when sync errors occur.
  • A periodic heartbeat (every 10 seconds) so the interviewer can see whether your sync client is currently connected.
  • Your name and email, which you provide on the candidate page before downloading the interview package. They are matched against what the interviewer entered when planning the interview.
  • AI Provenance, when supported by the candidate's local tools: Git AI attribution metadata such as line ranges, tools, models, prompt counts, and related contribution statistics.
  • Prompt Evidence, when supported by the candidate's local tools: Git AI prompt/message content tied to AI-assisted work in the interview.

That's it. Everything captured is interview-scoped, and the sortie packet reports the AI Usage Policy and supported AI capture behavior for that interview.

Local processing state

To compute diffs, line ranges, and AI Provenance, the client may create a temporary local Maverick Provenance Ledger under the Code Maverick state directory:

  • macOS: ~/Library/Application Support/Code Maverick
  • Windows: %LOCALAPPDATA%\Code Maverick
  • Linux: ${XDG_STATE_HOME:-~/.local/state}/code-maverick

CODE_MAVERICK_STATE_DIR can override this location.

The ledger mirrors eligible interview files while the client is running. It is Code Maverick processing state, not Candidate git history, and it is not created inside the Sortie Packet. After the sortie ends and final sync succeeds, the client should delete this local ledger. If the client exits early, stale local ledgers are cleaned up by later connect or doctor runs after the retention window.

Before an interview, code-maverick doctor may create and delete a local probe ledger under the same state directory to verify that sync, diffing, and supported AI attribution can work. The probe uses synthetic files, not the exercise contents. The setup report it uploads carries health and status metadata, not raw agent hook payloads: the operating system, the versions of Node, git, and the attribution tooling, the absolute paths of the exercise folder and the state directory, which usually include your local username, and which of the supported agent tools (Cursor, Claude Code, Codex) have a configuration folder in your home directory, so the interviewer knows whether attribution can work.

AI tooling policy

Each interview has an interviewer-selected AI Usage Policy:

  • AI-Native: AI tooling is allowed and encouraged for this interview. Supported AI metadata and Prompt Evidence may be captured so the Evaluator can understand how the Candidate worked.
  • Traditional: AI tooling is not allowed for this interview. If supported AI tooling is used anyway, AI Provenance and Prompt Evidence may be captured and reviewed.

The candidate page and sortie packet should show the active AI Usage Policy before the candidate downloads the packet or starts the sync client.

What we do not capture

The sync client does not capture:

  • Keystrokes
  • Clipboard contents
  • Screen recordings
  • Browser history
  • Private AI prompts outside the watched interview project or unsupported by the Git AI provenance flow
  • Editor telemetry
  • Files outside the watched exercise directory
  • Environment secret files (.env, .env.local, .env.*.local, *.pem, *.key)
  • Any process or activity unrelated to the watched directory

The client does not run as a background daemon. It only runs while you have it running, and it stops automatically when the interview ends.

Skipped files and directories

The following are skipped from sync by default and never uploaded:

  • Directories: node_modules, .git, .claude, .cursor, .vscode, .maverick, .code-maverick, dist, build, coverage, logs, tmp, temp, test-results, playwright-report, .playwright, .nyc_output, git-ai-dumps, .next, .turbo
  • Files: .env, .env.local, .env.*.local, *.pem, *.key, *.log, .DS_Store, Thumbs.db, Desktop.ini, *.swp, *.swo, *~, .gitignore, .gitattributes, MAVERICK.md

.env.example is intentionally not skipped. It is treated as a starter template file.

Where data goes

Synced file content and metadata are sent to the Code Maverick backend, hosted on Convex in the United States, where the interviewer can view them during the live session and review them after the interview ends. The sortie packet names the backend the client will connect to.

Heartbeat and session events

The client sends a small heartbeat every 10 seconds so the interviewer can see your connection status. The heartbeat carries no payload beyond a timestamp.

The client also writes session events for connection lifecycle and file changes. These power the lightweight session timeline the interviewer sees, and they are part of the durable interview record after the interview ends.

How to inspect the client

The candidate sync client ships as an inspectable npm package. The published bundle is minified, so reading it line by line is hard; what you can do is:

  • unpack the published package (npm pack code-maverick@alpha) and check which hosts it talks to and which files it reads
  • audit exactly what is sent over the network during an interview
  • run code-maverick doctor before joining to see the setup checks, and read the watched directory and ignored folders the client prints when it starts

If something looks wrong, contact the security email below before the interview starts.

Security disclosure

If you find a security or privacy issue, please email security@codemaverick.dev rather than filing a public issue.

Questions

If you are a candidate and have any concerns about what Code Maverick captures, you should be able to ask the interviewing team or contact us directly. The product is intentionally narrow in scope; if it ever feels otherwise, that is a bug we want to know about.