Last updated: August 18, 2026
Loophole is an open-source, AI-native code editor built with privacy as a foundational design principle, not an afterthought. The core guarantee is simple: your code never passes through a Loophole server. Every AI request travels directly from your machine to the provider you choose. We have no backend infrastructure capable of seeing your code, your prompts, or your editor activity.
Loophole does not collect, store, or transmit your source code, project files, file paths, editor state, or any content you write or edit. All workspace indexing — the context Loophole gathers to power AI features — happens entirely on your local machine. We have no visibility into your codebase and no infrastructure to receive it. Your intellectual property remains yours alone.
When you provide API keys for AI providers such as Anthropic, OpenAI, Google Gemini, DeepSeek, or any of the 20+ supported providers, those keys are stored locally using the operating system's secure credential storage. We never transmit your API keys to any Loophole-controlled server. All API requests originate from your machine and go directly to the provider's public API endpoint. You retain full control over your credentials at all times.
When you send a chat message, use Quick Edit, or trigger autocomplete, Loophole assembles context from your open files and workspace structure locally, converts it to the provider's message format, and sends it over an Electron IPC channel to the main process. The main process then makes the HTTP call directly to the provider's API — not through any Loophole relay — and streams the response back to your editor in real time. The only data that ever leaves your machine is what you explicitly send to a provider.
When you use Loophole with cloud-based AI providers, your prompts and code snippets are sent directly to those providers subject to their respective privacy policies and data retention practices. Loophole acts as a local client only — no data passes through our servers. We strongly recommend reviewing the privacy policies of Anthropic, OpenAI, Google, or any other provider you choose. Many enterprise-tier plans include zero data retention options. When you use local models via Ollama, vLLM, or LM Studio, no data leaves your machine at all.
Loophole supports fully local inference via Ollama, vLLM, and LM Studio, which are auto-detected and whose model lists refresh automatically. In local mode, no internet connection is required for AI features, and no data of any kind leaves your device. This mode is ideal for sensitive codebases, proprietary projects, classified environments, or air-gapped systems where any external data transfer is unacceptable.
With your explicit opt-in, Loophole may collect anonymous usage statistics — such as feature interaction patterns, error logs, and performance metrics. This data is fully anonymized and contains no code, file contents, file paths, or personally identifiable information. Analytics help us understand how developers use Loophole and where to focus improvement efforts. You can opt out at any time in settings, and opting out has no effect on editor functionality.
The entire Loophole codebase is publicly available at github.com/loophole-ai/loophole-ide under the AGPL-3.0 license. You can verify every privacy claim in this policy by reading the source code directly. We believe that open-source auditability is the strongest privacy guarantee we can offer. If you discover a discrepancy between this policy and the code, please report it immediately.
We may update this policy to reflect changes in our practices or for legal compliance. Significant changes will be announced in the repository and the "Last updated" date above will be revised. Continued use of Loophole after any update constitutes acceptance of the revised policy.
For privacy-related questions or concerns, please open an issue on our GitHub repository or email us at hi@loopholeeditor.in. We take all privacy inquiries seriously and aim to respond within 48 hours.