Privacy and data handling

CloudPouch analyzes your AWS costs on your own computer: AWS credentials, billing data, and cached results stay there, and CloudPouch servers take no part in the calls CloudPouch makes to AWS. Besides AWS, the flows that leave your machine are listed below: registration, license validation, an update check, a font request to Google Fonts, and an error report you send on request. CloudPouch 2.0.0 sends no telemetry and no product analytics.

What stays on your computer

CloudPouch uses the AWS profiles already on your machine to sign requests and reads AWS cost and resource data directly. The data travels between AWS and your computer:

AWS account <-> your computer

AWS credentials stay in your local ~/.aws files. CloudPouch uses them to sign AWS API requests and does not send them to CloudPouch.
Cost and resource data that CloudPouch fetches is stored locally, together with Cost Insight results and Savings Scan runs.
Cache files, configuration, and logs live in local files you can inspect. Local files lists the exact paths.

In normal analysis, CloudPouch does not send AWS cost data, AWS resource metadata, AWS credentials, or Cost Insight results to CloudPouch servers.

What reaches CloudPouch, GitHub, or Google

Flow	When it happens	What it carries	Where it goes
Registration	You register for Free or a Pro trial	The email address you enter; CloudPouch emails you a 6-digit code to confirm it	CloudPouch
License validation	When CloudPouch starts	Your license key, a machine identifier, and the running CloudPouch version	CloudPouch licensing service
Update check	When CloudPouch starts	An update check against the published releases; no AWS cost data	GitHub Releases
Font request	When the CloudPouch window opens	The window loads a font from Google Fonts, so Google receives your IP address and the technical details of that request; no AWS data	Google Fonts
Error report	Only when you click Send error report…	The prepared report described below, as shown under View the data	CloudPouch

Registration, license validation, the update check, and the font request carry no AWS cost data; they are routine parts of running the app. The error report is the exception: it carries what you see under View the data (your notes and a redacted log fragment in which AWS resource names are not removed), and CloudPouch does not guarantee that it contains no cost data. It is never sent unless you choose to send it.

Error reports

CloudPouch never sends an error report by itself. When a screen offers Send error report…, a View the data expander shows the exact payload and log fragment first, and what you preview is what the report carries.

A report is not anonymous and not free of personal data:

It includes a machine identifier, the CloudPouch version, platform and operating system details, and your plan.
AWS resource names are not redacted, so they can appear in the log fragment.
A report prepared from the registration dialog also includes the email address you typed there.
CloudPouch keeps the reports it receives and makes no promise to delete one.

Before a report is sent, CloudPouch removes the license key, the MCP token, email addresses, 12-digit AWS account IDs, home-directory paths, and AWS access-key IDs from the free-text fields and the log fragment. If a name in the preview is one you cannot share outside your organization, do not send the report. Send an error report lists the full contents.

Telemetry

CloudPouch 2.0.0 does not send telemetry, crash reports, or product analytics. A failure is reported only through the error report above, and only after you choose to send it.

What the local log keeps

CloudPouch writes a local main.log for startup, profile loading, cache operations, and AWS API calls. From CloudPouch 2.0.0, it does not record your license key, your registration email address, the raw machine ID, AWS account IDs, organization account names, or configuration values. It can still name AWS resources. The first start after upgrading deletes the old main.log and main.old.log once, because earlier builds did write the omitted values.

The MCP server and your AI assistant

The embedded MCP server is disabled by default and runs only on your computer, on the loopback address 127.0.0.1. It adds no connection to a CloudPouch server, and it never changes anything in your AWS account.

If you enable it, the assistant you configure can read your local cost and savings data. Where that assistant sends what it reads is decided by the assistant and its vendor. CloudPouch’s local-only handling covers CloudPouch, not the assistant’s own traffic.