What the recorder uploads, field by field
The TokenPylon recorder shares call metadata with your account by default. That makes the question of what it sends worth answering exactly, not in a sentence on a settings page.
A contract generated from the code
The upload contract (docs/upload-contract.md in the repository, and tokenpylon privacy --contract on any machine) lists every field of every uploaded record, with its type. It is generated from the recorder's own structures, and two tests hold it in place: the recorder's test fails when the file no longer matches the code, and the server's test fails when its allowlist of accepted fields differs from the file. A field cannot be added on one side only.
See the next upload before it happens
tokenpylon sync --dry-runprints the exact bodies of the next call and meter uploads, built by the same function the uploader uses, and changes nothing: the queue is read in a transaction that is rolled back.
What is never sent
- Prompts, replies, transcripts and tool output
- File contents, paths, project and repository names, branches
- Session labels and the provider keys your tools use
Public figures are aggregates only, published when enough independent recorders contributed. Sharing is one switch: tokenpylon sharing off.