Your AI key is held in VS Code's SecretStorage, which is your operating system's credential store — Keychain on macOS, Credential Manager on Windows, your keyring on Linux. Not in settings, and not in a file in the extension folder. FlowKy does not proxy those calls and does not see the traffic.

Extension tokens. Signing in at flowky.ai is what connects the extension: it exchanges that session server-side for a scoped, revocable token, and only the token is stored. Revoke it from Settings → Security and the extension is cut off immediately, without affecting your browser session.

The local bridge between browser and editor is loopback only. Console output, network traffic and screenshots travel over it and do not leave your machine.

What is sent to FlowKy. Content-wise, only what you save: tasks, flows, captures you keep, and your brand kit. No prompt, no file content and no source code.

One thing is sent without you pressing anything: when signed in, the extension reports a count of AI requests, batched shortly after they happen. A number and a label. It draws your usage chart and enforces your plan limit. Signed out, nothing is sent. The more detailed record of which commands you have run stays on your machine and is never uploaded, and there is no analytics SDK, crash reporter or third-party tracker.