I Audited 3 AI Coding Tools for Privacy — The Difference Is 100x A developer audited three AI coding tools—Claude Code, Cursor, and Cline—for privacy and found that all archive conversations in local plaintext without informing users. Claude Code stored 43MB of conversation data and saved API keys in plaintext, while Cursor stored passwords in plaintext JSONL. Cline was the only tool to store API keys in the OS keychain but still archived all conversations. None of the tools achieved a perfect privacy score. Claude Code stores 43MB of your conversations. Cursor saves your passwords in plaintext JSONL. Cline is the only one that puts your API key in the OS keychain — but it still archives everything you say. Not one of them tells you this is happening. Two weeks ago, I discovered Claude Code had silently archived 43MB of my complete conversation history on my machine. I wrote about it. The comments asked: "What about Cursor? What about Cline?" I tested them. The results were more nuanced than I expected. Three tools. Five dimensions. One standardized test script. | Dimension | What I Tested | |---|---| | Conversation Storage | What's stored? Format? Size? | | Credential Security | How is the API key stored? Plaintext or encrypted? | | User Awareness | Does the tool tell you it's archiving your conversations? | | Data Isolation | Can AI in Project A read conversations from Project B? | | Uninstall Residue | Does conversation data survive uninstallation? | In each tool, I typed the same three things: a normal coding question, a database connection string with a password, and an API key. Conversation Storage : ~/.claude/projects/ , JSONL format. One file per session. Opening one 2.3MB session file: | Content | Count | |---|---| | AI responses | 590 | | AI internal thinking | 272 | | Tool calls | 101 | | Tool call results incl. file paths | 100 | | File history snapshots | 208 | Credential Storage : settings.json — plaintext. The built-in Read tool can access this file without restriction. Data Isolation : No. Global history file merges all projects. Uninstall Residue : 19 project directories, 43MB of conversation data. Conversation Storage : agent-transcripts/ , JSONL format. Same structure as Claude Code — user input, AI responses, tool calls all stored. Size depends on conversation length. Stores every user input, every AI response, and every tool it called. Does not store tool execution results or thinking blocks — in Plan mode. Credential Storage : SQLite database stores tokens at 415 bytes each. Better than plaintext. My test password and API key : Both written verbatim into the transcript file. Data Isolation : Yes. Per-project separation. Conversation Storage : Open source, directly auditable. Each task gets its own directory with 4 JSON files: tasks/