What leaves your computer

Reflex Ops runs on your computer. This page lists what it sends out, where it goes, and what is kept. It describes version 0.22.1 and was checked against its code on 13 October 2026.

When you ask a model

A model does not open your files. The agent reads them on your computer, and what it reads (files, command output) is sent with your words in the next request to the model you picked, to answer that job.

Reflex Agent and Reflex Mini are answered through our service, which passes each request to the companies that host the models behind it.
Free models are run by companies we do not run, under their own terms, and may learn from what they are sent. With a free model, a web search the agent makes sends the search words to a search service.
A model account of your own, if you add one, gets what you send under your agreement with that company.
A named team agent is Claude Code. What it sends goes out under your own Claude Code account and its terms.

An agent can also reach the internet the way any program on your computer can: read a web page, or run a command that sends data, such as a push to your own code host.

Reflex Ops also asks reflex.riif.com for the newest version number. Each call's cost is counted, and reflex stats shows on your computer what your sessions used and cost.

Private folders and free models

Every folder is private unless you mark it public.

Before each model call, Reflex Ops checks the folder you work in and the top folder of its project. The stricter one wins. If the model is a free model and the folder is not public, nothing is sent and you are told why.
Even in a public folder, nothing is sent to a free model when the message holds something that looks like a key or a token: a private key, a cloud access key, a code-hosting token, a model service key, a chat app token or a payment key.
With a free model, the agent may not read files outside the folder, or key, env (settings) and credential files inside it, and it asks you before each shell command.
This rule is about free models. Reflex models and model accounts of your own may work in a private folder.

reflex folder shows whether a folder is private or public. reflex folder public asks a person at the keyboard to say yes, and refuses when another program runs it. The setting is a plain file in the folder (.reflex/policy), so a program that can write files there can change it. If others or other programs work in that folder, check it with reflex folder.

The design check and films

The design check (reflex design) sends the page, and the files it names inside the project folder (styles, scripts, pictures, fonts, data, video), to our service. The page is drawn there and the report and pictures come back. It never sends key or env files or anything outside the project folder, and it sends at most 24 MB in all, 12 MB a file. An account can run 200 design checks a day.

Films (reflex film):

With our hosted voice, the words of the narration go to our service. --engine local uses your computer's own voice instead, offline.
A generated shot sends its words to our service. The price shows first, and nothing is spent without your yes.
reflex film publish uploads a finished film to your team's page on riif.com. A new film starts as members only.

When this computer works for a team

This applies on a Mac running reflex awake, to named agents, and to a folder set up as a team space. A folder you keep to yourself sends none of this to a team.

To team members' phones, through our service

What was asked, the agent's answer, its to-do list and short step lines such as "Reading index.html" or "Running a command: npm". Never file contents.
The names of the folders and agents this Mac shares. Never their paths.
On a team Mac, every minute it changes, the owners see the last thing asked (up to 160 characters) and the last thing said (up to 200) in up to eight work sessions in the shared folders, Claude Code sessions included.
Our service keeps a finished job for 7 days (or the last 100 on that computer), then deletes it.

Files

An agent can attach a file it made in its folder, up to 10 MB. Only the file's name, size and kind go out. The file itself travels only when a team member who may see that job taps it.

Other things that leave, on purpose

When an owner asks for it, lines that read like rules in CLAUDE.md, AGENTS.md or a README in one shared folder go to the owner's phone. A line that looks like a secret is not sent.
A task in a folder under git runs on its own branch, which is pushed to that folder's own remote if it has one.

In your team's record on riif.com

For each task: the first 200 characters of what was asked, who asked, which agent did it, whether it was checked, what it cost, and whether it waited for a person. Not the answer, and not the files. A question that changes nothing is not written to the record.
In a team space folder, one line per finished session: its title.
A step that waits for a person sends the command it wanted to run (up to 2,000 characters) and the reason, so a person can say yes or no.
Members of the team can read the team's record.

In a team folder, steps that sign in, pay, delete, deploy, or change terms or a public interface wait for a person first. Reflex Ops reads the command, not the inside of every program, so it can miss one.

How long things are kept

Team jobs on our service: 7 days, as above.
A team's record: no end date has been set. If you delete your account, your name comes off the team's entries; the entries stay with the team.
To delete your riif account and what it holds, write to [email protected] from the address you sign in with.

Your key

reflex login shows a code, and you approve it on account.riif.com.
The key is saved in ~/.config/riif/key. On Mac and Linux, only your user account can read that file. Your settings file points to it rather than holding a copy.
Never paste the key into a chat.
reflex logout deletes the key file on this computer. It does not stop the key: to do that, remove the device at account.riif.com/connect.
On a team Mac, run reflex awake off before reflex logout. It uses your key to tell riif the Mac has left its teams.

Spend

A job you start with reflex task stops once its cost passes its cap: 4 dollars unless you set another with --cap. It checks while the job runs, so a job can end a little over the cap. It also stops after 25 minutes unless you set another time.
A session you run by hand has no cap.
Credit, usage and devices are in your account dashboard.

Removing Reflex Ops

From version 0.22.1, reflex uninstall removes only the PATH line the installer added and tells you how to remove the program. It keeps the data, cache and settings folders, because OpenCode uses the same folders; reflex uninstall --remove-shared-data removes them too. Version 0.22.0 and earlier deleted those folders, so update first (reflex upgrade), then uninstall.

To remove it:

On a team Mac: reflex awake off.
reflex logout, then remove the device at account.riif.com/connect.
Run reflex uninstall, then delete the folder ~/.reflex as it tells you. It holds the program. On Windows it is .reflex in your user folder.

Or by hand, on any version: do steps 1 and 2, delete ~/.reflex, then: 4. Remove the two lines the installer added to your shell file (~/.zshrc, ~/.bashrc or ~/.bash_profile): # reflex ops and the export PATH= line after it. With fish, remove the fish_add_path line for .reflex/bin in ~/.config/fish/config.fish. On Windows, remove .reflex\bin from your user PATH (Settings, "Edit environment variables for your account"). 5. Only if you do not use OpenCode: you may also delete ~/.local/share/opencode, ~/.cache/opencode, ~/.config/opencode and ~/.local/state/opencode (your sessions and settings), and ~/.config/riif and ~/.config/riif-connect.

Files reflex kit wrote in a project (.claude/skills/reflex) stay until you delete them.

Who we are

Reflex Ops and R II F are made by Univault Technologies LLC, Salt Lake City, Utah. Questions: [email protected].

Install Reflex Ops. Your team, its rules and its record live at riif.com. The privacy policy is at riif.com/privacy.

Last updated: October 12, 2026