Skip to content
Fito

Your data and privacy

Fito holds less about you than most learning tools, and the reason is architectural rather than promised. The part of the product that reads your code runs on your machine, so the server never receives it.

This page states what is true of the code today, not what a policy hopes for.

No LLM keys exist on the Fito server

Section titled “No LLM keys exist on the Fito server”

Every AI turn in Fito runs on your own LLM subscription, on your own machine. The tutor, the rubric scoring and the quiz scoring are all agent turns in your pi session, paid for by your own provider account.

The server holds no LLM API key of any kind, because it never makes a model call. That is not a setting an operator can switch on; there is no code path that would use one.

The tutor is also scoped, not merely instructed. It receives the case’s briefing documents and the knowledge components that case references, and it cannot reach the exemplar solution, the quiz answer key or the rubric’s scoring key — see Ask the tutor.

Two things follow, and both are worth being clear about:

  • Your code and your prompts never pass through Fito’s server. What reaches it is the score, not the work that earned it.
  • Your model provider does see them, under whatever terms you agreed with them. Fito moves that relationship to you; it does not remove it.

What the server keeps about your identity

Section titled “What the server keeps about your identity”
What How it is kept
Your password A bcrypt hash, cost factor 12. The plaintext is never stored and never logged.
Your refresh token Only a SHA-256 hash. The usable string exists only in your hands.
Your access token Not stored at all. It is a short-lived signed token, checked on each request.
Your GitHub access token Encrypted at rest with AES-256-GCM, under a key held by the operator.
The OAuth state of a login in flight Not stored. It is signed and time-limited, and expires in about ten minutes.
LLM API keys None exist.

A refresh token is single-use: refreshing revokes the old one and issues a new one. Expired rows are deleted nightly.

What GitHub gives Fito, and what it does not

Section titled “What GitHub gives Fito, and what it does not”

Linking GitHub grants Fito read:user and user:email. That reads your public profile and your email address.

It cannot push code, create a fork or open a pull request. All of that is done by your own local gh, with your own credentials. Fito’s link exists only to answer one question at submit time: is the account that opened this pull request the account that owns this Fito profile?

What stays on your machine

Section titled “What stays on your machine”
Client What it holds
Web app Your access token in memory only, so it does not survive a page reload. Your refresh token in the browser’s local storage, so a reload can sign you back in.
Terminal Both tokens as JSON in ~/.fito/credentials, file mode 0600, directory mode 0700.
Case checkouts Your work, under ~/.fito/cases/<case-id>/, plus your fork on GitHub.

Your password is never written to ~/.fito/credentials. The login flow hands back tokens, never the credential that minted them. A leaked copy of that file expires on its own.

The browser-to-terminal handoff at login is narrow by construction: a single-use secret minted for that login, checked before the request body is read, and a local server that accepts one origin. Nothing in that exchange leaves your machine.

What Fito records about your learning

Section titled “What Fito records about your learning”
  • Your proficiency, per knowledge component. This is the point of the product — see Bloom levels and proficiency.
  • Your submissions: the pull request URL, when you submitted, which version of the case you solved, and the result of each rubric criterion and quiz question, with the reviewer’s reason.
  • When you open a case, so a case’s author can see whether people finish it.

Your own assessments are private to you. On a case’s page, the Competencies assessed and Your submissions sections are scoped to your account, and they never expose another learner’s work.

The usage figures on a case cover — opens, submissions, completion rate, median time — are public and aggregate. They count acts and people, and they name nobody.

What Fito records about your visits

Section titled “What Fito records about your visits”

Beside what you learn, Fito keeps a log of the requests that reach its server. It is what the platform’s own dashboards are built from, and it is the part of this page a reader is least likely to guess.

Every request that reaches the application writes one row, carrying which route was asked for, the method, the status it answered with, how long it took, your IP address and your browser’s user agent.

Three things about that log are worth stating plainly:

  • It records signed-out visits too. Those rows carry no account, and no visitor identity is invented to link them to each other.
  • The route is a template, /cases/{id} rather than the path you actually asked for, so an id never becomes part of what the log groups by.
  • The row’s detail is a short, fixed set of fields. It never carries your password, your tokens, an OAuth code or state, a pull request URL, anything you submitted, the text of a curation claim, or a rubric or quiz answer key. That list is enforced by a test rather than left to review.

Four things are not recorded at all:

  • Request bodies. By the time a row is written, the body has been read and is gone.
  • Anything that stays in your terminal. Your pi session, your tutor turns and your local work never cross the API, so nothing about them is logged.
  • Anything that stays in your browser.
  • A request the security layer rejects before the application — an unknown address, or a malformed token.

The same log read from the operator’s side is Admin dashboards.

Taking your credentials back

Section titled “Taking your credentials back”
  • /fito-logout deletes ~/.fito/credentials and revokes the refresh token on the server.
  • Deleting the file yourself removes the local copy. Run /fito-logout instead when you also want the server-side token gone.
  • Signing out of the web app revokes the refresh token rather than only forgetting it.

What this page does not cover

Section titled “What this page does not cover”

How a Fito server is deployed, and what an operator does when a key leaks, are operator concerns rather than learner ones. They live in the repository’s own architecture documentation.

What’s next

Section titled “What’s next”