# Control privacy Canonical: https://hypaware.ai/docs/cli-reference/control-privacy ```text hyp privacy [args...] ``` Use `hyp privacy --help` to list privacy operations: ```sh hyp privacy --help ``` Directory classes are `sync`, `local-only`, and `ignore`. A policy marking is prospective; it doesn't delete rows already in the cache. Use purge only when you intend to delete existing local data. ## `hyp privacy show` ```text hyp privacy show [path] [--json] ``` Resolves the governing class and source for a path, which defaults to the current directory. It also reports a best-effort residual cache count. ```sh hyp privacy show . --json ``` ## `hyp privacy set` ```text hyp privacy set sync|local-only|ignore ``` Upserts an exact host-local path marking. It doesn't write a dotfile or delete rows. An `ignore` marking prints a line naming `hyp privacy purge --ignored`, which deletes what was already recorded in every ignored folder. ```sh hyp privacy set ./private-research local-only ``` ## `hyp privacy unset` ```text hyp privacy unset [sync|local-only|ignore] ``` Removes host-local entries governing the path. Add a class to remove only entries of that class. The operation is idempotent and doesn't delete rows. ```sh hyp privacy unset ./private-research local-only ``` ## `hyp privacy list` ```text hyp privacy list [--json] ``` Lists host-local path and client policy plus the new-folder prompt preference. It can't globally enumerate `.hypignore` files; use `hyp privacy show PATH` for a specific path. ```sh hyp privacy list --json ``` ## `hyp privacy ignore` ```text hyp privacy ignore [path] ``` Writes a shareable `.hypignore` file in an existing directory at the explicit path. With no path, uses the repository root, or the current directory when outside a repository. Use `hyp privacy set sync|local-only|ignore` for host-local markings and `hyp privacy show [path]` to report without writing. The receipt names `hyp privacy purge --ignored` to delete what was already recorded in ignored folders. ```sh hyp privacy ignore ./customer-data ``` ## `hyp privacy unignore` ```text hyp privacy unignore [path] ``` Removes the nearest governing `.hypignore`. Use `hyp privacy unset ` to remove host-local markings. It does not remove cached rows. ```sh hyp privacy unignore ./customer-data ``` ## `hyp privacy client` ```text hyp privacy client [] [sync|local-only] [--json] ``` Lists or changes per-client export policy. `local-only` withholds future rows from remote sync. Returning to `sync` affects future rows only: the policy flip itself syncs nothing that was withheld. To sync that retained history, run the separate, separately confirmed `hyp sync --history `. A client required by central configuration can't opt out. ```sh hyp privacy client codex local-only ``` ## `hyp privacy folders` ```text hyp privacy folders [ask|sync] [--json] ``` Reports or changes whether unclassified folders sync by default or prompt once for classification. Existing markings and `.hypignore` files don't change. ```sh hyp privacy folders ask ``` ## `hyp privacy purge` ```text hyp privacy purge | --session [--remote | --local-only] | --ignored | --all [--yes] [--json] ``` **Warning:** This operation permanently deletes matching rows from this host's local cache. Select exactly one target. Every form also sweeps the Claude raw-body spool so pending bodies can't recreate deleted rows. A terminal prompts for confirmation; a non-interactive call requires `--yes`. A `--session` purge also deletes that session's rows from every configured or signed-in remote and every enrolled server, and excludes the session from future recording. `--remote ` limits the remote scope to one server; `--local-only` skips servers. The two flags are mutually exclusive and apply only with `--session`. Remote deletion uses your login credential and requires the session owner or an organization admin. Physical files remain until compaction, and copies in published reports aren't covered. With `--json`, each entry in a `--session` purge's `local.cache_cleanup` admits background file cleanup for one cache partition; it is not a durable deletion certificate. Its `job_id` names the partition (`job_scope: "cache_partition"`), so a later purge of the same partition reuses it. The cleanup status API reports `completed` only until maintenance retires the finished cleanup, with no minimum window, and `unverified` after that. `unverified` means the completion can no longer be certified, not that cleanup failed or that the files remain. The ``, `--ignored`, and `--all` targets purge locally only. They never contact a sink or HypAware Cloud and can't retract exported copies. ```sh hyp privacy purge --session SESSION_ID hyp privacy purge --session SESSION_ID --local-only ``` Replace `SESSION_ID` with the reviewed session ID. Avoid `--yes` during manual work. A remote failure returns a nonzero exit status; repeat the command to finish an incomplete purge.