What Rebates can and cannot see.
The short answer is that Rebates does not read your code. The longer answer is worth reading anyway, because “we respect your privacy” is what every tool says. Here is what the code actually does, field by field — including the one place where the guarantee is best-effort rather than absolute.
Does Rebates read your code?
No. The default sponsored footer collects nothing about what a developer is writing. A footer line does not need it in order to render. That distinction matters more than a privacy policy does. A policy is a promise about what an operator will do with data it has already collected. The default Rebates flow has no collection step at all. There is nothing to promise about, nothing to audit, and nothing to leak. Rebates never opens your files. Rebates never scans the filesystem. Rebates never uploads a session transcript. Declining every optional feature on this page is always allowed and never penalised — no sponsor is withheld and no rate is docked for it — though earnings are a 90% share of realized ad revenue, which targeting can move.
- Your source files. Rebates does not read, open, or scan the filesystem.
- Your session transcripts. Nothing is uploaded by the default sponsored footer.
- Fenced code blocks. Contextual mode strips them before anything else runs.
- Credentials. Lines mentioning tokens, secrets, passwords, or DATABASE_URL are dropped.
- API keys by shape. Strings starting sk-, pk-, ghp_, gho_, github_pat_, or xox are removed.
- Personal data and names, redacted on your machine before any request leaves it.
What does Rebates send in contextual mode?
Contextual sponsors are a separate mode that a developer switches on deliberately, and it is the only path where any session text is involved at all. Even then the payload is deliberately small: at most two short prose fields, each capped at 1,600 characters, with code, credentials, and personal data removed before either field is built. Nothing else is attached — no file paths, no repository names, no environment values, no identifiers describing the project. The table below is the complete list of what can travel, not a summary of it.
| Limit | What it means |
|---|---|
| Two prose fields, at most | Contextual mode sends currentUserMessage and lastAssistantResponse. There is no third field, and no file, path, or repository identifier travels with them. |
| 1,600 characters per field | Each field is truncated at 1,600 characters. A long session cannot turn into a long upload, because the cap applies after redaction, not before. |
| Prose only, line by line | Every line is classified before it is kept. Lines that look like code — const, function, import, export, class, or markers such as => and === — are discarded rather than redacted. |
| Nothing, when nothing survives | If redaction leaves too little real prose behind, the field is sent as null. A message that was only machine data produces no contextual message at all. |
The redaction behaviour is versioned as rebate-ad-context-v3, so it is pinned rather than drifting quietly between releases.
Where does the redaction happen?
On your machine, before any network request is made. The redaction runs inside the Rebate CLI itself, which means the unredacted text never leaves the device rather than being cleaned up after it arrives. That ordering is the whole argument. A service that redacts on its own servers has already received the original text, and its promise to discard the original afterwards is worth exactly as much as the operator behind it. Redacting locally removes the need to extend that trust at all, because the sensitive version was never transmitted.
You do not have to take this on faith, either. Run rebate plan to print every local change before it is applied, and rebate off to restore your Claude Code and Codex settings byte-for-byte. The same five-question checklist we would apply to any competitor is on the legitimacy page, and it applies to Rebates too.
What can Rebates not promise?
That best-effort redaction catches everything, every time. The default flow carries a hard guarantee because no context is collected at all, and a thing that is never collected cannot leak. Contextual mode is different in kind. It combines pattern matching with a machine-learning pass over free text, and no system of that shape is perfect. Prose that reads like ordinary prose but carries a novel secret format could survive the filter. That residual risk is precisely why contextual mode is opt-in, why the payload is capped at two short fields, and why declining it is never penalised — earnings follow realized ad revenue, and targeting can move that, but saying no never costs a developer a sponsor.
We would rather write this down than let you discover it later. If the residual risk is unacceptable for your work — regulated code, client repositories, anything under NDA — decline contextual sponsors and keep the default. Nothing about your account is downgraded for it. For the formal treatment of data handling, retention, and your rights, read the full Privacy Notice.
Straight answers about terminal-ad privacy.
Does Rebates read your code?
No. The default Rebates flow reads no code, no files, and no transcripts, because a sponsored footer line needs nothing about what a developer is writing in order to render. This is a structural guarantee rather than a policy promise: there is no collection step in the default path to trust or audit. Contextual sponsors are a separate, opt-in mode. Even in that mode, fenced code blocks are stripped first, and individual lines that look like code are discarded rather than redacted. Declining contextual mode is always allowed and never penalised: no sponsor is withheld and no rate is docked for saying no. Earnings are a 90% share of realized ad revenue, though, and targeting can move what an impression is worth, so the honest claim is that declining costs nothing as a matter of policy rather than that it cannot affect the number.
Are terminal ads safe to run?
A terminal ad tool is as safe as what it reads and how completely it uninstalls. Check those two things on any tool rather than trusting the category. Rebates changes only Claude Code and Codex settings files. Those files are backed up byte-for-byte before anything is written. Every change is previewable through the plan command first. The Rebate CLI does not execute your code. The Rebate CLI does not scan your filesystem. The Rebate CLI adds no network round trip to the agent loop. Running the off command restores the original settings exactly. The worst realistic outcome of trying Rebates is returning to the configuration that existed beforehand.
What does Rebates actually send in contextual mode?
At most two short prose fields: the current user message and the last assistant response. Each field is capped at 1,600 characters. Before either field is built, fenced code blocks are removed, lines resembling code are discarded, credential-bearing lines are dropped, and personal data and names are redacted by an on-device pass. No file paths, repository names, or environment values are attached. If redaction leaves too little genuine prose, the field is sent as null instead. The redaction logic is versioned as rebate-ad-context-v3, so the exact behaviour is pinned rather than drifting silently between releases.
Where does the redaction happen?
On your own machine, before any network request is made. The redaction runs inside the Rebate CLI, which means unredacted text never leaves the device rather than being cleaned up after arrival. This ordering is the part that matters. A service that redacts server-side has already received the original text, and a promise to discard it afterwards is only as good as the operator. Redacting locally removes the need to trust that promise, because the sensitive version was never transmitted in the first place.
What can Rebates not promise?
That best-effort redaction catches everything, every time. The default flow carries a hard guarantee, because no context is collected at all and there is nothing to leak. Contextual mode is different in kind: it is pattern matching plus a machine-learning pass over free text, and no such system is perfect. Prose written to look like prose but containing a novel secret format could survive. That is exactly why contextual mode is opt-in, why the fields are capped and limited to two, and why declining it is never penalised — though earnings follow realized ad revenue, and targeting can affect that. If the residual risk is unacceptable, decline it.
Keep your code to yourself.
The default flow never reads it. Install in one command, preview first with rebate plan, and leave contextual sponsors off if you want.
curl -fsSL https://rebates.ai/install | bash