Data & security

Data ownership is a precondition, not a feature: a single-file database you can move or export, with no account and no telemetry.

Data directory

How you run it	Location
Desktop (Windows)	`%LOCALAPPDATA%\Hetu`
From source	`HETU_DATA_DIR`, otherwise `hetu.db` in the working directory
Database	`hetu.db` (plus `-wal` / `-shm`)
Logs	`logs/`, Serilog daily rolling, 7 days retained
Vector extension	`sqlite-vec/vec0.dll` (`vec0.so` elsewhere), loaded when the connection opens

Backup and migration

Settings → Data & backup: export all notes as a Markdown archive, back up or restore the database file.
To move machines, quit the app and copy the whole data directory (including the WAL file).

Copying the database file while the app runs can lose uncommitted WAL content. Prefer quitting first, or use the built-in backup.

Environment variables and config keys

Name	Purpose
`HETU_DATA_DIR`	Data directory (database and logs); injected by the desktop shell
`HETU_PARENT_PID`	Shell process id; the backend exits when its parent disappears
`HETU_API_DEV_PORT`	In dev mode, reuse an existing backend on this port
`DatabaseProvider` (appsettings)	`Sqlite` (default) / `Postgresql`
`ConnectionStrings:DefaultConnection`	Connection string; SQLite defaults to `Data Source=hetu.db`
`Embedding:Dimensions`	Vector dimensions (default 1536) — must match the embedding model
`WorktreeConfig` (stored setting)	Worktree root directory
`WorktreeCleanupConfig`	Cleanup interval, idle threshold, delete branch
`CloseToTray`	Whether closing the window minimizes to the tray

Switching to PostgreSQL

export DatabaseProvider=Postgresql
export ConnectionStrings__DefaultConnection="Host=localhost;Database=hetu;Username=postgres;******"

dotnet ef database update \
  --project src/Hetu.Infrastructure.PostgresMigrations \
  --startup-project src/Hetu.Api

PostgreSQL 16+ with the pgvector extension is required. Both databases support the same features, but data does not transfer: rebuild notes and indexes in the new database.

Vector storage

Database	Approach	Dimensions
SQLite	`sqlite-vec` `vec0` virtual table keyed by rowid, alongside metadata tables	From `Embedding:Dimensions`, default 1536
PostgreSQL	`pgvector` column with an index	Same setting

Security boundaries

Item	Implementation
API keys	Encrypted with ASP.NET DataProtection (DPAPI-backed on Windows); never written to logs or API responses in plaintext
SSH credentials	Encrypted the same way
Outbound requests	Only to providers you configure and to search / MCP services you explicitly enable; no telemetry
Markdown rendering	Sanitized with DOMPurify so note content cannot inject scripts
Command execution	Governed by permission modes (plan / readonly / ask / auto / bypass); risky operations require confirmation by default
Share links	Expose a single rendered note, can be revoked, and record view counts
SQL injection	All access goes through EF Core parameterized queries