Data and AI: what Sapling does with your files

One page, plain sentences, each one checkable by a QA or IT person.

Without an AI#

• Everything stays on your computer. The editor reads and writes the plan (sap.qmd), the protocol files and the metadata next to it, and a folder .sapling/ in your study folder. Nothing is sent to any server.
• No telemetry. The extension has no telemetry, no analytics, no update check of its own and no crash reporting. What we checked in the code of this version: the extension's source (vscode/src/*.ts, vscode/media/*.js) has no network call (no fetch, XMLHttpRequest, WebSocket, http, https or net import); the only network call in the compiler it bundles is the one that sends a request to the AI you configured (below); the page of the visual editor runs under a content security policy with default-src 'none', which also blocks every request from the page; the fonts and the maths library are in the package. You can check it yourself by running VS Code behind a firewall that blocks everything: Sapling works the same.
• The feedback command sends nothing. It makes a text that you copy or save, and you choose whether it contains your plan. If the person who asked for feedback has set an email address or a form address in the setting sapling.feedback.destination, a button opens your own mail program or browser with that text: you send it.
• Programs it starts, on your computer only: Quarto (the PDF), R (the analyses and the Method Lab), SAS (the SAS programs), when you ask for those and they are installed. Without them the editor works; the PDF, the analyses and the lab are not available.
• Node.js is not needed. The compiler runs inside VS Code's own runtime.

With an AI#

An AI is used only when you connect one (the setting sapling.ai.provider: the Claude Code, Codex or Gemini command-line tool with your own login; any OpenAI-compatible address; or a command of your own) and only for the helpers that say "AI". Sapling does not ship a model or a key, and never stores a key: a command-line tool logs in by itself; an HTTP provider reads the one environment variable you name.

• To whom: only to the provider you chose, by the means that provider uses (its program on your computer, or the address you set). Never to the Sapling authors.
• When: at a click (Ask AI, a chat message, a task, a decision interview) and, if sapling.ai.prepare is on (the default), also without a click: when you open a plan, the recommendations of the first open decisions are asked for in the background, so that the interview is quick. Switch it off by setting sapling.ai.prepare to false; the interview then asks only when you open it. sapling.ai.parallel limits how many requests run at once.
• What goes into a request: your wording; the lines of the plan around the place; a short summary of the plan (its block ids and kinds); the names the plan may use (populations, groupings, ADaM variables and labels from the specification or the SDTM metadata); the sentences of the protocol that fit the request; items of the knowledge base; counts from the public SAPs of the corpus (no sponsor text); the errors and review findings of the plan; the house rules; the learned lines; and the attached blocks, sections or findings you chose with @. No data records of a study go in unless you put them in the plan; the Method Lab's results (if you ran the lab) can appear.
• What the house rules and the learned file are: .sapling/rules.md (sentences you write) and .sapling/learned.jsonl (one line per accept, decline, improvement or interview answer: the kind of block, a one-line title, what you said; no data values). Both are plain files on your computer; Sapling: Edit the House Rules and What the Assistant Has Learned open them and the second can clear them. Their relevant lines go into later requests.
• Where answers are kept: .sapling/proposals.json, .sapling/chat.json and .sapling/recommendations.json in your study folder, as readable text.
• A company's own model: set sapling.ai.provider to openai-compatible, sapling.ai.baseUrl to the address of the company's gateway or local server (Ollama, LM Studio), and sapling.ai.apiKeyEnv to the name of the variable that holds its key; or use command with a command your IT team provides (the instructions and the request arrive on its standard input, the answer leaves on its standard output). Nothing else leaves the machine.
• No AI allowed: set sapling.ai.provider to none. Every AI button is hidden or replaced by its form; the interview, the proposals from the rules and the templates all work. Setting the environment variable SAPLING_NO_AI=1 has the same effect.

An AI never approves a plan, never answers a decision for you and never writes your name: a person decides.