Zcode was found to be uploading the entire workspace and Git history to its servers for storage without the user’s consent.
Simply logging in with a Zhipu account triggers the process of packaging, encrypting, and uploading the data. The encryption key is stored only on Zhipu’s servers and is not kept locally, meaning that only the servers can decrypt the files. Zhipu’s privacy policy does not mention this, and ZCode’s built-in „Optimize Experience“ feature cannot be disabled to stop the uploads.