Performance and Privacy

Syntalume is designed around explicit budgets and local work, not an absolute "no startup cost" promise.

Performance#

  • Color themes, file icons, and product icons load declaratively with no code execution.
  • The small runtime activates lazily at onStartupFinished, after VS Code's own startup path. It registers commands but claims no idle status-bar space; the single optional Syntalume entry exists only while Environment Guard or a Review Session has state to show. Enabled optional tools then initialize only the work they need.
  • Desktop and browser entry points record the duration of the actual activate() registration path. Desktop also records its non-negative heap delta. Integration QA reads those in-memory measurements for release-budget assertions; they contain no workspace or user data and are never sent.
  • Release gates cap the generated desktop bundle at 340 KiB and the browser bundle at 302 KiB. Separate desktop-only YAML and file-lock helpers are capped at 140 KiB and 24 KiB and load only when their features need them. The browser ceiling includes the same bounded, fail-closed exact-reset safety checks as desktop. The real VS Code integration suite budgets extension activation below 2 seconds and activation heap growth below 32 MiB on the CI runner. These are ceilings, not claims that every machine has identical timings.
  • Representative theme, icon, language, diff, terminal, and JetBrains resource outputs have deterministic visual baselines; changing one requires an explicit baseline update.
  • Enabled ambience survives a restart instead of resetting each session.
  • Tooling setup commands only write VS Code settings and optionally open/install companion extensions after user confirmation.
  • Focus Field decorates visible ranges only.
  • Edit Heatmap caps files, lines, and age.
  • Blame Ghosts debounces cursor movement and caches results.

Privacy#

  • No telemetry.
  • Paid licenses are periodically verified with Polar in the background; project data is not sent.
  • Trial use is checked locally. Paid access requires online activation and periodic validation after consent. A previously verified license can continue for up to 72 hours during temporary connection/service failures, bounded by its known expiry. Confirmed revocation does not receive this grace. See Privacy.
  • No secret scanning.
  • No source upload.
  • No passive review or feedback prompts. Support links run only when you choose them and let you inspect the copied or prefilled payload before submitting.
  • The optional JetBrains Companion reads .syntalume/profile.json first, with .auralis/profile.json as a legacy fallback, only when you inspect or apply it. Accepted appearance values are stored in normal local IDE/project component state and a locally derived editor scheme; no project file is edited and project metadata is not transmitted. Licensing requests are handled separately by the standalone Theme’s licensing service. Exact reset fingerprints public scheme settings so later manual edits are preserved.
  • The Setup Dashboard can show two aggregate activity counts: explicit Tune applies and shared profile recommendations you chose to apply. They contain no timestamps, project names, paths, or settings; they stay in this VS Code installation's local extension storage, are never transmitted, and can be cleared from the dashboard at any time.
  • Blame Ghosts runs local git blame only when enabled by the user and only in trusted local workspaces. restrictedConfigurations keeps the blame settings from taking effect until the workspace is trusted.
  • Syntalume Doctor only checks whether optional companion CLIs are available on PATH, and only in trusted workspaces; it does not run formatters or linters against your source files.
  • The Setup Dashboard webview is locked down: a crypto-strong per-render nonce, localResourceRoots: [], retainContextWhenHidden: false, and a default-src 'none' Content-Security-Policy. It loads no external or local resources.
  • Accessibility Lab uses a locked-down, local-resource-free webview. Icon Studio's equally locked-down webview can read only Syntalume's packaged icon directory so it can render its inventory; it cannot read workspace files. On desktop, Apply rewrites only the bounded contributed Studio manifest and SVG directory inside the installed extension. Presets and reports stay local until you explicitly copy or save them.
  • License keys use editor secret storage and the provider's activation identifiers. Trial timing uses a durable record and secure-store backup. See the full Privacy Policy.
  • Activation metrics separate licensing work from feature startup and retain total elapsed time. The trial notice does not block editor startup.

Supported execution environments#

The paid release supports native VS Code-compatible extension hosts, including supported server-based hosts, and JetBrains. Browser-only extension hosts such as vscode.dev/github.dev are excluded until shared browser licensing is ready. Remote native hosts need persistent writable storage and may consume a separate activation. Virtual workspaces still omit features that need local files or tools.