From 124b65a9d422fd163ef230878420f1a24e6f7d3c Mon Sep 17 00:00:00 2001
From: Eddie A Tejeda <669988+eddietejeda@users.noreply.github.com>
Date: Tue, 27 Oct 2026 15:52:03 -0700
Subject: [PATCH 1/2] README: list what the plugin runs, sends, and fetches

The directory asks whether a plugin sends data to other services and
expects the answer in the README.
---
 README.md | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/README.md b/README.md
index 14ccaaf..34576fc 100644
--- a/README.md
+++ b/README.md
@@ -69,6 +69,26 @@ per task than agents sharing a folder, through extra round trips rather than the
 The guard is a refusal rather than advice because the benchmark found that refusals held
 and instructions did not.
 
+## What it runs, sends, and fetches
+
+- **Hotdata, through the `hotdata` CLI.** Every command calls the CLI, which talks to
+  the Hotdata API (`https://api.hotdata.dev/v1`) with your Hotdata login. It sends the
+  files you load, the SQL you run, and the definitions you save, and Hotdata stores
+  them in your workspace until you delete them.
+- **Saved queries, directly.** Definitions use the REST API the CLI does not expose:
+  `scripts/api.py` sends `HOTDATA_API_KEY` to `https://api.hotdata.dev/v1/queries`
+  (or `HOTDATA_API_URL`). It reads the key from the environment, or from
+  `~/.hotdata/api-key` when the environment has none, and sends it nowhere else.
+- **SessionStart hook.** It runs `hotdata auth status` once per machine, prints the
+  cached orientation, and refreshes that cache in the background: CLI calls read the
+  project's tables and a sample of rows, and the saved-query API reads its definitions. The cache lives in
+  the plugin's data folder (`~/.claude/hotdata` outside Claude Code).
+- **PreToolUse guard.** It checks file sizes on your machine and sends nothing.
+- **`tabular-memory demo`** asks Hotdata to load a public NYC taxi sample from
+  `https://d37ci6vzurychx.cloudfront.net`.
+
+The plugin installs nothing and collects no telemetry.
+
 ## The model
 
 **One database per project.** The project is named by its repository root, so every

From e9820a69bda239c4f515fcf708ba67a2a3de7961 Mon Sep 17 00:00:00 2001
From: Eddie A Tejeda <669988+eddietejeda@users.noreply.github.com>
Date: Tue, 27 Oct 2026 15:53:38 -0700
Subject: [PATCH 2/2] README: the refresh also caches date ranges and recent
 query history

---
 README.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 34576fc..1169b1f 100644
--- a/README.md
+++ b/README.md
@@ -81,7 +81,8 @@ and instructions did not.
   `~/.hotdata/api-key` when the environment has none, and sends it nowhere else.
 - **SessionStart hook.** It runs `hotdata auth status` once per machine, prints the
   cached orientation, and refreshes that cache in the background: CLI calls read the
-  project's tables and a sample of rows, and the saved-query API reads its definitions. The cache lives in
+  project's tables, a sample of rows, date ranges, and recent query history, and the
+  saved-query API reads its definitions. The cache lives in
   the plugin's data folder (`~/.claude/hotdata` outside Claude Code).
 - **PreToolUse guard.** It checks file sizes on your machine and sends nothing.
 - **`tabular-memory demo`** asks Hotdata to load a public NYC taxi sample from