Remediation

Hard veto. Then rotate.

The /privacy command did not stop uploads. The Improve-the-model toggle did not stop uploads. Local config.toml is the gate that still belongs to you.

Local hard veto

disable_codebase_upload = true in ~/.grok/config.toml. This is the last gate in the upload pipeline.

Defense in depth

GROK_TELEMETRY_TRACE_UPLOAD=false and GROK_TELEMETRY_ENABLED=false in the shell profile.

Rotate secrets

If Build ran against a folder with keys, assume they left the machine. Rotate all of them.

Re-verify after updates

Client auto-updates. Re-run verification. Do not trust a silent server flag as the permanent fix.

Copy and run

~/.grok/config.toml

[features]
telemetry = false
codebase_indexing = false
feedback = false

[telemetry]
trace_upload = false
mixpanel_enabled = false

[harness]
disable_codebase_upload = true

Shell profile (defense in depth)

export GROK_TELEMETRY_TRACE_UPLOAD=false
export GROK_TELEMETRY_ENABLED=false

.grokignore

.env*
*.pem
*.key
*.crt
*.p12
*secret*
*password*

Check whether a repo was uploaded

cat ~/.grok/logs/unified.json | grep repo_state.upload

Stop processes and drain the upload queue

pkill -f "grok "
du -sh ~/.grok/upload_queue
rm -rf ~/.grok/upload_queue/*

Community verification

git clone https://github.com/wetlink/grok-build-privacy-hardening.git
cd grok-build-privacy-hardening
./verify.sh

Search the open web for your chats

site:grok.com "<a unique phrase from your chat>"

Mark it done Self-protection