It doesn’t upload code (it’s not meant to, anyway); it uploads coding agent transcripts. It’s meant to be a fun app like Spotify wrapped - that’s how it was described when presented internally.
It's very common nowadays to claim that something doesn't have access to X when it does in fact have system level access to X, but the application code just doesn't use X (or a prompt is being asked not to use X).
>curl -fsSL https://paxel.ycombinator.com/upload.sh | bash
Point in case.
Trustworthy people will ask you to give them the right amount of access, they won't ask you for infinite access and ask you to trust them that they won't use it. Would you trust a contractor that asks for root, and your master password when they could have requested a specific user or some specific files?
[dead]
But to generate those transcripts the tool does upload your code to an LLM of its choosing
;)