Protecting your data is the first principle Cmdr is built on. This page describes what that means in practice, and where the limits are. It’s the detail behind section 3 of our terms.
Replacing a file
When Cmdr replaces an existing file, it writes the new version to a temporary file alongside it and swaps it in only once every byte has landed. An interrupted write doesn’t leave a half-written file wearing your filename.
One case can’t work that way: replacing a file with a folder, or a folder with a file, across two different devices. There’s no way to swap types atomically across two storage backends, so Cmdr removes the destination first. It tells you before it starts.
An overwritten original isn’t recoverable afterwards. Cmdr doesn’t keep a hidden copy of what you replaced.
Deleting
Deleting asks first, every time, and nothing in Cmdr’s settings turns that confirmation off. Where the filesystem has a Trash, that’s the default and the dialog says so. On a filesystem without one (network shares, FAT32 and exFAT, phones over USB, inside an archive) the delete is permanent, and the dialog warns you before it runs.
The one way past the confirmation is Cmdr’s MCP server, which lets an outside AI client drive the app. It’s off by default, and a client needs the access token to use it. If you turn it on and share that token, that client can delete without the dialog.
Long-running work
File operations show honest progress, and you can pause or cancel them at any point, including after you’ve sent them to the background. Canceling stops the remaining work. It doesn’t undo what already finished, and a delete can’t be undone at all.
Not everything in Cmdr is cancelable. Installing or removing a local AI model has to finish once it’s underway, and background indexing has no cancel button (you can switch indexing off per drive in settings).
How we test this
The data-writing paths carry a large automated test suite, including deliberately hostile cases: a transfer killed partway through, a device disconnected mid-copy, a backend that fails on demand, and cancels and rollbacks at every stage. Where the OS can tell us, free space is checked before an operation starts.
What this isn’t
This describes how Cmdr works today and how we intend to keep building it. Features change, so the app itself is the authority on how it behaves right now, not this page. It isn’t a warranty that nothing will ever go wrong.
Cmdr copies, moves, renames, and deletes real files on real disks, sometimes across a flaky network, on operating systems that change underneath it. No software is free of defects, so we can’t guarantee the safety of your data. Cmdr is a file manager, not a backup tool, and it isn’t a substitute for one. Please keep current backups of anything you’d be upset to lose, and check now and then that you can actually restore from them.
If something goes wrong
If Cmdr loses or corrupts a file, we want to know, quickly and in detail. Write to [email protected] with what you were doing and what happened, or use Help > Send error report… in the app, which shows you what the report contains and a preview of the log before anything leaves your machine. Paths and personal details are stripped first, and your email address is included only if you add it.
Data-loss reports go to the front of the queue, and when we find a bug we ship the fix to everyone through Cmdr’s built-in updater. We’re describing our practice, not offering a warranty on top of the rights you already have by law, and it isn’t a promise you can make a claim on.