Sidekar does not upload your repositories. The agents you run, Sidekar's REPL included, send what they read to the model provider you chose, as they would without Sidekar.
Signed out, the only request Sidekar makes to sidekar.dev by itself is the update check. About once an hour the daemon sends the version it runs. sidekar config set auto_update false stops it.
After sidekar device login, kv secrets, TOTP, memory and bus messages sync to your other machines through sidekar.dev. They are encrypted with your account key, and sidekar.dev holds that key so a new machine can read them. sidekar config set bus_sync_interval_secs 0 keeps the bus on this machine.
A signed-in daemon also keeps a connection open to relay.sidekar.dev, so your other devices and the chat page can reach this machine's sessions. sidekar config set relay off closes it. A signed-in machine also streams the terminal of each agent you start with sidekar <agent>, the REPL or spawn to the relay, so you can open it at sidekar.dev/sessions (the default, relay auto). --no-relay keeps one agent off it, and sidekar config set relay off keeps all of them off.