Telemetry and privacy
The app
Section titled “The app”Zero telemetry by default. No analytics SDK in the client, ever.
That is quoted from the project’s engineering rules, and it is checkable in the most boring way possible: there is no analytics or crash-reporting dependency in any manifest in the repository. Not disabled — absent.
There is no crash reporter today. If one is ever added it will be opt-in, scrubbed through the same redacting rules invariant 4 already requires, and it will show you exactly what is about to be sent before sending it.
Server-side we keep operational metrics — request counts and latency. Request bodies are never logged, which invariant 4 makes non-negotiable and which the workspace lints enforce by denying print statements outright.
What the server necessarily stores
Section titled “What the server necessarily stores”Being unable to read your values does not make the server blind:
| Stored | Readable by us? |
|---|---|
| Your account email | Yes |
| Project and environment names, and their display order | Yes |
| Payload sizes and version counts | Yes |
| Who read or wrote which environment, and when | Yes |
| Public keys | Yes — they are public |
| Every secret value | No — ciphertext |
| Every note | No — ciphertext |
| Wrapped environment keys | No — opaque |
| Your private key | No — encrypted under a key we never see |
| Your recovery backup | No — encrypted under a key we never see |
Content is opaque. Existence and activity are not. An environment named
acme-prod-stripe-live tells us something even though every value inside it is
unreadable — so name things with that in mind if it matters.
Encrypting names was considered and rejected for now, because it makes invitations and administration meaningfully worse while sizes and timing would still leak. It is listed as an accepted limitation in the threat model rather than glossed over.
What we would hand over
Section titled “What we would hand over”If compelled by valid legal process, what exists to hand over is the table above: metadata, and ciphertext we cannot decrypt. We cannot produce plaintext — not because of a policy, but because the key that would decrypt it has never been on our infrastructure.
That is the practical difference between “we can’t look” and “we won’t look”.
This website
Section titled “This website”- No cookies. None are set, on any page.
- No analytics. No beacon, no pixel, no tag manager.
- No third-party requests at all. Fonts are self-hosted rather than loaded from a font CDN — which matters, because a font request on a page making this claim would make the claim false. A build check fails on any script, stylesheet, image, iframe or preconnect pointing off this domain.
- Outbound links are links, not loads. The pricing page cites other
companies’ pricing pages; nothing is fetched from them unless you click, and with
Referrer-Policy: no-referrerfollowing one tells them nothing about where you came from. - No prefetching. The docs are configured not to speculatively fetch pages you did not ask for.
- No form. Early access is a
mailto:link, so there is no submission endpoint and no list of addresses sitting on a server. If you email us, we have your email — that is the whole data flow, and you initiated it.
The one thing docs pages store locally is your theme choice and which sidebar sections you expanded, in your own browser’s storage. It carries no identifier and never leaves your machine.
Telling you about that is more useful than claiming a zero that isn’t quite true.