Privacy

This public documentation site

mdflow.dev serves public documentation, source facts, and a client-side interactive demonstration. Workflows execute only through the local CLI; the website serves read-only documentation and source facts. The demonstration runs in your browser. The site's checked-in application code does not integrate an analytics SDK or an advertising tracker. That statement does not establish what infrastructure logs or platform-level services a hosting provider may operate.

The site is hosted on Vercel. Like other web hosts, the hosting infrastructure receives request information such as an IP address, requested URL, and browser headers to deliver pages and operate the service. Retention and processing at that layer are governed by the provider's configuration and Vercel's privacy policy; this repository does not establish a retention period or a guarantee that requests are never logged.

Browser storage and external requests

The homepage's optional interactive easter eggs store progress in your browser's local storage under mdflow-eggs, mdflow-puzzle, and mdflow-golden. A mdflow-nudge session-storage flag remembers whether a hint has been shown. This is local interface state, not a website account. Clear this site's browser storage to remove it; doing so resets that progress.

The homepage serves its font files locally. Article pages request fonts from Google Fonts, which exposes the usual web-request information to Google; see Google's privacy policy. Following a GitHub, npm, or other external link sends you to that service under its own policies. No claim is made that those third parties share this site's practices.

Running the local CLI

The mdflow CLI is a separate local program. Flows may read files, resolve remote imports, run commands, invoke context providers, and launch the engine you configured. That engine may send prompts, selected context, and outputs to its provider according to your credentials, settings, and the provider's terms. A free CLI license does not make provider processing offline or private.

Local flow logs, feedback, eval receipts, and evolution artifacts can contain sensitive project information. Review them before sharing; private local state is not the same thing as encrypted storage. Review untrusted flows and executable sidecars, limit credentials, and use a disposable environment when appropriate. Engine context isolation is not a host filesystem, network, environment, process, or credential sandbox. See the security policy and contact page for reporting concerns.