Privacy

This is an operator draft, not a lawyer-reviewed policy. It describes how the current product is built.

Desktop

The desktop app runs the agent on your machine. Provider API keys live in the OS keychain. Runtime telemetry on a user-owned machine is local-only; nothing uploads it.

Account and hosted sessions

Signing in is optional on desktop and required on the web app. Hosted identity is Clerk. Hosted sessions and account data live in Postgres with row-level isolation on the Gambalf server.

Waitlist

Cloud signup is Clerk Waitlist mode. Your email goes to Clerk so an operator can send an invite. There is no second mailing list on this site.

Analytics

We measure this site with PostHog, on their United States infrastructure. Every request goes to this domain first and we forward it, so no third-party script runs on the page and your browser never contacts another company directly — but the measurements themselves are stored in the US.

On these public pages we record page views, which links and buttons get clicked, how fast pages load, and — so we can see where the site confuses people — anonymised recordings of how the page was used. Nobody is identified: we never send a name, an email or an account id with any of it, and typed input is masked out of recordings.

The app is treated differently, on purpose. Inside /app there are no recordings and no automatic click capture, because that would mean sending your prompts, your code and your file names to someone else. What it reports is a page view, load-speed numbers and a few named steps of signing in — nothing else — and the URL is stripped of its query string first so session identifiers cannot travel with it. The desktop app reports none of this at all; its telemetry stays on your machine.