Privacy

The CLI

activate-agentmd runs on your machine. lint, audit, pins, bundle, review, extract, sync and analytics send nothing to Agent.md. audit downloads files from public GitHub repositories you name; extract uses your own Anthropic key and talks to Anthropic directly.

Usage counters are off unless you turn them on. When on, each event carries only: the event and command name, whether it succeeded, a duration bucket, a finding count, the CLI version, the Node.js major version, the platform, whether it ran in CI, a random ID made on your machine, and the send time. No paths, file contents, repository names or IP-derived data are kept. DO_NOT_TRACK or AGENTMD_TELEMETRY=0 turns them off. Events are written to our server log, not a database.

This website

Browsing the registry needs no account and sets no analytics or advertising cookies. Our hosting providers keep standard request logs (IP address, user agent, time) for security and debugging, under their own retention.

If you sign in with Google or GitHub, we store the name, email address, profile image and account ID that provider shares, so you can save presets and write reviews. You can ask us to delete your account at any time.

Agent.md Team (the GitHub App)

The App asks GitHub for metadata: read, pull_requests: read and checks: write. It never asks for repository contents, so it cannot read your code.

We store: which account installed the App and which repositories it covers; for each verified commit, the paths and sha256 hashes of your declared instruction files (or keyed hashes of the paths, if your policy turns that on); merge commits and their pull-request numbers; the login and numeric ID of pull-request authors, to count active contributors for billing; your policy file; standards you publish to your private registry; and signed evidence records, which include the commit, the manifest digest, the approving review (reviewer login, review ID, commit, time), the CI job's verified identity claims and a hash of its token.

Reviews are read from GitHub when a check runs and are not stored apart from the evidence record. File contents never leave your CI runner, except standards you choose to publish to your private registry.

Evidence records, commit hashes and contributor entries are deleted 90 days after they are created or last seen. Registry content is kept until you delete it. Uninstalling the App removes the installation and its repositories from our records; ask us and we delete the rest within 30 days.

To timestamp an evidence record we send a sha256 hash of its signature to Sigstore's public timestamp authority (timestamp.sigstore.dev). Nothing else about you or your repository is sent.

Where data is kept

The website and API run on Vercel and are served through Cloudflare. The database is Supabase Postgres hosted on AWS in Mumbai (ap-south-1), encrypted at rest. Signing keys are held as encrypted secrets in our hosting environment.

What we never do

We do not sell data, show ads, or use your data or your repositories to train models. We do not share data with anyone except the service providers above, or when the law requires it.

Your choices

You can ask what we hold about you, ask us to correct or delete it, or ask for a copy. Write to us and we answer within 30 days.