Privacy by default.
The website has no analytics or tracking. mdquire has no account of its own, and a newsletter subscription is optional. The subscription service is not collecting addresses yet.
Books and application data
A book remains in its local files. Plain folders, local git and non-GitHub remotes need no mdquire sign-in. GitHub access is requested only for GitHub operations.
- No manuscript is sent to a model provider without the approval required by the agent workflow.
- The M1 full-text search index stays in memory.
- Crash reports are sent to crash@mdquire.com only after the user approves the shown report in the app.
Newsletter data and consent
When subscriptions open, the form will request an email address, preferred language and explicit product-news consent. Confirmation is required before product news is authorized. An active address receives no duplicate signup email merely because it was submitted again.
- Pending signups expire; abandoned pending records and payloads are purged after seven days.
- HMAC-derived signup abuse counters are deleted within seven days and do not contain raw IP addresses.
- Unsubscribe cancels pending confirmation and queued mail.
- A minimal suppression record can remain to prevent accidental reactivation.
- Export goes only to the verified address owner; erasure also cancels queued work.
Hosting and delivery processors
The design uses Cloudflare for static hosting, the subscription Worker and D1 storage, and Resend for email delivery in a dedicated mdquire account. These processors are not receiving subscriber data while the form is disabled. Provider open and click tracking will be disabled; security and delivery processing still occurs.
Logs, caching and recovery
The design excludes addresses, raw tokens, request bodies, IP addresses and user agents from application logs. Subscription and capability responses use no-store. Database recovery history can outlive an interactive deletion; before any restore, later unsubscribes, complaints and erasures must be reconciled with sending paused.
Privacy requests
The public privacy-request address will be published before subscriptions open. Until then the site collects no newsletter address and offers no public subscriber form. The confirmed crash-report route is separate and does not subscribe the sender to news.