# Privacy by default.

The website has no analytics or tracking. mdquire has no account of its own, and a newsletter subscription is optional. The subscription service is not collecting addresses yet.

## Books and application data

A book remains in its local files. Plain folders, local git and non-GitHub remotes need no mdquire sign-in. GitHub access is requested only for GitHub operations.

- No manuscript is sent to a model provider without the approval required by the agent workflow.
- The M1 full-text search index stays in memory.
- Crash reports are sent to crash@mdquire.com only after the user approves the shown report in the app.

## Newsletter data and consent

When subscriptions open, the form will request an email address, preferred language and explicit product-news consent. Confirmation is required before product news is authorized. An active address receives no duplicate signup email merely because it was submitted again.

- Pending signups expire; abandoned pending records and payloads are purged after seven days.
- HMAC-derived signup abuse counters are deleted within seven days and do not contain raw IP addresses.
- Unsubscribe cancels pending confirmation and queued mail.
- A minimal suppression record can remain to prevent accidental reactivation.
- Export goes only to the verified address owner; erasure also cancels queued work.

## Hosting and delivery processors

The design uses Cloudflare for static hosting, the subscription Worker and D1 storage, and Resend for email delivery in a dedicated mdquire account. These processors are not receiving subscriber data while the form is disabled. Provider open and click tracking will be disabled; security and delivery processing still occurs.

## Logs, caching and recovery

The design excludes addresses, raw tokens, request bodies, IP addresses and user agents from application logs. Subscription and capability responses use no-store. Database recovery history can outlive an interactive deletion; before any restore, later unsubscribes, complaints and erasures must be reconciled with sending paused.

## Privacy requests

The public privacy-request address will be published before subscriptions open. Until then the site collects no newsletter address and offers no public subscriber form. The confirmed crash-report route is separate and does not subscribe the sender to news.