Privacy Policy

1. What we collect

The malveon software

This covers the command-line tool, the VS Code and Cursor extension, and the MCP server. Your code, file names, plans, prompts, commit messages and error messages never leave your machine. There is no account and no login.

malveon sends small anonymous signals so we can see whether anyone actually uses it. Each one carries your operating system, CPU type and malveon's version, plus:

• First run: the first time malveon runs on a machine.
• Check: each malveon check, from the terminal, your editor or your AI agent: clean or blocked, whether your build and tests ran, how many of your prompts were captured, and the name your agent or editor gives itself.
• Command: which command ran (update, session, register, hooks, prompt or trust).
• Agent connected or tool used: an AI agent or the editor connects to malveon: its own name and the name of the tool.
• Update: an update is offered, installed or fails: the two version numbers, and a one-word reason if it failed.
• Error: a check can’t run: a one-word kind, never the message.

The only thing malveon remembers between runs is a random ID stored on your own machine, so two runs from you count as one person, not two. That ID isn't tied to your name, your email or anything that could identify you. malveon never looks up your location (that is turned off on purpose). As with any internet request, the server that receives a signal sees the IP address it came from. We don't use IP addresses for anything. Typing a prompt to your AI agent never sends anything.

To turn the signals off, add --no-telemetry to any command, or set DO_NOT_TRACK=1 in your environment. In VS Code, turning off the editor's own telemetry setting turns them off too.

Updates and downloads

Once a day malveon asks GitHub whether a newer version exists, so GitHub sees your IP address, as it does for any request. Turn this off with MALVEON_NO_UPDATE_CHECK=1 (DO_NOT_TRACK=1 turns it off too).

The install scripts, malveon update and the npm package fetch files through get.malveon.com, which counts the download and sends you on to GitHub. The count records which file was downloaded and which channel it came through (the install script, npm, Homebrew, Scoop and so on). It does not record your IP address or anything about you.

Through normal use of this website

• Usage analytics (page views, session duration, referrer) through Google Analytics, only if you press Accept in the cookie notice. If you press Decline, Google Analytics is never loaded.
• Standard request logs kept by our host, Vercel (the page requested, the status code and the IP address, as any web host records). We don't use them to identify visitors.
• There is no sign-up form and no account on this website, and no other tracking.

If you contact us

If you email us, we keep your email address and what you wrote so we can answer. If you post in GitHub Discussions, your post is public on GitHub under your GitHub account.

We used to run an early-access sign-up form on this website. It is closed. We no longer collect email addresses through this site, and we don't use any collected earlier.

2. How we use it

• See whether malveon is used, and which versions and install channels people use, to decide what to build next.
• Understand traffic to this website, if you accepted analytics.
• Answer your emails.

We do not sell, rent, or share your data with third parties for marketing.

3. Where your data lives

These services are based in the United States, and we are based in India. By using this website or the software you understand that data may be stored and processed outside your own country, including in the United States.

4. Subprocessors

We use these third-party services:

• PostHog (anonymous usage signals and download counts)
• Vercel (hosting for this website and for get.malveon.com)
• GitHub (hosting the releases, and the daily update check)
• Google Analytics (web analytics, only if you accept)

The software talks to PostHog and GitHub directly, and its installers and updater go through get.malveon.com. It makes no other network calls of its own. (When you ask your AI agent to use malveon, the agent's own service is separate and has its own privacy policy.)

5. Data security

• All traffic to and from this website uses TLS 1.2 or higher.
• Because your code never leaves your machine, there is nothing of yours for us to protect or lose there.
• Production secrets are stored in Vercel's encrypted environment variables. They are not committed to source control.

6. Your rights

You can:

• Ask us what personal data we hold about you.
• Correct inaccurate personal data.
• Ask us to delete it, including anything we hold from an email you sent us.

We hold very little. Usage signals are tied to a random ID, not to your name, so we can only find or delete yours if you send us that ID. It is in the file telemetry_id in the .malveon folder inside your home folder. To exercise any right, email ladson@malveon.com. We will respond within 30 days. You can also complain to your local data protection authority.

7. Data retention

• Usage signals and download counts: kept in PostHog for as long as that service keeps them under our plan, and deleted on request.
• Request logs: kept by Vercel for the period its service provides.
• Google Analytics data: kept for the period set in our Google Analytics account (14 months at most).
• Emails you send us: kept until you ask us to delete them.

8. Children

Malveon is not directed at anyone under 18. We do not knowingly collect data from minors.

9. Cookies

This website uses a small number of cookies:

• Google Analytics cookies, only after you press Accept in the cookie notice.
• Your Accept or Decline choice is saved in your browser's local storage so we don't ask again.
• No account or authentication cookies: this website has no login.
• No marketing or advertising cookies.

10. Changes to this policy

We update the “Last updated” date when material changes are made.

11. Contact

Email ladson@malveon.com for any privacy question, data request or complaint. Ladson Antony Raj is our contact for privacy complaints.