Privacy
What is stored, what leaves, and what is never sent.
Privacy
Section titled “Privacy”This page describes what the software does. It is the input to a privacy policy rather than the policy itself.
Where your documentation lives
Section titled “Where your documentation lives”In a git repository you own. Staleless reads and writes it. It is not a copy held here and handed back on request, and deleting a workspace deliberately leaves the repository alone.
Everything else lives in one Postgres database, scoped per workspace at the database level rather than in the application. Every protected table refuses a query from another workspace.
Uploaded files are content-addressed in an asset store, and each project has its own prefix inside its workspace’s.
About the people who write
Section titled “About the people who write”Stored for an account: an email address, a display name, a password hash (scrypt), and whether they want mail. Optionally a TOTP secret (encrypted, because verifying a code needs the secret) and recovery codes (hashed).
A session is a row plus an httpOnly cookie holding a random token. Only the SHA-256 of that token is in the database. Sessions last 30 days, and each one can be revoked from Settings. Changing a password ends every other session.
Closing an account removes the row. Sessions, memberships, notifications and enrolments go with it. What stays is authorship: the name on a comment, an audit line, a revision.
About the people who read
Section titled “About the people who read”Cookieless. No cookie, no storage, nothing survives the page.
No reader’s address is ever stored. The route hashes it and discards it before the rest of the product sees it. What is kept is a salted hash whose salt rotates daily, so yesterday’s visitor cannot be joined to today’s.
A page view holds: the path, a two-letter country or nothing, one of four device words, a bare referrer host, and that daily hash.
A search holds the words typed and how many results came back. A missed address holds the path somebody asked for. Feedback holds a verdict, an optional comment, and a coarse address hash.
Retention is yours: 90 days by default, between 1 and 400.
What leaves the system
Section titled “What leaves the system”Mail, through the configured relay: verification and sign-in links, password resets, invitations, notifications, and the weekly digest. The relay sees a customer’s address and nothing else.
Webhooks, to a URL you chose, signed, naming the sha, the branch, the message and the paths.
A model provider, for the features you switch on.
The model provider, exactly
Section titled “The model provider, exactly”One provider is called, and only by the features below. There is no second call site.
Off for every site until an owner or an admin turns it on. Until then nothing about that site is sent anywhere.
When a reader asks something:
| What is sent | The reader’s question, and up to six passages of that site’s own published documentation that the question matched. |
| What is not sent | No reader identity, no address, no session, no other customer’s content. |
| Which pages | Only published ones. Never a draft, never a page kept out of search. |
| Private sites | Do not answer questions at all. The endpoint is reached by strangers and cannot tell who passed the gate, so it refuses rather than guessing. |
| What is kept | Nothing, unless the site turns on keeping questions. |
Help with the words
Section titled “Help with the words”Only the text you selected, plus the glossary terms that appear in it. No page context, no other page, no repository. See Help with the words.
Source code
Section titled “Source code”staleless document --dry sends nothing and calls no model. Drafting from
source code is designed and not built, and there is no flag that turns it on.
When it ships, it will read only the path prefixes a file in your own repository
names, only files git tracks, and never a file that looks like a credential. See
document.
Deleting a workspace
Section titled “Deleting a workspace”The workspace is marked deleted and its site stops serving immediately. The rows are purged 30 days later, along with the published files, the routing entry and every file the workspace uploaded.
Your git repository is untouched.
Operator visibility
Section titled “Operator visibility”Operators see grouped counts, not per-person trails. Product telemetry stores the workspace, the site, the signed-in user id, a broad device class and small scalar values. It does not store page bodies, typed values, full URLs, raw user-agent strings, keystrokes, or reader identities.