Privacy.

What we collect

• Cloudflare Web Analytics — cookieless pageview metrics such as URL, referrer, country, browser, and device class. It uses no advertising cookie or cross-site profile and runs on every page.
• Email sign-ups. If you submit an install/download form or the newsletter form, Cloudflare KV stores your email plus any role, team-size, project description, source, timestamp, and request id you submitted or generated. The signup IP is not retained in the lead record. Truncated IP hashes support short-lived abuse controls. When operational analytics are configured, signup events use an email hash and download events use a separate full SHA-256 IP-derived identifier; vendor retention applies. The lead record expires after 365 days. Emailprivacy@opchain.dev to delete yours sooner.
• Hosted MCP checkpoints. If an MCP client callswrite_checkpoint, the client-supplied JSON is stored in Cloudflare KV for 30 days. Checkpoints are limited to 64 KiB and keyed by the skill plus a private signed session token returned bycreate_checkpoint_session; invented tokens cannot read or pre-seed state. Session creates and writes are rate-limited. Do not put secrets or regulated data in checkpoints. The v1.9 security migration deletes all pre-v1.9 hosted checkpoints; local on-disk checkpoints are unaffected.
• Roadmap activity. Vote totals are aggregate and retained; a truncated hash of your IP is kept for 25 hours to stop duplicate daily votes. A feature request creates a public GitHub issue after submission, so do not include private information.
• Rate-limit counters. Short-lived counters derived from your IP prevent abuse of write endpoints. They expire between 60 seconds and 25 hours, depending on the endpoint.
• Browser analytics (optional). If you accept the consent banner, the PostHog browser SDK records pageviews and site interactions using browser local storage. Session recording is disabled. Declining means the browser SDK does not load.
• Server-side usage events. When configured, the Worker sends PostHog events for downloads, feedback, and email sign-ups independently of the browser consent choice. Identifiers are SHA-256 hashes of the submitted email or IP-derived value; raw email is not sent to PostHog.
• Feedback submissions go to Linear for triage. Including your email is optional; if you leave it blank we have no way to reply.
• Visitor identifier. The oc_id cookie is a random UUID retained for one year so feature-flag rollouts stay consistent in the same browser. It is not used for advertising.

What we don't do

• Sell your email or use it for advertising.
• Send your raw email to analytics vendors.
• Profile you across other sites.
• Record your screen or keystrokes.
• Sell usage data.

Opting out

Click Manage privacy in the footer to reset your browser-consent choice, PostHog local storage, and theoc_id cookie. Declining stops the browser PostHog SDK; it does not disable the limited server-side operational events described above. For deletion of an email record or a hosted MCP checkpoint before its TTL, emailprivacy@opchain.dev with the relevant email or checkpoint skill and session token.

Self-hosting

opchain is open source. In a fork, KV records and checkpoints stay in the operator's Cloudflare account; configured feedback, roadmap, and analytics flows go to services the operator selects. Analytics are env-gated: server events requirePOSTHOG_PROJECT_API_KEY, while consented browser events require both PUBLIC_POSTHOG_KEY andPUBLIC_POSTHOG_HOST. The deploy wrapper enables neither for self-hosted forks unless the operator explicitly supplies those settings. PostHog *.i.posthog.com hosts are already allowed by the Content Security Policy; a custom analytics domain must also be added to script-src and connect-src in the operator's policy.