Privacy

Last updated: 2026-08-05

This page covers three different things people mean when they ask what "allodic" does with data: this website, the allodic CLI, and the self-hosted registries that publishers run with allodic software. They have very different answers, so they get separate sections.

This website (allodic.dev)

The website is a static site served by Cloudflare Pages. It sets no cookies, runs no analytics, loads no external fonts, and makes no third-party requests from your browser. Cloudflare, as the hosting provider, processes connection data (such as IP addresses) to serve and protect the site, under Cloudflare's privacy policy. We do not receive or store that data.

The allodic CLI

The CLI sends disclosed, privacy-limited automatic usage events unless you disable them. The complete technical description — every event, every property, every prohibited data category, the queue, and all off switches — lives on the telemetry page, which is rendered from the same repository file the release gate validates. In summary:

• What: coarse, allowlisted product events (for example "a publish succeeded", "an install completed") plus install/update delivery events to the registry you're installing from. Never skill content, names, slugs, paths, credentials, emails, buyer data, exact prices, or raw error text.
• Where: product events go to PostHog Cloud EU through j.allodic.dev, an allodic-owned first-party proxy. IP-address storage is disabled in the PostHog project, and every event is marked so that no person profile is created.
• Who you are to us: a random installation UUID generated on your machine. It is not derived from your hardware, your username, or anything about you, and we cannot connect it to your identity.
• Off switches: allodic telemetry disable (persistent), ALLODIC_TELEMETRY=0 (per process), or DO_NOT_TRACK=1 (overrides everything). One setting controls all automatic reporting. Reporting is off by default in CI and in source checkouts.

Installed skills never contain allodic telemetry and never phone home.

Self-hosted registries

Publishers run allodic registries on their own infrastructure. When you buy or install a skill from a publisher's registry, your data (such as the email you use for a license, and your order) is processed by that publisher on their server, under their responsibility — allodic (the project and its maintainers) never receives it. Payment card details go directly to the publisher's payment processor (Stripe) and never touch allodic software. Questions about data held by a specific registry go to the publisher who operates it.

Data retention and your rights

Telemetry events are retained in PostHog only as long as needed for product analytics, under the retention policy configured in the PostHog project. Because the installation identifier is random and unlinked to identity, we generally cannot identify which events are yours; the most effective control is the off switch, which stops collection immediately and clears the local event queue. For any privacy question or request, write to hello@allodic.dev, or open an issue at github.com/allodic-hq/allodic.

Changes

Material changes to CLI telemetry (new events, new properties) fail the release gate unless they are documented, so the telemetry page and this policy change with the software, not after it.