legal
charter explain --privacy # opening PRIVACY.md

Privacy Policy

Last updated June 19, 2026 ·~5 min·1,060 words

What the Charter website collects, and why. The CLI itself is offline by design — it makes 0 network calls and sends us nothing.

CLI sends no telemetry
No tracking cookies
Data is never sold
Offline by design
PRIVACY.md — charter 13 sections
01

Scope

This Privacy Policy covers the website at use-charter.dev (the “Site”), operated by the Charter project (“we”, “us”). It explains what information is processed when you visit the Site and how it is handled. It does not apply to the Charter command-line tool — that is covered in the next section.

02

The Charter CLI

in short: the CLI is fully offline. It never phones home, so we never receive your code, your findings, or your scores.

The command-line tool runs entirely on your machine. By design it makes no network requests, performs no LLM calls, and emits no telemetry or analytics. Your repositories, scan results, and scores never leave your environment and are never transmitted to us or any third party. We have no technical ability to observe how you use the CLI.

03

What the site collects

When you visit the Site, a small amount of technical information is processed to serve and secure the pages:

  • Server & CDN logs. Our hosting provider records standard request metadata — IP address, user agent, requested URL, and timestamp — to deliver content, prevent abuse, and maintain security.
  • No account data. The Site has no login, no user accounts, and no forms that collect personal information.
  • No advertising or cross-site trackers. We do not embed ad networks or third-party tracking pixels.
04

Website analytics

in short: first-party and cookieless. We count visits in aggregate using a daily-rotating, irreversible visitor hash that is deleted within ~48 hours — no profiles, no cross-site tracking, no third-party analytics.

To understand how the Site is used we keep our own privacy-first analytics. There is no third-party analytics service, no cookie, and no browser storage involved. We store only aggregate daily counts — pageviews, approximate unique visitors, which pages and documentation are viewed, install-command copies, and visitor country.

Unique visitors are estimated without identifying anyone. For each day we derive a one-way hash from a visitor’s IP address and browser user-agent combined with a random salt that rotates and is deleted every 24–48 hours. Once the salt is gone the hash cannot be reversed or linked to any later day, so the same person is counted independently each day and cannot be tracked over time. We never store your raw IP address, your user-agent, or the individual pages you viewed.

Automated bots and browser prefetch requests are excluded. This processing rests on our legitimate interest (Art. 6(1)(f) GDPR) in understanding and improving the Site; because no personal data is retained and no device storage is used, it sets no consent-gated cookie. The resulting dashboard is private to the project maintainer.

05

How we use it

Technical information is used only to:

  • deliver and render the Site;
  • protect against abuse, fraud, and security threats;
  • understand aggregate traffic patterns to improve the Site.

We do not sell, rent, or trade your information, and we never use it for advertising.

06

Cookies

in short: the Site stores one local preference — your light/dark theme. No tracking cookies.

Your theme choice is saved in your browser’s localStorage so the page renders the way you left it. That value stays on your device and is never sent to a server. We do not set advertising or cross-site tracking cookies.

07

Third parties

The Site relies on a small number of service providers:

  • Hosting & CDN. The Site is served by a static hosting and content-delivery provider that processes request logs as described above.
  • Source & documentation. Links to our code, license, and docs point to GitHub and our documentation host; their own privacy policies apply once you follow them.
08

Retention

Technical logs are retained only as long as needed for security and operations, then deleted or anonymized in line with our hosting provider’s standard practices. Because the Site keeps no personal accounts, there is no profile data to retain.

09

Your rights

Depending on where you live (for example under the GDPR or CCPA), you may have the right to access, correct, delete, or restrict the processing of personal data relating to you. Because the Site holds no user accounts or marketing profiles, the data we have about any individual visitor is minimal. To exercise a right, contact us using the details below.

10

Children’s privacy

The Site is a developer tool and is not directed to children under 13 (or the equivalent age in your jurisdiction). We do not knowingly collect personal information from children.

11

International transfers

Our hosting and CDN operate globally, so technical request data may be processed in countries other than your own. Providers are selected for their adherence to recognized data-protection safeguards.

12

Changes

We may update this policy as the Site evolves. Material changes are reflected by the “last updated” date above. Continued use of the Site after an update constitutes acceptance of the revised policy.

13

Contact

Questions about this policy or your data? Reach us at privacy@use-charter.dev or open an issue on our GitHub repository.