Privacy

The Community edition is local-first. The public documentation site does not provide Community accounts or receive local Community state. Complete Local uses a separate Cloudflare-hosted order and entitlement service and Stripe-hosted payment entry.

Collection, use, and local storage

Session state, context, ledgers, checkpoints, and private signing keys are written beneath the local state directory selected by the operator and used only to provide the requested local proof, recovery, and signing functions. The package never sends that local state to Living Stack.

Optional full-runtime adoption receipt

The current seven-tool Community edition has no adoption-reporting tool. The full single-agent runtime included with Complete Local has a fixed-origin adoption tool that is inert unless the user explicitly sets consent. When invoked, it sends only the package version, a bounded milestone, a coarse host category, the installation public-key SHA-256, a timestamp, and an Ed25519 signature to the Living Stack adoption endpoint. The schema rejects workspace content, task content, personal data, arbitrary metadata, IP-address fields, and user-agent fields. The service stores those fixed receipt fields only and publishes aggregate counts described as signed installation receipts, not people or active users.

Sharing

The Community package does not share local MCP data with Living Stack or third parties. With the full runtime, a user or host may deliberately export a metadata-only signed trace and may separately opt in to the minimal adoption receipt above; the user controls both actions. Those two tools are not in the current Community edition.

Retention and deletion

Session and checkpoint expiry prevents stale state from being accepted after the selected retention window, but it does not automatically erase local files. The operator controls the state directory and is responsible for deleting it when local retention is no longer required. The package has no remote copy to delete.

Website data

The static site is hosted by Cloudflare Pages. Cloudflare may process ordinary request metadata such as IP address, user agent, and timestamps for delivery and abuse prevention under its own policies. Living Stack does not use advertising trackers, cookies, fingerprinting, or persistent visitor identifiers.

A small first-party script sends one body-free event when the product landing page loads. Fixed Community-install and paid-checkout redirects may increment aggregate daily counters, and a successfully created Stripe Checkout Session increments a checkout-start counter. Living Stack stores only the stage, UTC day, aggregate count, update time, and whether the event was organic or QA—not the visitor's IP address, user agent, account, referrer, query string, or task content. These are event counts, not unique people, successful installations, purchases, or customer identities. Counter failure never blocks the page, redirect, or checkout.

Complete Local purchase data

Stripe processes payment credentials and required authentication. Living Stack must not receive raw card credentials. The Cloudflare-hosted order service retains the minimum order, payment-status, entitlement, tax, fraud-prevention, support, and refund records required to fulfill and support the one-time purchase. The buyer's browser generates an Ed25519 installation key; only the public key is submitted. Local session content, checkpoints, recovery-kit private key, and signing keys are not part of the purchase payload.

Card purchases may require Link, card-issuer, or user approval. Stripe Machine Payments may expose limited stablecoin transaction metadata such as the originating wallet, network, transaction identifier, amount, and status.

Secrets

Do not send credentials to the MCP. Redaction is defense in depth, not a secret manager.

Contact

Use the Living Stack support routes for privacy questions or suspected vulnerabilities. Do not include credentials, private keys, order authenticators, or unrelated personal data.