Privacy

Website

mdbase.dev is a public static documentation website. It has no account system or advertising trackers. The hosting provider may retain ordinary request logs for security and service operation.

Connect accounts

Public signup uses an email address to deliver a one-time verification link. Connect retains the verified address, account name, accepted terms and privacy-policy versions, identity-provider links you add, and security and audit metadata needed to operate the account. Passwords are stored as password hashes, not readable passwords. Abuse controls retain keyed digests and bounded counters for email addresses and source networks.

Connect also retains computer pairing, application declarations, collection identifiers and display names, exact grants, tokens, audit metadata, and routing metadata needed to operate the service.

Local collection paths and record payloads stay at the connector. Encrypted relay traffic exposes routing metadata, operation names, timing, and sizes. Request and response bodies remain encrypted between the application and local connector.

Hosted collection records are encrypted at rest by the hosted provider. The provider decrypts them to execute authorized mdbase operations and acts as a trusted data processor.

Application providers

Applications connected through mdbase receive data under the grants users approve. Each application provider is independently responsible for its own handling of authorized data.

Contact

Report a privacy or security concern through the appropriate repository in the mdbase GitHub organization.