Privacy Policy

1. What we collect

The malveon check CLI

Your code never leaves your machine. The CLI reads your source code, plan, and git history locally, and runs your project's own build, lint, and test commands as local subprocesses. There is no account and no login. It makes two small network calls, both off with one setting: each run of malveon check sends one anonymous usage event (operating system, CPU architecture, and whether the result was clean or blocked, with a random per-machine ID and no IP-based location; off with --no-telemetry or DO_NOT_TRACK=1), and once a day it asks GitHub whether a newer version exists (off with MALVEON_NO_UPDATE_CHECK=1). No file names, code, plan contents, or commit messages are ever sent.

If you use the early-access form on this website

• Your email address, if you submit it to be notified about the VS Code extension or hosted service.
• That is the only thing we use it for. We do not sell or share it.

Through normal use of this website

• Usage analytics (page views, session duration, referrer) via Google Analytics. No personally identifying information is sent to Google Analytics.
• A lead-tracking pixel that records the page you visited, the referring page, and time on page, so we can see which companies are visiting the site for our own outreach. It does not set a tracking cookie or identify you personally.
• Server-side logs (request paths, status codes, error traces). We do not log request bodies that contain sensitive content.

2. How we use it

• Email you when the VS Code extension or hosted service is ready, if you asked to be notified.
• Understand traffic to this website and which companies are visiting, for our own product and outreach decisions.

We do not sell, rent, or share your data with third parties for marketing.

3. Where your data lives

Malveon's primary data store is located in the United States, and the operator is based in India. By using this website you understand that your data may be stored and processed outside your own country, including in the United States.

4. Subprocessors

We use the following third-party services to operate this website:

• Supabase (early-access signup storage)
• Vercel (CDN, frontend hosting)
• Resend (signup-notification email)
• Google Analytics (web analytics)
• Railway (our internal leads/visit-tracking service)

The CLI itself has no subprocessors: it does not call out to any Malveon-operated service.

5. Data security

• All traffic to and from this website uses TLS 1.2 or higher.
• Early-access signup emails are stored in Supabase, which encrypts data at rest by default.
• Production secrets are stored in Vercel's encrypted environment variables. They are not committed to source control.

6. Your rights

You can:

• Ask us what personal data we hold about you.
• Correct inaccurate personal data.
• Ask us to delete your early-access signup email.

To exercise any of these rights, email ladson@malveon.com. We will respond within 30 days.

7. Data retention

• Early-access signup emails: retained until you ask us to delete them.
• Server logs: 30 days.
• Google Analytics data: retained per Google's default settings (currently 14 months).

8. Children

Malveon is not directed at anyone under 18. We do not knowingly collect data from minors.

9. Cookies

This website uses a small number of cookies:

• Google Analytics cookies for usage analytics.
• No account or authentication cookies: this website has no login.
• No marketing or advertising cookies.

10. Changes to this policy

We update the “Last updated” date when material changes are made. For significant changes, we notify anyone on the early-access list by email.

11. Contact

Email ladson@malveon.com for any privacy questions or data requests.