Privacy Policy

Last updated: 2026-10-23

What we store

• Account data: your username, a salted password hash (if you set a password), and — if you link a provider — the provider name, your stable provider account id, the issuer, and the email address that provider reports (with its verified flag).
• Service metadata: machine, installation, and paired-device records for your account (labels, timestamps, revocation state).
• Security events: an audit trail of logins, pairing, enrollments, and revocations — identifiers and outcomes only, never message content or credentials.
• Rate-limiting data: recent per-IP request counters kept in memory to prevent abuse.

What we never see

Your Claude Code conversations are end-to-end encrypted between your devices. The relay routes opaque encrypted envelopes and stores no message content. OAuth provider access tokens are used once at sign-in and are not kept.

Cookies

One session cookie (zf_session) keeps you signed in on zackforge.com. It is HttpOnly, Secure, and SameSite=Lax. Login-form CSRF tokens use a short-lived helper cookie. No analytics or advertising cookies.

Third parties

• If you sign in with Google, GitHub, or Microsoft, those providers receive the sign-in request and see your account there — governed by their own policies.
• If enabled at signup, Cloudflare Turnstile runs a bot check; Cloudflare receives the challenge data. Turnstile results are never treated as your identity.

Deletion

Contact support to delete your account and its records.