Privacy

Four things, and nothing else.

Account

The name, email address, and avatar URL your identity provider shares when you sign in with Google or GitHub. No password ever reaches Malaf.

Content

The plans, files, and sites you publish, plus what you say about them: titles, descriptions, tags, addresses, versions, and whether a password or a private flag is set.

Usage

Storage used, API call counts per key, and quota records. Publishing without an account keys those records to your IP address, because that is the only way to apply a fair limit to someone with no account.

Logs

Server logs with a request id, method, path, status code, duration, and, where you were signed in, your user id. They exist to debug failures and are not used to build a profile of you.

• No analytics product, no pixels, no fingerprinting, no session recording.
• No advertising, and no ad network is given anything.
• Your data is never sold, rented, or shared for marketing.
• Your content is never used to train a machine learning model.
• Your content is not read by a person, unless you ask for help with it or it is reported under the acceptable use policy.

Anything you publish without a password is readable by anyone holding the link. Addresses carry six random characters so they cannot be guessed, but a link can be forwarded, pasted into a chat, or indexed if you turn on search visibility.

Whatever you put inside a plan, a file, or a site is your choice and your responsibility. Malaf checks file headers for executable formats and type mismatches, but does not run a full malware scan or remove metadata. Photos can still contain camera and location data, so remove that before sharing if you want to keep it private.

Malaf sets two kinds of cookie, both necessary, neither tracking.

Session

Set by Clerk when you sign in, so the dashboard knows who you are. Signing out clears it.

Site access

Set on a password-protected site after you enter the password, so you are not asked again on every page. It holds a signature, not the password, and changing the password invalidates it.

There is no cookie banner because there is nothing to consent to. Nothing is stored on your device for advertising or measurement.

Malaf is run by one person on top of four services. Each of them sees only what it needs to do its job.

Vercel

Runs the website and the API. Request metadata, and content in transit. Global edge, United States company.

Convex

Database, quotas, background jobs. Account records and content metadata. Ireland (eu-west-1).

Cloudflare R2

Stores the bytes of files and sites. The content you publish. Global object storage.

Clerk

Google and GitHub sign-in, sessions. Name, email address, avatar URL. United States.

Data may also be disclosed if the law requires it, for example a valid court order. Where it is allowed, you will be told.

Account records and content metadata are held in Ireland. File and site bytes sit in Cloudflare object storage and are served from the location nearest the reader. Sign-in is handled in the United States. Using Malaf means your data crosses borders between those providers, each of which offers standard contractual terms for such transfers.

Anonymous

Links published without an account expire after 24 hours, then the records and the bytes are deleted.

Workspace

Content expires 30 days after its last update. Republishing or pressing Renew starts the 30 days again.

After deletion

The link stops working at once. The stored bytes are removed within three days by a cleanup job.

Logs

Kept by the hosting provider for a short operational window, then rotated out. Webhook delivery records are dropped after 30 days.

Account

Deleting your account removes your content, keys, webhooks, profile, and your identity record with the sign-in provider.

Most of what a privacy request usually asks for, you can do yourself and immediately.

• See what is stored. The dashboard lists everything you own, and GET /api/v1/whoami reports your limits and usage.
• Take it with you. Every file, plan, and site can be downloaded from its own link, or listed through the API and the CLI.
• Correct it. Names, titles, descriptions, and addresses are editable from the dashboard, the API, and the CLI.
• Delete it. Delete single items, or delete the account from settings, which takes everything with it.

If you want something that is not in that list, or you want to object to how your data is handled, write to hi@jehaad.com. Requests are answered within 30 days.

Malaf is not for children under 13, and accounts are not knowingly created for them. If you believe a child under 13 has an account, write to hi@jehaad.com and it will be removed.

When this page changes, the date at the top changes with it. A change that affects what is collected or who processes it is announced on the site before it takes effect.