Trust

• Free with no card, no trial, and no paid tier waiting behind a feature.
• Your content is never sold, shared for marketing, or used to train a model.
• No analytics product, no ad pixels, no tracking cookies.
• Everything you publish can be listed, exported, and deleted by you at any time.
• Outages are published automatically, including the ones nobody would have noticed.

Malaf is built and operated by Jehaad AL-Johani. One person, no company behind it, no investors asking for a business model. That is worth knowing before you put something important here, and it is why the limits are what they are.

Malaf costs little to run because nothing is kept forever. Links made without an account live 24 hours. Everything in a workspace lives 30 days from its last update and can be renewed with one click. Storage therefore settles at roughly what people touched this month rather than everything ever uploaded.

A workspace holds 200 MB, and there are 50 sites and plans and 2,000 API requests an hour to go with it. Those numbers sit inside the free allowance of the services underneath, which is the whole trick. If they ever stop covering it, the limits move before a price appears.

Four providers, each with one job.

Vercel

Runs the website and the API. Global edge, United States company.

Convex

Database, quotas, background jobs. Ireland (eu-west-1).

Cloudflare R2

Stores the bytes of files and sites. Global object storage.

Clerk

Google and GitHub sign-in, sessions. United States.

The privacy page says exactly what each one receives, and the security page covers how the pieces are kept apart.

Nothing here locks you in. Files download from their own links, plans keep their original Markdown next to the rendered page, and sites are the files you deployed. The API and the CLI list everything you own, so a script can pull the lot in one go.

Deleting an item stops its link at once. Deleting your account from settings removes your content, your keys, your webhooks, your profile, and your sign-in record.

Solo products end sometimes, and pretending otherwise helps nobody. If Malaf is going to shut down, there will be at least 30 days of notice on the site and in the dashboard, long enough to move anything you care about. Since nothing is stored longer than 30 days anyway, no link would outlive that window unnoticed.

• The OpenAPI document describes every endpoint, so nothing about the API has to be taken on trust.
• The agent instructions are the same document agents read, published as it is.
• The status page shows 90 days of measurements, and incidents are opened by counting rules rather than by a person deciding what to admit.
• The command line tool is on npm under the MIT licence, so you can read exactly what it sends.

Anything about how Malaf handles your work goes to hi@jehaad.com, and reaches the person who built it.