Privacy Policy
The short version. Munder Difflin runs on your computer. Your prompts, your code, your agents' output, your API keys, your memory and your hive never reach us — there is no account to create and no server of ours for them to travel to.
The app sends a small set of anonymous usage events (that it was launched, that an agent was spawned) so we can tell whether anyone is actually using it. Every event is listed below, the list is enforced in code as a hard allowlist, and you can switch it off three different ways. That is the entire collection story.
01Who we are
Munder Difflin is a free, open-source project maintained by Chaitanya Giri, an individual developer based in India. There is no company behind it and no sales team. "We" and "us" in this document mean that one person.
The source code is public at github.com/chaitanyagiri/munder-difflin, which means every claim on this page is one you can verify yourself rather than take on trust.
02What stays on your device
Munder Difflin is a desktop application that drives command-line AI agents already installed on your machine. Everything it works with is stored locally, in the app's own data directory and in the hive folder you choose:
- Prompts you write, and everything your agents produce in reply
- Your source code, files, repositories and terminal output
- API keys and credentials you enter, including any secrets in the integrations registry
- Agent memory, mailboxes, tasks, schedules and the event log
- Voice audio for dictation and Realtime Michael, which goes to the provider whose key you supplied and nowhere else
None of it is transmitted to us. There is no account, no sign-in, and no sync service. If your machine is offline, the app still works apart from the parts that call an AI provider.
03Usage stats in the app
The app sends a small number of anonymous product-analytics events so we can see whether features are used. TELEMETRY.md is the authoritative contract: if an event or property is not listed there, the app does not send it, and the code enforces that list as a hard allowlist.
Properties attached to every event
| Property | Example | Notes |
|---|---|---|
| app_version | 0.4.3 | The app's own version |
| os | darwin / win32 / linux | Platform, nothing more |
| arch | arm64 / x64 | CPU architecture |
The events
| Event | Extra properties | When |
|---|---|---|
| first_run | — | Once, the first time the app ever starts |
| app_launched | — | Each app start |
| agent_spawned | provider — the CLI engine name, e.g. claude, codex | An agent terminal is spawned |
| feature_used | feature — one of slack_trigger, webhook_trigger, hire_install, voice_dictation | At most once per feature per session |
| session_ended | duration_bucket — one of <5m, 5-30m, 30m-2h, 2-8h, 8h+ | On quit — a coarse bucket, never a raw duration |
How it stays anonymous
- Events go to PostHog with
$process_person_profile: false, making them anonymous events — no person profile is created and no identity is stored. - The only identifier is a random UUID minted on first run and kept in the app's user-data directory as
telemetry-install-id. It is not derived from your machine, and deleting the app's data deletes it. - IP-based geolocation is used only to derive a country for aggregate statistics. PostHog does not retain the IP address on the event.
04How to opt out
Any one of these fully disables telemetry:
- In the app. Settings → General → Anonymous usage stats → off, or uncheck "Share anonymous usage stats" during onboarding. Takes effect immediately.
- Set
DO_NOT_TRACKto any value other than0. This standard environment variable is respected unconditionally. - Build from source. The analytics key is injected only in official release CI. A local or forked build compiles without one and the analytics module becomes a complete no-op — forks never send events anywhere.
05The website
This site is served as static files by GitHub Pages. It sets no cookies of its own and has no login.
- Analytics. PostHog records page views and a
download_clickedevent carrying the name of the file. It runs with person profiles set tonever, autocapture off and session recording disabled — so no clicks, keystrokes, form contents or screen recordings are captured. It honours your browser's Do Not Track setting and does not load at all when that is on. - Fonts. Typefaces load from Google Fonts, so Google receives your IP address as part of that request. This is the one third-party asset the site loads.
- Hosting and downloads. Pages and release downloads are served by GitHub, which sees your IP address and processes it under its own privacy statement. The app's update check also contacts GitHub.
- Donations. If you choose to donate, payment is handled entirely by Razorpay under their terms. We never see your card details.
06What we never collect
No prompts. No agent transcripts or output. No file paths, repository names, branch names or hostnames. No email addresses, account identifiers, machine identifiers or API keys. Nothing free-form — the property allowlist drops anything not in the tables above.
We hold no information that identifies you. That is a design decision, not a promise about our intentions — the allowlist is in the source code, and you are welcome to read it.
07Services you connect
Munder Difflin is a harness around tools you supply. When you configure an engine or an integration, your data goes directly from your machine to that provider, governed by their privacy policy and terms — not this one. We are not an intermediary and never see the traffic.
- AI providers whose CLI agents you run — Anthropic, OpenAI, xAI, Google, Moonshot and others, plus any local model server you point at. Your prompts and code go to whichever you choose.
- OpenAI Realtime for the voice channel, using your own key.
- Slack, webhooks and other integrations you enable yourself.
Review those providers' policies before sending them anything sensitive. Their handling of your data is outside our control.
08Retention
Anonymous events are retained by PostHog under their standard retention for our project and are used only in aggregate. Because the events carry no identifier beyond a random install UUID, we cannot single you out within them.
Everything else — your work, your keys, your memory, your hive — lives on your disk for exactly as long as you keep it, and is gone when you delete it. We hold no copy.
09Your rights
Depending on where you live, you may have rights to access, correct, export or delete personal data an organisation holds about you, including under the GDPR and the Indian Digital Personal Data Protection Act.
In practice we hold no personal data to act on: there is no account, and the analytics are anonymous by construction. The nearest thing to a handle on you is the random install UUID, and you can destroy it yourself by turning telemetry off, deleting the app's user-data directory, or both. If you believe we hold something about you regardless, write to us and we will look into it and act.
10Children
Munder Difflin is a developer tool and is not directed at children. It is not intended for use by anyone under 13, or under the minimum digital-consent age where they live if that age is higher.
11Changes
If this policy changes, the date at the top changes with it, and any change to what the app collects also changes TELEMETRY.md in the same commit. Because the repository is public, the full history of both is permanently auditable.
12Contact
Questions, corrections or requests: girichaitanya11@gmail.com, or open an issue on GitHub. Security reports have their own route — see SECURITY.md.
See also the Terms of Service.