Privacy Policy

Last Updated: June 16, 2026

This Privacy Policy explains what information CmdHub ("we", "us", "our") collects, how we use it, and the choices you have. It applies to the CmdHub website and hosted Service. The open-source cmdh client runs locally on your machine and performs its searches against a local database; it does not send your queries to us except when you explicitly call the hosted API.

1. Information We Collect

Account information: when you sign in with a third-party provider (GitHub or Google), we receive your email address, a provider account identifier, and basic profile information. We store an account record and issue session tokens.
Payment information: purchases are handled by Paddle, our Merchant of Record. Paddle processes your card/payment details; we do not receive or store full payment-card numbers. We retain transaction metadata (amount, date, status) needed for accounting and your wallet balance.
Usage data: API key usage, request metadata, search queries submitted to the hosted API, feedback you submit, and content you publish. We may log IP addresses and request information for security, abuse prevention, and rate limiting.
AI assistant: messages you send to the AI copilot are transmitted to our LLM provider to generate a response (see Section 4). Do not include sensitive personal data in copilot messages.
Cookies/local storage: we use strictly necessary cookies/local storage for authentication and preferences. We do not use non-essential advertising trackers.

2. How We Use Information

We use the information to: provide and operate the Service; authenticate you; process payments and maintain your wallet; meter and bill usage; secure the Service and prevent abuse; respond to support requests; and improve the registry and search quality.

3. Legal Bases

Where applicable law (e.g., GDPR) requires a legal basis, we rely on: performance of our contract with you (providing the Service); our legitimate interests (security, abuse prevention, improving the Service); compliance with legal obligations; and your consent where required.

We do not sell your personal data. We share data only with service providers that help us operate, under appropriate confidentiality terms, including:

Paddle — payment processing and tax (Merchant of Record);
Cloud and infrastructure providers — hosting, storage, and content delivery;
An LLM provider (via OpenRouter) — to process AI assistant messages.

We may also disclose data if required by law or to protect our rights, users, or the public.

5. Data Retention

We keep account and transaction records for as long as your account is active and as needed for legal, accounting, and security purposes. Security and abuse logs are retained for a limited period and then deleted or anonymized.

6. Security

We use industry-standard measures (encrypted transport, scoped access, hashed API keys, signed offline databases) to protect your data. No method of transmission or storage is completely secure; we cannot guarantee absolute security.

7. Your Rights

Depending on your location, you may have the right to access, correct, export, or delete your personal data, to object to or restrict certain processing, and to withdraw consent. To exercise these rights, contact xuepoofoter@gmail.com. You may also have the right to lodge a complaint with your local data-protection authority.

8. International Transfers

We may process data in countries other than yours. Where required, we use appropriate safeguards for such transfers.

9. Children

The Service is not directed to children under 16, and we do not knowingly collect their personal data.

10. Changes to This Policy

We may update this Policy. Material changes will be reflected by updating the "Last Updated" date and, where appropriate, by notice on the Service.

11. Contact

Privacy questions or requests: xuepoofoter@gmail.com.