Privacy and your data

This page describes how the software behaves. The site's legal terms are in its privacy policy.

Where your data lives

Everything is stored on the server that runs this site: your account, conversations, uploaded files, assistants, projects, memory and provider connections. There is no central Max Harness service and no telemetry. The software does not send usage data to its authors.

What is sent to an AI provider

When you send a message, the server builds one request and sends it to the provider of the selected model. It contains:

• The conversation so far, including earlier messages and replies.
• Attached files from the conversation: images and PDFs as files where the model accepts them, other documents as extracted text.
• Instructions from the project, the assistant and the conversation settings.
• Enabled memory items, if memory is on.
• Tool descriptions and tool results, if tools are on.
• The current date.

It does not contain your name, email address, password or keys for other providers.

If you compare models, the same request goes to each provider you selected. If you switch models partway through, the whole conversation so far goes to the new provider with the next message.

Each provider processes requests under its own terms and retention rules. Some keep API data for a period for abuse monitoring. Check the policy of each provider you connect.

What is sent elsewhere

• Web search. Your query goes to the search service that you or the administrator configured.
• Page reading. Your server requests the page from the website. The site sees the server's address, not yours.
• Google or GitHub sign-in. If enabled and you use it, that service learns that you signed in here.
• Email. Password reset and verification messages go through the mail server the administrator configured.

Nothing else leaves the server.

How API keys are protected

• Keys are encrypted with AES-256 using the installation's own application key before they are written to the database.
• They are decrypted only on the server, at the moment a request to that provider is made.
• The browser never receives a stored key. After saving, you see the last four characters.
• Exports do not include keys.
• Remove key deletes a key at any time.

Someone with full access to the server, meaning both the database and the application key in .env, could decrypt stored keys. That is unavoidable for software that has to use the key on your behalf, so run Max Harness on a host you trust and use provider-side spending limits.

Who can see your conversations

Your conversations, files and provider connections are tied to your account, and every request checks ownership. The admin panel shows counts per user. It has no screen for reading chats, opening files or viewing keys. A server operator with direct database access can read stored messages, because they are not end-to-end encrypted.

Export and deletion

Under Settings, Data and privacy you can:

• Download my data. A ZIP with a JSON file of your conversations, assistants, projects and memory, plus your files.
• Delete all conversations. Removes every chat and file.
• Delete my account. Removes the account and everything attached to it.

Deletion is immediate. Copies may remain in the server operator's backups until those expire.

Sessions and sign-in

Sign-in uses a session cookie that is marked HTTP-only. Two-factor authentication adds a code from an authenticator app. The security section of the settings lists active sessions and lets you sign out other devices.