Privacy policy

This policy is a template supplied with the software. The site owner must review it, fill in the bracketed details and confirm that it meets the law that applies to them.

Operator: [Legal name of the person or company running this site] Contact: [Email address for privacy questions] Effective date: [Date]

What this site is

This site runs Max Harness, a self-hosted AI workspace. You connect your own accounts with AI providers and use them through this site. The operator named above is responsible for the site and for the data stored on it.

Data we store

• Account data: your name, email address and a hashed password. If you sign in with Google or GitHub, the identifier that service gives us.
• Workspace content: your conversations, the files you upload, files created in conversations, projects, assistants and memory items.
• Provider connections: the providers you add and your API keys. Keys are stored encrypted.
• Security data: active sessions with IP address and browser type, and two-factor authentication secrets if you enable it.
• Contact messages: what you send through the contact form.
• Server logs: standard web server logs with IP addresses and requested pages, kept for [period].

We do not use advertising or analytics trackers. [Remove this sentence if you add any.]

How we use it

To provide the workspace, keep your account secure, answer your messages and keep the service running. We do not sell personal data and we do not use your conversations to train models.

Who receives your data

• AI providers you choose. When you send a message, the conversation, attached files, your instructions, enabled memory items and tool results are sent to the provider of the model you selected. Each provider processes that data under its own terms.
• Search service. If you use the web search tool, your search queries go to the configured search service.
• Websites read by a tool. When a model reads a web page for you, this server requests that page.
• Sign-in services. If you use Google or GitHub sign-in, that service knows you signed in here.
• Hosting and email providers. [Name your hosting company and email service.]

Legal basis

[For operators subject to GDPR or similar law: state the legal basis, typically performance of a contract for account and workspace data, and legitimate interests for security logs.]

Retention

Your data is kept until you delete it or delete your account. Backups are kept for [period] and then overwritten. Contact messages are kept for [period].

Your choices

In the workspace settings you can download your data, delete all conversations, remove stored API keys and delete your account. You can also turn memory off and control which tools a model may use.

You may have further rights under the law of your country, such as access, correction, objection and complaint to a supervisory authority. To use them, contact us at the address above.

Cookies

This site sets a session cookie to keep you signed in and a security token cookie to protect forms. Your theme preference is stored in your browser. There are no advertising cookies.

Security

Passwords are hashed, API keys are encrypted and connections use HTTPS. No system is perfectly secure. Use a strong password, enable two-factor authentication and set spending limits with your AI providers.

Children

This site is not intended for children under [age].

Changes

We will update this page when the policy changes and revise the effective date.