Privacy
What we collect, and what we don’t
This site sets no cookie until you allow one, the console never uploads the files you drop into it, and the software we publish never contacts us at all. Everything below is the long version of those three sentences, and all of it is checkable — in your browser’s network panel, or in the source.
Last updated 30 August 2026
Who we are
PRAE (“we”) operates prae-ai.com and publishes the
prae-gate and
prae-cli packages. We are the controller of the
personal data described here. For anything in this policy — including a request to see,
correct, or delete what we hold — write to
[email protected]
and a person will answer.
What this site collects
| What | When | Where it goes |
|---|---|---|
| Analytics events — page views, referrer, approximate location derived from IP, device and browser class | Landing page only, and only after you press Allow | Google Analytics 4 (property G-6Y7QP4XGG7) |
| Your answer to the analytics question | When you press Allow or Decline | Your browser only — never sent anywhere |
| Your PAPER / FENCE ground preference | When you switch it in the console | Your browser only — never sent anywhere |
| Request logs — IP address, user agent, URL, timestamp | Every request, unavoidably, as with any website | Cloudflare, our host. We do not keep a copy |
| Your email address | Only if you use “Request access” or email us | Our mailbox, [email protected] — delivered by a Cloudflare Worker on this site, which keeps no copy |
There is no account, no login, and no profile. “Request access” sends the address you typed, and nothing else, as one email to our mailbox through a Cloudflare Worker on this site. It is not written to a database or a log we keep; the request itself appears in Cloudflare's request logs like any other, as described above.
The console does not upload your files
Every view under /console/ runs entirely in your
browser. When you drop an AGENTS.md,
CLAUDE.md or a policy pack onto the ingest page,
the file is read and parsed by JavaScript in the page. It is not sent to us, to our host,
or to anyone else. There is no endpoint to send it to.
Analytics do not run on console pages at all — not merely denied by default, but absent. A page whose promise is “nothing is uploaded” should not be carrying a tracker while it says so.
The software does not phone home
prae-gate and
prae-cli make no network requests: no telemetry,
no update check, no licence call. Your rules and your ledger are files on your own disk,
and prae verify reads them locally.
prae serve binds to
127.0.0.1 and serves the console to you and nobody
else. We cannot see your policy, your ledger, or that you are running it — the only signal
we get is the anonymous weekly download count npm shows every publisher.
Cookies and browser storage
| Name | Purpose | Lifetime |
|---|---|---|
| _ga, _ga_6Y7QP4XGG7 Cookie | Google Analytics — tells one visitor from another | 2 years · only if you allow it |
| prae-consent localStorage | Remembers your answer so we stop asking | Until you clear it or change it below |
| prae-ground localStorage | Remembers light or dark in the console | Until you clear it |
Google’s tag is not merely denied storage until you allow it — it is not fetched at all.
Consent Mode on its own still loads the script and lets it send a cookieless ping from
every visit; we defer the fetch instead, so until you press Allow no request of any kind
reaches Google from this site. Your network panel will show you that, which is the point.
A Global Privacy Control signal is treated as a decline without asking you at all, and the
two prae- keys never leave your browser — they exist so we
stop asking you the same question.
Change your mind
Your current choice
Checking…
Declining takes effect immediately and also expires any analytics cookie already set. Withdrawing does not undo what was already counted before you changed your mind, and we cannot pick your past visits back out — the data has no identifier that ties it to you.
Why we are allowed to hold it
- Analytics — your consent, GDPR Art. 6(1)(a). Withdraw it above, at any time, with no penalty; every page works identically either way.
- Request and security logs — our legitimate interest in serving the site and defending it from abuse, Art. 6(1)(f).
- Your consent answer and your ground preference — necessary to deliver what you explicitly asked for, and exempt from the consent requirement under ePrivacy because they do nothing else.
- Email you send us — steps taken at your request before a contract, or our legitimate interest in answering our correspondence.
Who else handles it
- Cloudflare, Inc. — hosting and delivery, and therefore the request logs (policy).
- Google LLC — Google Analytics, and our mailbox (policy).
Both are in the United States, so allowing analytics involves a transfer there; we rely on the EU–US Data Privacy Framework and, where it does not apply, the European Commission’s standard contractual clauses. That is the entire list. We do not sell personal data, do not share it for advertising, run no advertising or cross-site tracking of any kind, and make no automated decisions about anyone.
How long it lasts
- Analytics — held in Google Analytics under that property’s retention setting. We do not export it, and we do not join it with anything else.
- Your choice and your ground preference — in your browser until you clear them. Clearing site data removes both.
- Request logs — kept by Cloudflare under its own retention schedule. We do not maintain our own copy, which also means we cannot search them for you.
- Email — for as long as the conversation is useful. Ask us to delete it and we will.
Your rights
If the GDPR or UK GDPR applies to you, you have the right of access, rectification, erasure, restriction, objection, and portability, and the right to withdraw consent at any time. Email us and we will answer within 30 days. You can also complain to your local supervisory authority.
If you are in California: we do not sell or share personal information as the CCPA defines those terms, and we do not process sensitive personal information. A Global Privacy Control signal is honoured automatically, before you ask. The practical shape of a request is the same either way — write to us.
Children
This is a tool for people who operate software in an organisation. It is not directed at children under 16 and we do not knowingly collect anything from them.
Changes
When this policy changes, the date at the top changes with it. If we ever start collecting something materially different — a new processor, a new category of data — we will ask you again rather than lean on an answer you gave about something else.
Contact
[email protected] for anything here. To report a vulnerability, our security.txt says where it goes.