Mantyl is local-first by architecture, not by promise. This page describes exactly what reaches us, in plain language, because a trust product owes you that.
The mantyl command-line tool contains no telemetry, no analytics and no phone-home behaviour of any kind. Scanning, verification, passport generation and your agent transcripts all stay on your machine. Session transcripts pass through secret redaction before they are even written to your own disk. The only network calls the CLI ever makes are the ones you explicitly trigger: publishing a passport, or the optional LLM analysis you configure with your own API key, which sends redacted excerpts to your chosen provider under their terms.
When you run mantyl publish and confirm, the passport document you approved is uploaded and hosted at an address derived from its digest. Your source code is never uploaded. Hosted passports are readable by anyone who has the link. You can remove a hosted passport at any time with the delete token shown at publish, and removal is immediate.
mantyl.dev uses Vercel Web Analytics, which is cookie-free and records aggregate page views, referrers and two product events: that an install command was copied, and that a passport was published. Neither event carries content or identity. We do not run advertising trackers.
Accounts are optional and exist for paid features. Signing in with GitHub shares your GitHub name and email address with us and nothing else; no repository access is requested. Session state is held in a signed cookie in your browser. Sign out ends it.
Independent verification will require uploading a copy of the project being verified, with your explicit consent at the moment of upload, honouring your configured exclusions. Working copies will be destroyed after the verification run, and this page will be updated with the specifics before the feature accepts money.
Questions and requests, including deletion of account data, go to hello@mantyl.dev. Material changes to this policy will be dated at the top of this page and noted in the changelog.