Privacy policy
Effective 29 July 2026 · mddb Orbit and mddb.cc
mddb syncs your AI coding setup between your machines. That means the configs you put under management are stored on a server — so the honest version of this page is a list of exactly what the server holds, who else can touch it, and how you get it back or destroy it.
This page covers the hosted service — mddb Orbit at app.mddb.cc
and api.mddb.cc — and this marketing site. If you run the mddb server yourself,
your configs go to your database and we never receive them; nothing on this page
applies to that data.
What the service stores
Your account
- Your email address. That is the whole identity: there is no password, and we never hold one.
- Sign-in records: an emailed magic link or Google sign-in. Of a session we keep only a hash of the session token, never the token itself.
- Your workspace, its plan, and the role you hold in it.
Your machines
- The name you give a machine, its operating system, the mddb agent version, when it was first enrolled and when it was last seen.
- Which AI harnesses the machine reports as installed, and its sync settings — which categories sync, which are backup-only, which are off.
- A hash of the machine's device token. The token itself lives only on the machine, in
~/.mddb/device.json.
The configs you sync
Whatever you put under management: instruction files, skills and their bundled assets, MCP server definitions, subagent files, project paths, and vault entries. The full version history of each is kept too — that is what makes rollback and cross-machine history work — along with the snapshots you take and the conflict records the server has to keep to resolve two machines editing the same thing.
Billing
Paid plans are handled by Dodo Payments as merchant of record. Card details are entered on their side and never reach us. We store the plan, the subscription state and the identifiers Dodo returns.
What never leaves your machine
Secret values. Every outgoing entity is scanned on your machine for things
that look like secrets — API keys, tokens, private keys, JWTs, connection strings. A match is not
uploaded: the entity is held back and you are told what was found. Files named like secrets
(.env, *.pem, id_rsa, …) are stripped from skill bundles
before packing.
MCP servers and vault items are catalog pointers by design: they record where a secret lives — an env-var name, a file path, a command — never its value. The value is resolved locally on each machine.
The server runs the same scan independently and refuses to store a payload carrying a secret, so a client that skips the local scan still cannot write one into the history.
Also never uploaded: files you have not put under management, your source code, and anything
outside the categories you chose. You can see and change that choice at any time from the
dashboard or with mddb categories.
Cookies and tracking
Two cookies, both first-party:
mddb_session— httpOnly, holds your dashboard session. Without it you cannot stay signed in.mddb_lang— the interface language you picked.
There is no analytics package, no tracking pixel, no ad network, no session recording and no cross-site identifier anywhere on this site or in the dashboard. That is why you are not being asked to dismiss a consent banner.
One caveat stated plainly: this marketing site loads its typeface from Google Fonts, so Google sees the IP address of a request for the font file. The dashboard does not — it serves its fonts from our own domain.
Who else processes the data
- Cloudflare — hosting, edge network and object storage. Request metadata, including IP addresses, passes through its edge.
- Neon — the managed Postgres the service runs on.
- Resend — transactional email: sign-in links, account notices, billing notices. Marketing email is not sent through it because we do not send any.
- Dodo Payments — merchant of record for paid plans.
- Google — only if you choose Google sign-in, and for the font on this site.
Your synced configs are never sold, never rented, and never used to train a model — ours or anyone else's. We disclose data to anyone else only when the law requires it.
How long it is kept
- History — as deep as your plan allows: 1 day on the free plan, 30 days on paid plans. Older versions are dropped past that horizon; the current version of an entity is not affected.
- Snapshots — until you delete them or the plan's snapshot cap rolls them over.
- Skill bundles are content-addressed blobs, stored once and shared by every version referencing them.
- Suppression records — if an address hard-bounces we keep it on a list so we do not keep mailing it.
Getting your data out, and deleting it
mddb export writes a dump of everything under management from your own terminal.
You never need us to hand your configs back — and your files stay on your machines regardless,
because mddb syncs them rather than moving them.
Account deletion lives in the dashboard, under Danger zone. It takes more than a signed-in session: the request also carries a fresh code emailed to your address, and the code is consumed on use so it cannot be replayed. On Orbit the workspace is then marked for deletion, the owner is emailed, and a scheduled job removes it after a 7-day grace window — signing in during that window cancels the deletion and reactivates the workspace.
You can change the account email from the dashboard; the new address has to confirm a code before it takes effect.
Your rights
Access, correction, export, deletion and objection — write to support@mddb.cc and we will handle it. Most of it you can do yourself, immediately, from the dashboard or the CLI; the address is for everything else. If you are in a jurisdiction that grants you a formal complaint route to a supervisory authority, this policy does not take it away.
Security
Traffic is TLS-terminated at the edge. Device tokens, session tokens and one-time codes are
stored only as hashes. Config that is executable — an MCP server's command, a vault command
source — is quarantined on your machine and never written into a harness config until you approve
exactly that command, which is what stops a compromised account from pushing something that runs
on your machines. The full security model ships as SECURITY.md with the open-source
core, so you can read it rather than take our word for it.
Changes
The effective date at the top of this page is the version you are reading. If a change materially affects what we store or who processes it, account holders get an email before it takes effect.
Contact
mddb is operated by the developer behind mddb.cc. Questions, requests and complaints: support@mddb.cc.