Privacy

Last updated 9 May 2026.

Kvalt is built around a default of "no data collection unless we say otherwise." This page is an honest description of what that means in practice today.

This website

• No analytics. No cookies. No third-party tracking scripts.
• Fonts are served by Google Fonts. Google may log the IP address of font requests; this site does not.
• Hosted on Cloudflare. Cloudflare may collect aggregate request metadata as part of its standard hosting and security functions.

The Kvalt CLI

• The CLI does not phone home. There is no default telemetry.
• The update-notification feature contacts the registry once every 24 hours from inside a Kvalt project to check for new component versions. This is local-to-your-machine and can be disabled with kvalt config set notify false.
• Any future opt-in telemetry will be explicit and asked for on first run.

The Kvalt MCP server

• The MCP server logs zero query contents. It records aggregate request counts per API version per day, used solely to know when old versions are safe to retire.
• No IP addresses, no project identifiers, no component names, no user agents are persisted beyond standard short-lived edge-network logs.

Email

Email sent to addresses on this domain (such as hello@kvalt.dev) is forwarded via Cloudflare Email Routing to a personal inbox. Cloudflare may retain email metadata as part of routing; the inbox provider applies its own retention.

Vulnerability reports

Security issues should be reported privately to security@kvalt.dev. See the SECURITY.md in the repository for the full disclosure policy.

Changes to this page

If anything material changes about how Kvalt handles data, this page is updated and the change is noted in the relevant release notes.