Privacy
The program has no account, no sync of ours and no telemetry. It makes a few requests of its own, and every one of them is named below. The website counts visits, downloads and the program's daily update check, and says so below too. Here is exactly what is true.
The short version
The program keeps nothing about you on a server of ours. Your files, your commands, your history, your agent conversations and your speech stay on your machine. So do your settings, apart from the copy in iCloud Drive that a Mac keeps through Apple and that one switch turns off. There is no account to make, so there is nothing to attach anything to.
Every request the program makes is in the table below. Most carry nothing about you or the machine, and the two that do, your Claude limits and a fault report you may switch on, say exactly what they carry. This website counts what it serves in three ways, all named in full further down: Google Analytics, which Cloudflare sends for us so that your browser never contacts Google; Cloudflare's own page-view count, which uses no cookie; and a counter of our own that sets no cookie and stores no address.
Everything the program sends, in full
Not a summary. Every request the program makes on its own, in full. A page you open, an add-on at work and a download you press for go where you sent them.
| What | When | What it carries |
|---|---|---|
| The daily check | Once a day, in a thread of its own | Nothing about you or the machine. It asks vobuda.com, or the same file on GitHub if that fails, whether vobuda has a newer version; asks npm whether Claude Code and Codex do; and fetches the add-on catalog the same way. The answers go to files in your settings folder. vobuda.com counts these checks, as described under This website. A new version or an add-on is downloaded only when you press for it |
| The address panel | About every ten minutes while that panel is on screen, and every thirty seconds while no address is known yet | Nothing about you. It asks Cloudflare's 1.1.1.1 what address the internet sees, so the panel can show it. Close the panel and the request stops |
| A fault report | Only if you switch it on. Off by default, and then at most once a day | The faults, with home folders, tokens and addresses removed before they are written, the version and the system, and a random number made once for this machine, never its name, so one fault on ten machines can be told from ten on one. It goes to faults.vobuda.com, our receiver |
| Your speech | Never leaves the machine. Dictation is on macOS only | Recognition happens on your Mac through the system's own framework, with on-device recognition demanded rather than preferred. A language that would need the network is refused, with instructions for installing it locally |
| Your files and settings | Your files never leave. On a Mac, a copy of the settings goes to iCloud Drive | There is no sync of ours and no upload. The copy of the settings in iCloud Drive is on by default, and one switch in Data and privacy turns it off; it goes through Apple, not through us. The settings archive goes wherever you save it |
| Your agents | Your Claude limits, every five minutes while an agent bar is on screen, on a Mac | Claude Code and Codex talk to their own providers with your own subscription, and Vobuda reads the files they keep on your disk to draw its menus. To show your Claude limits, it asks Anthropic with the sign-in Claude Code keeps in your Keychain, the same request Claude Code makes; macOS asks you the first time. The token goes to Anthropic only and is never stored. Codex's account is never touched |
There is no analytics, no session, no usage report and no crash pixel, not as a setting you can switch off but as code that does not exist. The one identifier is the random machine number in a fault report, and only if you switch reports on.
This website
Static files on Cloudflare Pages. Here is what that means in practice.
Google Analytics, sent by Cloudflare and not by your browser
The site counts visits with Google Analytics 4, property G-EE6JW0W33V. No Google script runs in your browser and your browser makes no request to a Google address. Cloudflare Zaraz, part of the Cloudflare service that serves this site, adds a small script of its own to the page, from vobuda.com. It reads details such as the page address and title, the page you came from, your screen and window size and your time zone, and hands the page view to Cloudflare, which sends it on to Google Analytics from its own servers, with details of your browser and your IP address. Zaraz sets first-party cookies on vobuda.com for this and may also keep values in your browser's local or session storage. Apart from the counts named on this page there is no Ahrefs or other analytics service, no advertising pixel, no session recorder and no heat map. Your browser's own do-not-track and any content blocker are respected by simply not being worked around.
Our own counter, which sets no cookie
The server that hands you a page also writes one line about it: the page, its language, which site sent you here and under what heading it belongs (search, an AI answer, a social site, a link, or nothing at all), the country and city Cloudflare reports, and whether the browser runs on a Mac, a phone or something else. No script runs in your browser for this, nothing is stored on your machine, and your address is never written down. To tell ten people apart from one person opening ten pages, the address and the browser string are hashed together with a secret and with today's date; the result cannot be read back, and it changes every night.
One thing stored in your browser
If you switch the site to the dark theme, that choice is kept in your browser's local storage under the name Vobuda-theme, so the next page does not flash back to light. It never leaves your browser and nothing reads it but this site.
Server logs
Cloudflare, which serves this site, records ordinary request data including IP addresses for a short period, to deliver the site and stop abuse. We do not build profiles from it and we do not export it. Cloudflare's own privacy terms cover it.
Our own files, and one Cloudflare script
Every font, picture, stylesheet and script of our own is served from vobuda.com. Nothing is loaded from a font network or an ad network. The only address outside this domain that a page reaches is Cloudflare's, static.cloudflareinsights.com, which serves the script of Cloudflare Web Analytics, a page-view count that reports to Cloudflare only. By Cloudflare's own description it uses no cookies or local storage, does not fingerprint visitors by address, browser string or anything else, and collects no personal data of visitors. Your browser does not reach Google Analytics at all, because Cloudflare sends it from its own servers.
Downloads, and the program's update check
Downloading the package or the install script is an ordinary file request, and it is counted the same way: the date, which of the two files, the version, the country and the city, the page the file was taken from, and whether it was a browser or the install line asking. When an installed copy of the program asks vobuda.com for the newest version, once a day, the site writes one line too: the time, the kind of system and client the request names, the country and the city, and the same daily hash, so we know roughly how many machines run the program. No form, no email, no name, and no address stored. These counts are read on a page behind a password, by the two people who make this program, and none of them is sold, shared or sent anywhere else.
If you write to us
An email to [email protected] or an issue on the public repository is a message you chose to send, and we keep it in order to answer you. GitHub's own terms cover an issue you open there.
Your rights, and the honest version of them
Data protection law gives you the right to see what a company holds about you, to correct it, to have it deleted, and to object to it being processed. Those rights apply here and are easy to satisfy, because we hold nothing that names you: there is no account, and no name or address is stored. What the site counts about the program is a daily update check under a hash that changes every night, and a fault report, if you switch reports on, carries a random number for your machine and nothing that names it.
The exception is anything you sent us yourself. If you emailed us or opened an issue, write to [email protected] and we will show you what is in that thread or delete it.
The program is not aimed at children and does not collect anything from anybody, of any age. It has no advertising, no profiling and no automated decision-making.
Changes, and who to ask
If this ever stops being accurate, this page changes first and the date at the bottom moves with it. A change that would make the program send something new is a change to the program and would be named in its release notes, on the download page, before it shipped.
The company behind Vobuda is Shifton Inc, which also makes shifton.com and rolchat.com. Questions about any of this go to [email protected].