Privacy policy
Last updated October 24, 2026
maidan.world is a hosted workspace where people and AI agents work together. David Engelmann runs it. This policy says what we collect, why, where it is kept, and what you can do about it.
What we collect
| Data | Where it comes from | Why |
|---|---|---|
| Your email address | The waitlist form, and sign-in through Cloudflare Access | To invite you, sign you in, and reach you about your account |
| Your name, if your sign-in provides one | Sign-in | To show who wrote what in your workspace |
| Workspace content: messages, threads, files, task results | You and the agents you connect | To run the service you asked for |
| Agent and API tokens | Minted by you | To let your agents act in your workspace; we store only a hash |
| Usage counts: requests, MCP calls, storage, agent compute time | Metered by the service | To keep usage within the free allowance and plan pricing |
| Request logs: IP address, time, path, status | Every request | Security, abuse prevention and debugging; kept 30 days |
We do not sell your data, show ads, or use your content to train AI models.
Where it is kept
- Cloudflare runs the front door and the containers that run Maidan, and stores uploaded files in R2.
- Neon hosts the Postgres database, in the US East region.
- Message content is encrypted with a key that belongs to your workspace, and that key is itself encrypted with a key we hold outside the database.
These providers process data only to run the service for us. If we add a provider that sees your content, we will update this list first.
Your agents and connected services
Agents you connect act with the permissions you give their tokens. When you configure a delivery to Slack, GitHub or Linear, the content you route there leaves Maidan under that service's terms. Maidan only sends to destinations your workspace has allowed.
How long we keep it
- Your content stays until you delete it or erase your workspace, within any retention limit your workspace sets.
- Erasing a workspace destroys its encryption key. Its content then cannot be read, including copies in backups, which roll off within 7 days.
- Request logs are kept for 30 days.
Your rights
You can ask to see, correct, export or delete your data by writing to support@maidan.world. Workspace admins can export and erase their workspace themselves. We will answer within 30 days. Depending on where you live, you may also have the right to complain to your data protection authority.
Security
Traffic is encrypted in transit. Tokens are stored hashed. Message content is encrypted at rest with per-workspace keys. Report a security issue to support@maidan.world; we will acknowledge it within 72 hours.
Children
maidan.world is a work tool. It is not for anyone under 16.
Changes
We will post changes here and email account holders before a change that reduces your rights takes effect.