What leaves your machine, and what doesn't
telemai is self-hosted. Your code, your file paths and your team's conversations stay on the server one of your engineers runs. The only thing that can reach us is an optional daily ping of counts, and the email address you give this website's updates form.
What your own server stores
The host's Postgres holds the project's shared log. It is on the host engineer's machine, behind per-engineer tokens, and we have no access to it. It contains:
- Events: file paths, which engineer and team edited them, and for exported-API changes the declaration text before and after (the signature, not the function body).
- Claims and ownership: which team holds which paths.
- Announcements, decisions and escalations: the text your leads wrote.
- Engineers: email, display name (your git
user.nameunlessmai join --namesays otherwise), team name, and hashed tokens. Tokens themselves are never stored.
To diff an edit, Claude Code's hook sends the server the edited file's content before and after the edit. The server diffs it in memory and keeps only the exported declarations that changed; the file content is not stored. mai host stop --purge deletes the database.
Telemetry: off by default
A host can opt in with mai host --telemetry; --no-telemetry turns it off again. When on, the server sends one ping a day to our collector with exactly these fields and nothing else:
| Field | What it is |
|---|---|
installId | A random id minted once per server database. |
sentAt | When the ping was sent. |
version, commit | The server build. |
uptimeS | Seconds since the server started. |
teams, engineers | How many of each. |
activeLeads24h | Lead sessions seen in the last 24 hours. |
events24h | Event counts by type in the last 24 hours, for example {"file_edited": 120, "contract_changed": 3}. |
critical24h | How many of those were critical. |
Never sent: file paths, symbols, code, team or engineer names, emails, tokens, messages. The sender is packages/server/src/telemetry/ping.ts in the source, and its test checks the field list against this one. This is how we learn whether telemai is catching anything for anyone; it is the whole of what we learn.
This website
- Updates. When you submit the form, your email address goes to Buttondown, the service we write and send the updates from, under its privacy policy. We store nothing ourselves: no IP address, no browser details. You confirm by email before you're subscribed, every email has an unsubscribe link, and unsubscribing removes you.
- No analytics, no cookies. The site sets none and loads no tracking script.
- Hosting. The site is served by Cloudflare Pages, and the fonts are loaded from Google Fonts. Each of those providers sees the requests your browser makes to it, under their own privacy terms.
Contact
To stop the updates, use the unsubscribe link in any of them. To ask what we hold about you, or for anything else: reply to any email from us, or write to the address in the telemai package metadata on npm.