The canonical policy lives in the repository: docs/security/privacy.md and LEGAL.md. This page is the human-readable summary.

Your brain is your repo

Vant never puts your memory in someone else's database. Memory is markdown files under models/ in a repository, private if you make the repo private. Only you and the agents you authorize can access it. There is no external service holding a copy.

What Vant sends over the network

• Your Git host (GitHub, GitLab, Bitbucket, or self-hosted) when you sync
• A GitHub token, only if you provide one (revocable at any time)
• Hosted embeddings, only if you configure an embed provider with your own API key. The default hash provider needs nothing and sends nothing

What this website collects

Nothing. This site is plain static files: no accounts, no cookies, no tracking, no analytics, no server-side processing. The status page runs browser-side checks only, your browser queries public endpoints directly; nothing is stored or relayed through us. The contact form composes a GitHub issue locally in your browser; you review it and submit it on GitHub, so GitHub's own privacy terms apply to what you share there.

Data control

• Stop using Vant and the memory survives as files, readable with cat
• Private repo = private brain, full stop
• Revoke the GitHub token to cut Vant's network access