Privacy and telemetry

Last updated: 2026-05-25.

This is a short, honest contract on what your local Z.E.N. install sends to the Cadence-hosted control plane (zen-api.merchantry.systems) during the private beta. No tracking SDKs, no third-party analytics, no model-provider data sharing.

If anything below feels off, reply to your invite email and we'll fix it.

What stays on your machine

Your model API keys, prompts, workflow inputs, workflow outputs, model responses, conversation history, file reads, file writes, shell commands, the whole execution log. None of that crosses the network to Cadence. The CLI talks directly to your configured model providers (Claude, Hermes, Codex, etc.) using your keys. Cadence cannot read those interactions and cannot bill you for them.

~/.zen/ on your machine holds: your device credentials, the workflow/skill/command cache, and your local execution history. Mode 0600. Stays there until you delete it.

What the CLI sends to zen-api.merchantry.systems

Three things, all of them small and explicit:

1. Heartbeat — once every 6 hours while zen serve is running.

{
  "cli_version": "2.0.0",
  "os": "darwin",
  "arch": "arm64",
  "workflows_count": 12
}

No content, no inputs, no outputs, no file paths, no titles. Just enough to know who's still active and on what platform. Stored against your device id; retention is "until you ask us to delete it or you're revoked."

2. Content sync — on every zen serve startup.

The CLI calls GET /content/workflows, /content/skills, /content/commands to fetch the bundled pack you have access to. Each response is logged on the server as (device_id, kind/name@version, timestamp). We can see that you pulled a given workflow; we cannot see what you did with it after.

3. Update check — when you run zen update --check or zen update.

GET /releases/check?platform=darwin-arm64&current=2.0.0. Reports your platform + current version so we can hand you the right binary. That's it.

What the operator can see

In the admin UI:

• Your email (from your beta request form), platform, hostname (from activation), CLI version (from heartbeat), last-seen time, activation time.
• The list of content fetches against your device id, with watermark tags.
• The audit log: when you activated, when your device was last seen, when content was served, when (if ever) you were revoked.

The operator cannot see:

• Your prompts, your inputs, your outputs, your model keys, your local files, your shell commands, your conversation history, your workflow execution traces. None of it.
• Which steps inside a workflow you ran or what they returned.
• Anything you didn't explicitly send via heartbeat / content-sync / update-check.

The watermark in served content

Every workflow, skill, and command file your device pulls ends with a tagged line:

# served:abc123def4567890:1779686415989

<!-- served:abc123def4567890:1779686415989 -->

The tag is sha256(your_device_id)[:16]. It's not your device id, and it isn't reversible without the server's audit_log table. Its purpose is forensic: if a cohort member republishes a workflow they shouldn't have, the tag tells us which device served it and at what minute. Watermarks don't change your workflow behavior; they're a comment in the source.

If you want to share a workflow with someone outside the cohort, strip the tag first and ask us. The cohort is small; we can usually say yes.

Retention

• Beta-request rows: kept indefinitely so we don't double-process a re-submission.
• Invite rows: kept indefinitely (consumed marker + timestamp).
• Device rows: kept until you ask us to delete you. Revoke flips a status flag; full deletion requires a separate request to Zain.
• Audit log: kept indefinitely for forensic traceability. We do not export, sell, or share it.
• Hourly SQLite backups of the control-plane database land in a Cadence-owned Cloudflare R2 bucket (zen-backups). 30-day expiry via R2 lifecycle rule. Same data as above; same scope.

What we never collect

• Model provider API keys (they live in your .env).
• Workflow inputs or outputs.
• File contents.
• Shell command output.
• Conversation transcripts.
• Telemetry to any third party (no Sentry, no Mixpanel, no PostHog, no Google Analytics).

How to revoke

Email zain@thepromptdepot.com or reply to your invite. Your device status flips to revoked in the server; the next /content/* or /releases/* call from that device returns 403. Your local cache stays on your machine; delete ~/.zen/ to remove it.

If you want every trace removed server-side (device row, audit log entries, content-serve history), say so explicitly in the same email. Default behaviour preserves the audit log for forensic continuity; explicit deletion overrides that.

Why this lives at a URL

Because "trust me" doesn't scale to ten people. If a future version of the CLI starts sending anything else, this document changes, and the change shows up in git history at Fun-Stuff-Shared/zen. Catch us in a contradiction and we owe you a fix.