Privacy Policy

Who is responsible

Cendor is an open-source project maintained by Raghav Mishra, operating as PowerAI Labs, based in Denmark. Cendor is not a registered company; it is an independent OSS project. For anything in this policy, Raghav Mishra is the data controller. Contact: contact@cendor.ai.

Because we process so little personal data, we are not required to appoint a Data Protection Officer, and we have not appointed one.

What the site collects

Almost nothing. There are no user accounts, no sign-up, no contact forms, no comment system, no newsletter, no advertising networks, and no social or third-party embeds that phone home. The one exception is privacy-first, cookieless analytics, described in the next section. Fonts are self-hosted, so visiting a page makes no request to any third party by itself.

Analytics

To understand which pages are read and roughly how many people visit, cendor.ai uses Cloudflare Web Analytics — a deliberately privacy-first, cookieless tool. It sets no cookies, stores nothing on your device, does no cross-site tracking or fingerprinting, and builds no profile of you. It reports aggregate metrics (page views, referrers, country, browser family, and the like); it does not collect personal data, and no individual visitor can be identified from it.

• Purpose & legal basis: understanding aggregate usage to improve the site — our legitimate interest under Article 6(1)(f) GDPR. Because it is cookieless and stores nothing on your device, it needs no consent under the ePrivacy rules and the Danish cookie order.
• Processor: Cloudflare, Inc., under its data-processing terms. See Cloudflare Web Analytics (opens in a new tab) and Cloudflare's privacy policy (opens in a new tab).
• What it is not: no advertising, no data selling, no cross-site or cross-device tracking, no cookies, no local storage.

Hosting and server logs

Serving any website necessarily involves your device connecting to a server. cendor.ai is hosted on Cloudflare, which acts as our hosting, content-delivery, and security (DDoS/WAF) provider. To deliver and protect the site, Cloudflare processes standard connection data on our behalf — including your IP address, the requested URL, timestamp, and basic request metadata (such as your browser's user-agent).

• Purpose & legal basis: delivering the site and keeping it secure and available — our legitimate interest under Article 6(1)(f) GDPR.
• Retention: we keep no server logs of our own; any logging is Cloudflare's standard, short-lived operational logging under its own retention.
• International transfers: Cloudflare operates a global network, so processing may occur outside the EU/EEA. This is covered by Cloudflare's data-processing terms and the EU Standard Contractual Clauses. See Cloudflare's privacy policy (opens in a new tab).

The Try & SDK playgrounds

The Try and SDK playgrounds run the real Cendor packages in your browser via WebAssembly. If you enter your own AI provider API key to make a live call, that request goes directly from your browser to that provider's official endpoint (for example api.openai.com or api.anthropic.com). This holds for both — the SDK playground runs the agent loop in your browser and calls the provider the same way.

• We never receive it. Cendor operates no server or proxy in this flow — your key and the content you send are not transmitted to us, logged by us, or stored by us. Your key lives in a single in-memory variable for the session and is gone on refresh. You can verify this in your browser's network tab.
• You are the sender. When you make a live call, you are transferring data to a third party of your choosing, under their terms and privacy policy — for example OpenAI (opens in a new tab) or Anthropic (opens in a new tab). Use a scoped, low-limit key.
• The playground works fully offline without any key; a key is only needed for live provider calls.

Cookies and local storage

No cookie-consent banner, and here is exactly why. cendor.ai sets no advertising or analytics cookies and does no cross-site tracking — our analytics (Cloudflare Web Analytics) is cookieless, so it stores nothing on your device either. The only data stored on your device is a small amount of first-party localStorage used purely to make features work — written only when you actively choose something, carrying no personal data, and never sent to any server.

Those two localStorage entries are the complete list. Site search (Pagefind) loads a static, pre-built index from cendor.ai as you type — it is first-party, sets no cookie or storage, and sends your query to no one. Under the ePrivacy rules (and the Danish cookie order), storage that is strictly necessary to provide functionality you have explicitly requested does not require consent. Both entries qualify: nothing is stored until you act, and none of it identifies you. You can clear them any time via your browser's site-data controls. By default the theme follows your operating system's setting and is persisted only if you change it.

Your rights

Where the GDPR applies, you have the right to access, rectify, erase, restrict, or object to the processing of your personal data, and the right to data portability. In practice the only personal data connected to your visit is the short-lived connection data described above; we hold no store of it to search or export. To exercise a right or ask a question, email contact@cendor.ai.

You also have the right to lodge a complaint with your local supervisory authority. In Denmark that is Datatilsynet (opens in a new tab) (the Danish Data Protection Agency).

A few more things

• We do not sell or share personal data, and we run no advertising.
• We do no profiling or automated decision-making.
• The site is not directed to children and we do not knowingly collect their data.

Changes to this policy

If this policy changes, we will update the date at the top of the page. Material changes will be reflected here; there is no mailing list to notify because we keep none.

Related: Terms of Use · Security & disclosure · Contact.