Context Fence is a product of Synthrun. Synthrun builds and maintains the Context Fence proxy, this website, the Homebrew tap that distributes the macOS build, the Windows release pipeline, and — one day — the hosted control plane. Everything in this policy covers all of those. If a service is ours, this policy applies; if it is not listed here, it is not part of the product.

In the default mode the proxy runs entirely on your machine. No telemetry, no crash reports, no policy uploads, no analytics from the product itself. We cannot see your tool calls because they never reach us. The audit log, the policy file, and every secret-shaped value the fence strips — all of it stays on your disk.

This site uses Google Analytics to count visits and see which pages people read. GA sets cookies and we see aggregate numbers only: rough visitor counts, popular pages, broad geography. We do not see your identity through it, and we do not try to. The downloads page itself reads a public release manifest from GitHub — that is a public file any visitor can read, and it contains only version numbers, file sizes, and checksums.

Submitting the early access form sends us your email address. We use it exactly once: to reply about access. No list rental, no third-party marketing, no drip campaigns. The reply comes from the founders directly, within 4 business hours. If you later ask us to delete it, we delete it — one message is enough.

When it ships, opting in syncs the audit log to our infrastructure so a team can review it in one place. That is the explicit trade: you send us the log, we keep it for you. The sync is off by default, the log remains on your machine regardless, and the local mode keeps collecting nothing. Fleet policies, audit sync, and Slack alerting are planned features of that plane — none of them exist in the default path.

The product is local-first by construction: no telemetry endpoint, no control plane in the default path, no dependency on a model provider to enforce anything. The macOS build is ad-hoc signed and the Windows build is unsigned by design; both are published with their sha256 checksums so you can verify what you installed. We cannot claim a cloud we do not have.

Email addresses from the early access form are kept until you ask us to delete them. Website analytics are aggregate counters; there is no per-person record to retain. The audit log is yours — retention is your decision, on your disk.

Ask us anything: what we hold about you, why, and for how long. In local mode there is no account to delete — uninstalling the app deletes everything but your own files. If the hosted plane exists by the time you read this, the same rights apply to your synced copy.

If this policy changes, the date at the top changes and this page is the notice. We will not quietly change what crosses the fence. For the default, local mode: nothing does.