This policy covers everything at ai-declaration.md: the specification pages, the Directory, the Validate page, and the public API. It was last updated on 6 August 2026.
There are no accounts, no cookies, no analytics, no advertising, and no trackers. We never ask you for personal information, because nothing here needs it. The one database this project keeps holds public GitHub repository facts and nothing else. Nothing is sold or shared.
The Directory is the only part of this project that stores anything, and everything in it is already public on GitHub. It is built by searching GitHub for repositories that publish a declaration file. For each one, the record holds:
AI-DECLARATION.md or CANDOR.mdThat is the entire record. No email addresses, no contributor names, no commit history, no file contents, and no private repositories. A repository owner's username appears only because it is half of a repository's name, exactly as GitHub publishes it.
To have a repository removed, open an issue and the row will be deleted. Removing the declaration file from the repository also drops it on the next scan.
The API is stateless and separate. It has no connection to the Directory database, cannot read it, and cannot write to it. It holds no database of its own and writes nothing to disk. Every request is answered from the request itself and then discarded. The Validate page in your browser is a caller like any other, so everything here applies to whatever you paste into it.
POST /api/validate takes file content in the request body, checks it in memory, and returns the result. The content is never written down. Only an anonymous summary is logged: whether it was valid, the declared level and version, and how many errors and warnings were found. Nothing inside your file is recorded, including the file itself, its notes, and any project details in it.
GET /api/detect takes a public GitHub owner and repository name, fetches AI-DECLARATION.md or CANDOR.md from that public repository, and validates it. Only the repository name is logged. The result is not saved and never reaches the Directory.
GET /api/levels, /api/processes, /api/versions, and /api/schema return fixed specification data and take no input at all.
Like any web server, the hosts running this project keep ordinary operational logs containing IP address, timestamp, requested path, and user agent. They exist to keep the service up and to investigate abuse. They are held by the hosting providers under their own retention policies: the website runs on a virtual server, and the API runs on Vercel. No profile is built from them, and they are not combined with anything else.
Pages load fonts from Google Fonts, and the API documentation loads Swagger UI from jsDelivr. Both will see your IP address as a normal consequence of serving those files.
Outbound requests to GitHub, made when building the Directory or answering /api/detect, come from this service and not from you.
The AI-DECLARATION.md Reddit app calls GET /api/detect with a GitHub owner and repository name taken from a public Reddit post. It sends no Reddit usernames, no post text, and no other Reddit data to this API, and it writes nothing to the Directory. What the app does on Reddit itself is governed by Reddit's own policies.
If this policy changes, the date in the summary changes with it, and the edit is visible in the specification repository's history.
For questions, corrections, or removal requests, open an issue.