Privacy policy

Last updated 19 October 2026

Maiday is run by the Maiday team. It has two kinds of users: agent users, whose AI agents send reports and read hints through the Maiday plugin, and site owners, who sign in to the dashboard. This page explains what the Maiday service at this address collects, why, and for how long.

What we never do

• We don't sell data, show ads, or use tracking or analytics cookies.
• We don't store raw IP addresses in our application database.

Reports from agents

When an agent gets stuck on a website, it can send a report. A report contains:

• the site's origin and the page path (without query string or fragment)
• the kind of task (such as signup or booking), the failure type, and the outcome
• a short step description, the element involved, the site's error message and any workaround, each capped at a few hundred characters
• the number of attempts and the time of the failure
• the agent tool, its version and model name, if the agent provides them
• a reporter ID

Reports never include form values, cookies, tokens, query strings or URL fragments. Emails, phone numbers, card numbers, long digit runs and token-like strings are redacted from paths and text fields, first by the plugin and again by our server.

The reporter ID is derived from a random secret stored on the agent user's computer (in ~/.maiday/), separately for each site and each collector. It lets us count how many different installs report a problem. Because IDs differ between sites, reports can't be linked across sites by matching IDs.

To stop abuse, we store a network bucket with each report: a keyed hash of the sender's network prefix, scoped to that site. We also keep keyed hashes of IP addresses in rate-limit counters, which are deleted after 24 hours.

Who sees reports: a site owner who has verified a domain sees the reports about that domain, including the free-text fields. The Maiday operator can see all reports to run and protect the service.

Hint requests

When an agent asks for hints, it sends the page's origin and path. We don't store these requests. We only keep daily counts: how many hint requests arrived, and how often each verified domain's hints were served.

Site-owner accounts

• Email address, to send sign-in links and identify your account.
• Sign-in links are stored only as hashes and expire after 15 minutes.
• Sessions use one essential cookie, maiday_session, stored on our side only as a hash and valid for 30 days.
• Your domains, verification tokens, hints and page groups. Hints you publish are public: any agent can read them.

How long we keep data

• Reports: 90 days, then deleted automatically.
• Daily totals per page and failure type (no reporter IDs or network buckets): kept to show long-term trends.
• Rate-limit counters: 24 hours.
• Expired sign-in links and sessions: deleted daily.
• Accounts, domains and hints: until you ask us to delete them.

Service providers

• Cloudflare hosts the service and its database.
• Resend delivers sign-in emails.
• Dashboard pages load fonts from Google Fonts and a script from unpkg; your browser connects to them directly.

These providers process data on our behalf, and some of them may process it outside your country.

Your choices and rights

• Agent users can uninstall the plugin at any time, or delete ~/.maiday/ to get new reporter IDs.
• Site owners can delete hints in the dashboard, and ask us to remove a domain.
• You can ask for a copy of your data, or for your account and data to be deleted.

Contact: hello@maiday.dev.

Changes

If this policy changes, we'll update this page and the date above.