01What this covers
This policy covers two separate things, and it matters which one you are using:
- This website — the pages at
chimeraworkspace.com. - The CHIMERA desktop application — the software you install and run on your own computer.
They are treated differently below because they behave very differently. The controller for both is Hammad Muhammad, an individual based in the United Kingdom.
02The short version
03The website
This site is a static page. There is no server-side application, no database, no login and no form that submits anything to us.
What the site stores in your browser
Nothing. No cookies are set, and no localStorage or sessionStorage entries are written. Your operating-system name is read once in your browser (via navigator.userAgentData) purely to preselect the correct install tab. That value is never transmitted anywhere and is discarded when you close the tab.
Server logs
Whoever hosts this site may keep standard access logs containing IP addresses, timestamps and user-agent strings, as almost all web servers do. If you host on GitHub Pages, Cloudflare Pages, Netlify or Vercel, their respective privacy policies govern those logs. We do not read, export or analyse them.
04The desktop application
CHIMERA runs entirely on your computer. It has no account system and does not communicate with any server operated by us.
No telemetry
The application does not send usage statistics, crash reports, feature analytics, workflow contents, prompts, model outputs or error messages to us or to anyone else. There is no opt-out because there is nothing to opt out of.
Update checks
About eight seconds after launch, and every six hours thereafter, CHIMERA asks GitHub whether a newer release exists. That request reaches GitHub, not us, and carries only what any HTTPS request carries. Nothing downloads until you press Download, and the app never installs an update on quit.
05Where your data lives
Everything CHIMERA knows sits in two places on your own machine:
| What | Where |
|---|---|
| Workflows, runs, traces, notes, memory | A single SQLite file in your workspace directory — ~/.config/CHIMERA/ on Linux, ~/Library/Application Support/CHIMERA/ on macOS, %APPDATA%\CHIMERA\ on Windows |
| API keys and credentials | Your operating system's credential store — Keychain, Credential Manager or libsecret. Never in the database, logs, traces or error messages. Agents receive a handle, never the value. |
| Browser automation profile | A separate Chromium profile belonging to CHIMERA. It never touches the browser sessions you are personally logged into. |
You can copy, back up or delete any of it at any time. Deleting the workspace directory removes the database entirely; credentials are cleared separately through your OS credential manager or by removing the connection inside the app.
06Model providers and third parties
When you configure a model provider or connect an application, your data goes to that provider under their terms and their privacy policy, not ours. We are not a processor in that relationship and have no visibility into it.
| Third party | When it is contacted | What reaches it |
|---|---|---|
| Anthropic, OpenAI, Google, OpenRouter | Only when you configure that provider and run an agent using it | Your prompts, tool outputs and agent context, plus your API key |
| Ollama, LM Studio, OmniRoute | Only if you run them | Nothing leaves your machine — these run locally |
| Composio | Only if you connect an application | OAuth tokens and the tool calls your agents make. Governed by Composio's privacy policy. |
| GitHub | Update checks, and when you download a release | Standard HTTPS request metadata |
| Google Fonts | Every visit to this website | Your IP address and user agent, transmitted to Google to serve the typefaces |
fonts.googleapis.com. That removes the only third-party request this site makes and lets this policy say the site contacts nobody at all.CHIMERA's local-only workspace mode enforces that no outbound model traffic leaves your machine at all. If that matters to you, turn it on and point the app at a local model.
07What we never receive
To be unambiguous, we do not receive and cannot access:
- Your prompts, briefs, agent instructions or model outputs
- Your workflows, runs, traces or notes
- Any file, folder or document an agent reads
- Your API keys or OAuth tokens
- Your IP address, device identifiers or usage patterns from the application
- Any personal data of any kind from the application
08Legal basis and your rights
Because the application collects no personal data, there is nothing for us to process, and most UK GDPR obligations do not arise in relation to it. For any incidental data described above:
- Legal basis: legitimate interests (Art. 6(1)(f)) in operating and securing a website, limited to standard host access logs.
- Retention: we retain nothing ourselves. Host log retention is set by your chosen host.
- International transfers: none by us. Providers you configure may transfer data internationally under their own policies.
You have the right to access, rectification, erasure, restriction, objection and portability under UK GDPR, and the right to complain to the Information Commissioner's Office (ico.org.uk). Since we hold no personal data, most requests will be answered by confirming exactly that.
09Children
CHIMERA is a developer tool and is not directed at children under 13. We do not knowingly collect data from anyone, including children.
10Changes
If this policy changes materially, the date at the top will change and the previous version will remain in the repository's git history, so you can see exactly what changed and when.
11Contact
Privacy questions go to the project author, Hammad Muhammad, via github.com/HammadM-dev/chimera/issues or hammad.world.