NXTG.ai Privacy Policy

Last Updated: October 21, 2026

The Short Version

NXTG.ai builds developer tools that run on your machine. Most of our products collect nothing at all. One product, the Faultline Pro CLI, offers opt-in, anonymized usage telemetry that you must explicitly enable. Our local tools collect no personally identifiable information. The hosted Faultline web app at faultline.nxtg.ai is different: it has accounts, billing and scan history, and it collects personal data. Its privacy notice lists what it collects (see §3.4).

This website (nxtg.ai) collects some information itself: a page-view log, daily event counts, performance metrics, the site chat assistant, the feedback form, and the call request form. §4 lists what each one collects and how long it is kept.

1. Who We Are

NXTG.ai ("we," "our," or "us") builds AI-powered developer tools and data intelligence products. We are a solo-founder company based in the United States.

Contact: [email protected]

2. Our Principles

These principles apply to our local developer tools. Our hosted product, the Faultline web app at faultline.nxtg.ai, has accounts and paid subscriptions and collects personal data; §3.4 summarizes it, and its own privacy notice governs it.

Local-first. Our tools run on your machine. Your data stays on your disk.
Opt-in only. We never collect telemetry by default. Any data collection requires your explicit action — an environment variable you set, a toggle you enable, or a form you fill out.
No accounts required. Our local developer tools do not require registration, login, or authentication to use core features.
Auditable source. Our tools are published under open-source (MIT, Apache-2.0) or source-available (FSL-1.1-ALv2) licenses, so you can audit every claim in this policy.
No advertising. We do not serve ads, sell data, or engage in ad-tech.
No PII in local tools. We do not collect personally identifiable information through our local developer tools: no names, no email addresses, no IP addresses, no API keys, no file paths, no source code content. The hosted Faultline web app is the exception (§3.4).

3. Product-Specific Privacy Details

3.1 Forge — Claude Code Plugin

Forge is an open-source (MIT-licensed) plugin for Anthropic's Claude Code. It provides AI-powered development governance through commands, agents, skills, hooks, and a local MCP server.

What Forge collects: Nothing.

No telemetry, no analytics, no usage tracking
No cloud processing — all governance checks, health scores, and security scans run locally
No data transmission — Forge reads and writes files in your project directory (primarily .claude/governance.json), and that data stays on your disk
The only external network request is loading Tailwind CSS from cdn.tailwindcss.com when you open the HTML dashboard in your browser. This is a static stylesheet fetch — no user data is transmitted.

Your interactions with Claude Code itself (the AI model) are governed by Anthropic's Privacy Policy, not ours. We have no access to your Claude Code conversations, API usage, or model inputs/outputs.

Source code: github.com/nxtg-ai/forge-plugin

3.2 Forge Orchestrator — Multi-Agent Task Engine

The Forge Orchestrator is an optional Rust binary companion to Forge that provides multi-agent task orchestration and knowledge capture.

What Forge Orchestrator collects: Nothing. It runs entirely on your machine with no network calls, no telemetry, and no data collection.

3.3 Faultline Pro — AI Claim Forensics CLI

Faultline Pro is an Apache-2.0 licensed CLI tool for forensic verification of AI-generated claims. It runs locally on your machine.

What Faultline Pro collects by default: Nothing. With default settings, Faultline Pro makes no telemetry requests.

Opt-in telemetry: Faultline Pro offers optional, anonymized usage telemetry to help us improve reliability and prioritize development. Telemetry is disabled by default and is never sent unless you explicitly enable it by setting the environment variable:

export FAULTLINE_TELEMETRY=1

When telemetry is enabled, the following fields — and only these fields — are collected:

Field	Description
`install_id`	Anonymous UUID generated once per device (`~/.faultline/install-id`)
`run_id`	UUID generated per CLI invocation
`version`	CLI version string (e.g., `0.5.4`)
`provider`	AI provider name used for the scan (`gemini`, `openai`, `claude`, `perplexity`, `mock`)
`exit_status`	Exit code — `0` (success) or `1` (error)
`eval_count`	Number of claims scanned in the run
`error_code`	Enumerated error code from a fixed set (e.g., `TIMEOUT`, `NETWORK_ERROR`) — never the raw error message
`os_platform`	Operating system (`linux`, `darwin`, or `win32`)

A timestamp (ISO-8601) is attached to each event for time-series aggregation.

What Faultline Pro never collects — regardless of telemetry setting:

API keys or provider credentials
Evaluation content (the text you scan)
File paths, hostnames, or directory structures
IP addresses
Email addresses or any personally identifiable information
Raw error messages (only enumerated error codes from a fixed allowlist)

Both the CLI client and the server-side worker enforce this whitelist. Any field not in the table above is rejected by the server.

Data processor and storage: Telemetry events are transmitted to a Cloudflare Worker and stored in Cloudflare D1 (region: WNAM — Western North America). Cloudflare, Inc. acts as the data processor. No telemetry data is shared with, sold to, or accessible by any other third party.

Source code: The telemetry module (packages/cli/cli/telemetry.ts) and the Cloudflare Worker (infra/telemetry-worker/) are both Apache-2.0 licensed and source-available for audit.

How to disable: Remove or unset the FAULTLINE_TELEMETRY environment variable. No data is sent when the variable is absent or set to any value other than 1.

3.4 Faultline Pro — Web Application

The Faultline Pro web application at faultline.nxtg.ai provides a browser-based interface for AI claim verification. Unlike our local tools, it collects personal data: account details through Clerk, payment details through Stripe, your scan history, the text you submit for checking, and IP addresses for its free allowance and rate limits. Its privacy notice and terms list what it collects, where it is stored and for how long, and they apply to the web app where they differ from this policy.

3.5 Additional Products

As we launch new products, their privacy details will be added here. Each product section will clearly state what data (if any) is collected, how it is used, and whether it makes network requests.

4. This Website (nxtg.ai)

The nxtg.ai website uses:

Vercel Speed Insights — anonymous page-load performance metrics. No cookies. No personal data.
Page-view log. Each page you open sends its path, the referring page and your browser's user-agent string to our own page-view log. The log does not record your IP address.
Event counts. When a page first loads in a browser tab, and when you click an Evidence Watch link to Faultline, the site adds one to a daily counter. If the link you arrived on carried a campaign tag (?src=), the tag is kept in your tab's session storage until the tab closes, and a second counter is kept for that tag. The counters themselves hold nothing else: no IP address, no user agent, no identifier and no cookie. The counters expire after 90 days.
Performance metrics. Page-load measurements (Core Web Vitals) are recorded with the path of the page.
Site chat assistant. The questions you type are sent to Google Gemini to generate the answer and are recorded, with response timing and token counts, in Langfuse, our tracing service. If a message is flagged as an attempt to misuse the assistant, the chat's session ID is recorded for up to 24 hours and your IP address for up to 1 hour, so a closed chat stays closed. Do not type personal or sensitive information into the chat.
Call requests. The homepage has a form for booking a 20-minute call. It collects your name, work email, company, role, what you want to verify and, if you add one, a timeline. We store each request and email it to [email protected] so we can reply. We use it only to respond and to arrange the call; we do not add you to marketing lists or share it with third parties. For rate limiting we keep a short one-way hash of your IP address, never the address itself, and that hash expires after 30 days. We delete a request 12 months after it is received unless it leads to an engagement. To have yours deleted sooner, email [email protected] and we will delete it within 30 days. Messages sent through the earlier contact form were deleted on October 6, 2026.
Newsletter and waitlist (retired October 6, 2026). The site no longer collects email addresses for a newsletter or a waitlist. The newsletter is published on LinkedIn, where LinkedIn's own privacy policy covers your subscription. Earlier sign-ups were deleted on October 6, 2026.
Feedback widget. If you rate a page, we store the rating, the page and any message you type (up to 1,000 characters). The same store also receives automatic error reports when a page fails (the error name and message, the page path and an event ID).
Rate limits. The chat, the page-view log and the event counts count requests per IP address to stop abuse. Those counters expire within about an hour.
How long we keep it. Feedback and the page-view and performance logs are kept until we delete them. To have your feedback deleted, email [email protected] (see §13).
Error reports. When a page fails in your browser or on our servers, Sentry, our error-reporting service, receives a report of the error: the page address, your browser and operating system, and the recent steps on that page that led to it (such as page changes, clicks and network requests). For about 1 in 10 page loads and server requests, Sentry also receives performance timings. Like any web service, Sentry sees the IP address your browser connects from. Sentry does not record your session or your screen. Sentry's privacy policy covers its processing.
Cloudflare Web Analytics. Cloudflare, which sits in front of this site, adds a script that reports page views and page-load performance to Cloudflare. It sets no cookies. Cloudflare's privacy policy covers its processing.
Vercel Hosting — standard web hosting infrastructure. Vercel processes server logs (IP addresses, request timestamps) per their own privacy policy. We do not access or store these logs.
Cookies and browser storage. When you choose light or dark, the site saves that choice in a first-party theme cookie (1 year) and in your browser's local storage. Clerk, the sign-in service, loads only on the sign-in and sign-up pages and on pages for signed-in visitors, such as the Playground and account settings. There it sets its own cookies: __client_uat on .nxtg.ai (about 400 days), __client on clerk.nxtg.ai (about 400 days), and two Cloudflare cookies on clerk.nxtg.ai that protect that service (__cf_bm, about 30 minutes, and _cfuvid, for the session). When you sign in, Clerk also sets __session (about 1 year) and clerk_active_context (for the session) on nxtg.ai to keep you signed in. Some Clerk cookie names carry a short suffix, for example __session_Hu3YyZmS. Clerk also keeps its settings in local storage. Clerk's privacy policy covers its processing. On /podcasts, Spotify's player loads only if you choose to load it. Spotify then sets its own cookies, including sp_t (about 1 year) and sp_landing (about 1 day) on .spotify.com, under Spotify's privacy policy. In the Playground (/os), the terminal runs code in your browser with StackBlitz's WebContainer runtime, loaded from stackblitz.com. StackBlitz sets its own cookies there, including ahoy_visit (about 4 hours) and ahoy_visitor (about 400 days), under StackBlitz's privacy policy. The site sets no other cookies.

We do not use tracking pixels, fingerprinting, or third-party advertising services on this website.

5. Information We Do NOT Collect

Beyond what §3.4 (the hosted Faultline web app) and §4 (this website) list, we do not collect:

Your name, email, or contact information (unless you email us, submit the feedback form, book a call through the call request form, or use the chat, as described in §4 and §6)
Your source code, project files, or repository data
AI evaluation content (the text you submit to our tools for analysis)
API keys, provider credentials, or authentication tokens
Device identifiers, browser fingerprints, or hardware information beyond the operating system name (and only when telemetry is explicitly enabled)
Location data, or IP addresses beyond the short-lived rate limits described in §4
Behavioral data, session recordings, or usage patterns beyond the metrics described in §3.3 and §4

6. When You Contact Us

If you email us at [email protected], open a GitHub issue, or otherwise reach out, we receive whatever information you voluntarily provide. We use this solely to respond to your inquiry. We do not add you to marketing lists or share your contact information with third parties.

7. Open Source and Transparency

Our developer tools are published under open-source (MIT, Apache-2.0) or source-available (FSL-1.1-ALv2) licenses. You can audit the source code to verify every claim in this policy. The telemetry whitelist is enforced in code — both on the client side and on the server side — and both codebases are publicly available for inspection.

8. Third-Party Services

Our products may integrate with third-party platforms (e.g., Anthropic's Claude Code, Google AI Studio, OpenAI). Your use of those platforms is governed by their respective terms and privacy policies. Our local tools do not intercept, store, or process your interactions with third-party services. The hosted Faultline web app and the nxtg.ai chat assistant do send the text you submit to AI providers, as described in §3.4 and §4.

Faultline Pro's opt-in telemetry uses Cloudflare Workers and Cloudflare D1 for data processing and storage. Cloudflare's privacy practices are governed by Cloudflare's Privacy Policy.

9. EU AI Act Readiness

Faultline Pro provides AI output verification and EU AI Act risk classification capabilities. The tool maps AI-generated claims to applicable EU AI Act risk tiers and can generate compliance reports referencing Articles 6, 9, 13, 14, and 15.

These capabilities are tools to assist your compliance workflow — they do not constitute legal advice, certification, or guarantee of regulatory compliance. You are responsible for your own AI Act compliance obligations.

The data handling practices of our local tools (minimal collection, opt-in only, no PII, transparent processing, auditable source code) are designed to align with the principles of data minimization and transparency reflected in EU AI Act requirements for AI system operators.

10. Children's Privacy

Our products are developer tools and data intelligence software. They are not directed at children under 13, and we do not knowingly collect information from children.

11. Data Security

For products that collect no data (Forge, Forge Orchestrator, and Faultline Pro with default settings), there is no user database to breach. Data generated by these tools lives in your project directories on your machine, protected by your own security measures.

For Faultline Pro opt-in telemetry, the anonymized data is stored in Cloudflare D1, which provides encryption at rest and in transit. The data contains no personally identifiable information. Access to the telemetry dashboard is restricted to NXTG.ai operators.

12. International Users

We are based in the United States. For products that collect no personal data, there are no international data transfers to address.

Faultline Pro's opt-in telemetry is processed and stored by Cloudflare in the WNAM (Western North America) region. Since the telemetry contains no personally identifiable information, no special international transfer mechanisms (e.g., SCCs, BCRs) are required. However, we will add appropriate data transfer safeguards if our data handling practices change in the future.

The nxtg.ai website is hosted on Vercel's global CDN — see Vercel's privacy policy for their infrastructure practices.

The hosted Faultline web app's service providers are listed in its privacy notice.

13. Your Rights

Under GDPR, CCPA, and similar regulations, you have the right to access, correct, delete, and port your personal data. Since we do not collect personal data through most of our tools, these rights are satisfied by design for those products.

For Faultline Pro telemetry: the data is anonymous (keyed by a locally-generated UUID, not tied to any identity). If you wish to stop contributing telemetry data, unset the FAULTLINE_TELEMETRY environment variable. If you have questions about data associated with your install ID, contact [email protected].

For the hosted Faultline web app, its privacy notice explains how to clear your history or delete your account.

If you have contacted us by email and want your correspondence deleted, email [email protected] and we will comply promptly.

14. Changes to This Policy

We will update this Privacy Policy as we release new products or change data handling practices. Material changes will be posted on this page with an updated date. Since our tools are open source, you can also monitor our repositories for any changes that might affect data handling.

15. Contact

Questions about this Privacy Policy:

Email: [email protected]
GitHub: github.com/nxtg-ai

This Privacy Policy is effective as of May 3, 2026.