Privacy

Rapid-MLX runs models on your Mac. Your prompts never leave it. This is the full account of the little that the website and the update check do handle.

The short version

Rapid-MLX runs models on your own Mac. Your prompts, documents, images, audio and model outputs never leave your machine — there is no inference server of ours for them to reach. This page describes the small amount of data the website and the update check do handle, and the two things you can opt in to.

• We set no cookies and run no third-party analytics, ad networks or cross-site trackers.
• We never store your IP address. Geography is recorded only as Cloudflare's two-letter country code.
• Everything we count is an aggregate integer. There is no per-visitor record and no profile.
• Telemetry and benchmark sharing are off until you turn them on.

What the website records

rapidmlx.com runs as a Cloudflare Worker. It increments counters in a key-value store:

• Page views — a count per path. Not per visitor.
• Downloads — a count per release version, per channel (GitHub or our mirror) and per country code.
• Install script runs — a count of install.sh fetches.
• Update checks — see below.
• Leaderboard usage — see below.

These are integers. Nothing links one request to another, and there is no identifier that would let us do so.

Cloudflare sees your IP address in order to deliver the page and to apply abuse limits, as any web host must. We do not read it into our own storage, with one narrow exception described under the newsletter below.

The update check

The Desktop app checks for an update once, when it launches. The CLI does the equivalent behind a 24-hour cache. The only data the update-check request sends is the app's own version. No device identifier, no machine model, no operating-system version, no account, and no unique ID of any kind. We count how many checks arrived for each version, by country code.

This check is a product function rather than analytics — updates depend on it — so it is on by default. It is also deliberately the most constrained thing we do: because you cannot meaningfully decline it, it carries as little as it possibly can.

Anonymous Desktop first-run counters

During first run, Desktop can send POST https://rapidmlx.com/api/desktop-funnel with exactly two fields: the app version and one allowlisted milestone name (onboarding_shown, model download started/completed/failed, engine ready/start failed, or first chat reply). It sends no install ID, device or hardware details, operating-system data, model name, error text, client timestamp, account, or other field.

Only installs whose first-run setup starts on a Desktop version that includes this feature send these counters; existing installs never do.

Each milestone is sent at most once per install because a local marker file prevents repeats, and internal or development builds do not send.

We store only aggregate counts by milestone, UTC day, and app version, plus the time the most recent accepted event reached the server. There is no identifier, no per-install path, no retention measurement, and no country data for this endpoint. The connecting IP is used transiently to enforce an abuse limit; the IP address itself is never stored, and the minute-scoped rate-limit state is deleted after two minutes. Desktop skips these requests after the user has declined telemetry, and whenever update checks are turned off.

Leaderboard usage counters

The leaderboard page sends POST https://rapidmlx.com/api/lb-funnel with exactly one field: one allowlisted event name — the page loaded, a Mac, model or run view was shown, the search box was used or a result opened, or a Copy control on a rapid-mlx serve or rapid-mlx benchmark command was clicked. Each event is sent at most once per page load. It never says which Mac, model, run, search text or command was involved, and it carries no cookie, identifier or stored state.

We store only aggregate counts per event and UTC day, plus the time the most recent event arrived. There is no country, user-agent or per-visitor data for this endpoint. The connecting IP is used transiently to enforce an abuse limit and is never stored. Nothing is sent when your browser has Do Not Track or Global Privacy Control turned on.

Telemetry (opt-in)

Rapid-MLX can send anonymous usage telemetry. It is off by default and stays off until you explicitly say yes. If you decline, you are not asked again. The full wire schema, every field, and the command to preview the exact bytes before anything is sent are published at /docs/telemetry.

Telemetry is disabled automatically when RAPID_MLX_TELEMETRY=0 or DO_NOT_TRACK=1 is set, and on common CI environments.

Community Benchmark (opt-in)

Benchmark results are written to your own machine and stay there unless you explicitly choose to share a run. If you do share, the submission carries a name generated from a random per-install identifier — never a serial number. We know the name; we do not know the person. Deleting the identifier file resets it. Before any upload you are shown the destination and the payload digest.

Newsletter

If you subscribe, we store your email address, the page you subscribed from, the time, and your two-letter country code. The list lives in Cloudflare KV and is mirrored to Resend, which delivers the mail. Every email carries a one-click unsubscribe link, and we only mail people who asked us to.

One narrow exception to the no-IP rule: to stop signup spam, the subscribe endpoint writes a rate-limit key containing your IP address that expires automatically after 120 seconds. It is never read for any other purpose and never joined to the subscriber record.

Model downloads

Models are fetched from Hugging Face or from our mirror at dl.rapidmlx.com. Those requests go to those hosts and are visible to them in the ordinary way. We do not record which models you download against any identifier.

What we never collect

• Your prompts, conversations, documents, images, audio or model outputs.
• File names, file contents or anything read from your disk.
• API keys, passwords or credentials.
• Raw IP addresses, beyond the 120-second rate-limit key described above.
• Any cross-site or advertising identifier.

Your choices

Telemetry can be turned off at any time in Settings, or by setting RAPID_MLX_TELEMETRY=0 or DO_NOT_TRACK=1. Benchmark results are never shared unless you choose to share them. To unsubscribe from the newsletter, use the link in any email. To ask what we hold about you, or to have it deleted, write to privacy@rapidmlx.com — for most people the honest answer is an email address and nothing else.

Children

Rapid-MLX is a developer tool and is not directed at children under 13, and we do not knowingly collect information from them.

Changes

If this policy changes materially we will update the date below and say so in the release notes. The page's full history is public in the website repository, so you can diff any two versions of it.

Contact

privacy@rapidmlx.com
MachineFi Lab, 80 Willow Road, Menlo Park, CA 94025, USA

Last updated 3 October 2026.