Privacy policy

About this policy

This policy describes the Lathe editor’s update activity measurement and this privacy website, maintained by Chris Paterson. Lathe is a fork of Zed and retains inherited features that connect to other services. For privacy questions or requests, email support@fl0-dev.com.

Update checks and active-install counts

Release builds check for updates at updates.lathe-ide.com, hosted by Cloudflare. Each check sends the app version, release channel, operating system, and processor architecture. When usage metrics are enabled and an installation ID is available, the app also sends a SHA-256 hash of that ID using a fixed Lathe-specific prefix. The raw installation ID is not sent in this request.

The hash is a stable, pseudonymous identifier, not a guarantee of anonymity. It lets repeated checks from one installation be counted once in daily or weekly statistics. These counts measure installations checking for updates, not people or time spent editing.

For requests containing the hash, the update service records the hash, version, channel, operating system, processor architecture, country supplied by Cloudflare, timestamp, and an event count. Update pings do not include source code, file paths, prompts, or email addresses. This data is used to understand active installations, version adoption, and platform usage.

The Worker does not write IP addresses to its analytics dataset or enable application request logging. Cloudflare necessarily processes IP addresses and request metadata to deliver and protect the service and determine country. Analytics Engine events are retained for three months under Cloudflare’s retention rules. Downloads come from GitHub, which processes download requests under its own policies.

Your telemetry choices

To stop sending the installation hash, turn off usage metrics in Lathe’s settings, or merge these settings into your settings.json:

{
  "telemetry": {
    "metrics": false,
    "diagnostics": false
  }
}

Disabling metrics stops install events from being recorded by the update service. Update checks continue with version, channel, operating system, and architecture. The diagnostics setting separately controls inherited diagnostic reporting. Both settings are enabled in the app’s default configuration. Turning reporting off stops future optional reporting; it does not erase previously sent data.

Inherited Zed telemetry and connected features

Lathe retains code and configuration from Zed. The default server setting points to https://zed.dev, and inherited usage telemetry can be sent to https://api.zed.dev/telemetry/events. This reporting is separate from Lathe’s install-count dataset. Inherited telemetry may include feature use, file extensions, project statistics, device information, and diagnostics. See Zed’s privacy policy and telemetry documentation for Zed’s handling of this information.

If you use AI, collaboration, extensions, language servers, sign-in, or other connected features, information needed for those features may be sent to the provider or tool you choose. AI requests may include prompts, code, and supplied context. Providers have their own terms, retention rules, and privacy policies. This policy does not promise that editor content always stays on your device.

This website and service providers

This page uses no analytics scripts, advertising tags, third-party fonts, or cookies. Cloudflare hosts the page and may process network and security information as part of its infrastructure. See Cloudflare’s privacy policy. GitHub hosts public releases and project resources; see GitHub’s privacy statement.

Support and privacy requests

If you email support, your email address, message, and attachments are processed to respond and investigate your request. Avoid including secrets or confidential files. Information posted in public GitHub issues is publicly visible.

You can request information about, correction of, or deletion of personal information held by the Lathe maintainer at support@fl0-dev.com. Rights and exceptions depend on applicable law. We may need information to verify your request. An email address alone cannot identify your install-count records because the dataset contains no email field. Requests about records held independently by other providers should be directed to those providers.

Processing locations and security

Cloudflare, GitHub, email providers, and optional connected services may process information outside your country. Requests to the Lathe update service use HTTPS. No transmission or storage system can be guaranteed completely secure.

Policy updates

Changes will be published on this page with an updated date. Changes in Lathe’s features or service providers may require updates to this policy.