---
title: "Privacy: Chickpea"
description: "What chickpea.co collects (no cookies, no analytics, no forms), what Cloudflare sees to serve it, and where a Chickpea deployment keeps your data."
canonical: https://chickpea.co/privacy
verified: 2026-09-04
---

# Privacy

> This page covers two things: this website, and the Chickpea software you run. The short version is that the website collects nothing about you on its own, and the software keeps your data on infrastructure you operate, with three documented exceptions you control.

The HTML page is at https://chickpea.co/privacy; the site index for agents is at https://chickpea.co/llms.txt.

## This website

chickpea.co is a static site. It sets no cookies of its own, runs no analytics or tracking script, embeds no third-party widget, loads its fonts and images from its own origin, and has no forms, sign-ups, or accounts. The GitHub star count shown on the home page is fetched once when the site is built, not by your browser. When you follow a link to GitHub, Cloudflare, X, or the documentation site, that site's privacy policy applies from there.

The site is served by Cloudflare Workers. Like any web host, Cloudflare receives the request your browser makes, including your IP address and user agent, in order to answer it, and handles it under [Cloudflare's privacy policy](https://www.cloudflare.com/privacypolicy/). The project keeps no visitor logs of its own and does not receive them.

## The Chickpea software

Chickpea is self-hosted. When a team deploys it, the runtime, model traffic, configuration, memory, connector credentials, and Slack messages stay in the Cloudflare account or Node host that team operates. The project has no access to a deployment and no server that a deployment reports to for its work. The [security model](https://docs.chickpea.co/security/security-model) describes what a teammate can see and do: it only reads channels it is published to, unmentioned messages never reach a model, and credentials never reach the model at all.

There are three documented exceptions, each optional or switchable:

- Product telemetry: a small set of anonymous events, such as "a workspace connected" or "an Agent was created", keyed by a random installation ID with no workspace, user, message, or provider identity. It is on by default, the [complete event catalog](https://github.com/pejmanjohn/chickpea/blob/main/TELEMETRY.md) is public, and one setting turns it off.
- Managed connectors: opting a teammate into managed connectors hands OAuth for those accounts to Composio, a third party. The default, connecting your own accounts and HTTP APIs, does not.
- The shared Slack-app gateway: the optional lane that lets a team skip creating a Slack app stores encrypted installation credentials and sanitized health metadata, and does not durably store Slack message or event bodies. The exact boundaries are in [Shared Slack gateway data handling](https://github.com/pejmanjohn/chickpea/blob/main/docs/shared-gateway-data-handling.md); a team that prefers no gateway in the path uses its own Slack app.

## Questions

Questions about this page go to [GitHub Discussions](https://github.com/pejmanjohn/chickpea/discussions); anything that looks like a vulnerability goes through the [private security form](https://github.com/pejmanjohn/chickpea/security/advisories/new). This page was last checked against the source on 2026-09-04 and changes when the site or the software does.

## More

- About: https://chickpea.co/about
- Contact: https://chickpea.co/contact
- Privacy: https://chickpea.co/privacy
- Pricing: https://chickpea.co/pricing
- Home: https://chickpea.co/
- Docs: https://docs.chickpea.co
- Source: https://github.com/pejmanjohn/chickpea