What Liquidforge knows about you.

Very little, on purpose. There are no accounts, no analytics, no advertising and no tracking cookies. This page says exactly what each part of Liquidforge collects, why, who else sees it, and how long it is kept. Last updated 14 September 2026.

Who runs it

Liquidforge is an independent open-source project maintained by Meet Chauhan. It covers this website (liquidforge-pi.vercel.app, including the Studio and the community gallery), the liquidforge npm package, the liquidforge-mcp MCP server and its Claude Desktop extension, and the hosted MCP endpoint at /api/mcp. To reach the maintainer, use the contact form below.

This website and the Studio

Requests to the site

The site is hosted on Vercel. Like any web host, Vercel receives the request details your browser sends — IP address, user agent, the page requested — and keeps them in operational logs under Vercel's privacy policy. Liquidforge does not add analytics, tracking pixels or third-party scripts, and fonts are served from this site rather than from Google.

Posting to the gallery

When you post, the title, name, link, object and look you enter are stored in a Postgres database hosted by Neon, and shown publicly. To stop floods, the server stores a salted, truncated hash of your IP address with the post; the address itself is never stored, and the hash cannot be turned back into it. Posts stay up until you ask for one to be removed or it is taken down for breaking the rules.

Live cursors

On pages that show other visitors' cursors, your cursor position, a display name and a colour are relayed to other people on the same page while you are there. They are held in memory only and never stored.

Colours from a website

When you ask the Studio to read a website's colours, the address you enter is fetched by this site's server, along with up to six of that site's stylesheets. The result may be cached for up to an hour so the same address is not fetched twice; the address is not otherwise stored.

Things your browser fetches directly

Some features load data straight from other services, which then receive your IP address under their own policies: 3D model catalogues on the Assets page (Sketchfab, Poly Haven, Hugging Face, GitHub and the three.js examples), any model or image URL you give the Studio, and any JSON URL or GitHub repository you connect on the Live page.

Stored in your browser

Your display name for posts and your saved placement on the Place demo are kept in your browser's local storage, and a random identity for live cursors in session storage. None of it is sent anywhere except as described above; clear your site data to remove it.

The contact form

Messages you send are stored in the same database, with the topic, the text, the reply address if you choose to leave one, and a salted hash of your IP address for rate limiting. They are used only to answer you and are deleted within twelve months, or sooner on request.

The beta

The beta is a set of experiments behind an “Enter the beta” switch, which is only a flag in your browser's local storage. Most experiments run entirely on your device. Those that store or send anything:

Moving links

Making a link stores its title, word, colourway and the GIF your browser made in the Neon database, public to anyone with the link, with a salted hash of your IP address for rate limiting. When GIFs outgrow their storage budget, the least recently viewed are dropped and the link shows a still instead; links stay until removal is requested.

Creator packs

A pack's handle, name, looks and use counts are stored and public. Its edit key is stored only as a hash, and kept in your browser's local storage for convenience; a salted hash of your IP address limits how many packs can be claimed. Packs stay until deleted with their key or on request.

Crowd surface

Joining a room connects your browser directly to the others in it over WebRTC, found through public Nostr relays. As on any video call, the people in the room can see your IP address. Only your pointer position is sent, and nothing is stored.

Camera experiments

Hand tracking and the chrome selfie process your camera on your device and never upload video or photos. The tracking and depth models are downloaded from jsDelivr, Google's model storage and Hugging Face, which receive your IP address when they serve them.

Your brand on your site

The address you enter is fetched by this site's server with its stylesheets and logo, and the result may be cached for up to an hour. Nothing else about the request is stored.

Stream overlay

The overlay reads a Twitch channel's public chat anonymously, from your browser or OBS directly to Twitch. Nothing from chat reaches Liquidforge.

Talk and words

Speaking to “Talk to it” uses your browser's speech recognition; in Chrome that sends the audio to Google's speech service. “Words to object” sends the word you search for to the Iconify API. Typing instead of speaking sends nothing.

Everything else

Songs, doodles, selfies, page reflections, AR models and rendered clips are made in your browser and stay there unless you save or share them.

The npm package and <liquid-forge> element

The liquidforge library runs entirely in your visitors' browsers. It contains no telemetry and sends nothing to the maintainer. It loads only what you configure it to load — models, images, SVGs, and JSON URLs for data binding. If you load the element script from jsDelivr, that request is handled under jsDelivr's privacy policy.

The MCP server and Claude Desktop extension

liquidforge-mcp, whether run with npx or installed as the Claude Desktop extension, runs on your own computer. It has no telemetry and sends nothing to the maintainer. What it does touch:

Searching for models calls the public catalogues named above; the Objaverse index ships inside the extension, and the npm package fetches it from this website.
Reading a website's colours fetches that website from your computer.
Rendering starts a Chromium-based browser already installed on your computer, headless, and loads any model URL in the look being rendered. Images stay on your machine unless you or your AI client send them on.
Proposing a placement writes a liquidforge.proposal.json file into the project you name, and nothing else.

Your AI client — Claude or another — decides what it sends to the tools and what it does with their results, under its own privacy policy.

The hosted MCP endpoint

https://liquidforge-pi.vercel.app/api/mcp handles each request independently and keeps no record of the tool calls or their arguments beyond the standard request logs Vercel keeps. Reading a website's colours through it fetches that website from Vercel's servers, and only public addresses are allowed.

Who else sees data

No data is sold or shared for advertising. The service providers involved are Vercel (hosting and request logs), Neon (the database for gallery posts, contact messages, moving links and creator packs), and the catalogues, websites and services your own actions reach — in the beta, also Nostr relays, Twitch, Iconify, your browser's speech service, and the model hosts named above. Gallery posts, moving links and packs are public by design.

Keeping and removing data

Gallery posts, moving links and creator packs are kept until removed. Contact messages are deleted within twelve months. Hosting logs are kept for Vercel's standard retention period. To have a post or a message removed, or to ask what is held about you, send a message below with the topic “Privacy or data removal”; requests are handled within thirty days. Liquidforge is not directed at children under 13 and does not knowingly collect their data.

Changes

If this policy changes, the date at the top changes with it, and anything that collects more than it does today will be described here before it ships.

Contact

Questions about this policy, removal requests, or anything else. See also the MCP server documentation.