Privacy

Effective 21 September 2026 · Last updated 21 September 2026

MixLab collects nothing about you. This covers all of it: the mix command line, the MixEngine daemon and the MixLab window. There is no analytics, telemetry, crash reporting or advertising code in any of them.

The one service of ours is sync, and it is off until you sign in. What it carries is encrypted on your machine before it leaves, under keys the server never receives, so the server holds your data and cannot read it. The rest of this page says exactly what is kept where.

Who we are

MixLab is developed and published by mixnz (Nguyễn Hải Quang), Cẩm Mỹ, Đồng Nai, Vietnam. Questions about this policy, or about privacy in MixLab, go to haiquang9994@outlook.com.

What stays on your machine

• The MixEngine home (mix status names it) holds the runtimes, services, sites, certificates and logs MixEngine manages. None of it is sent anywhere.
• The MixLab window keeps its settings, saved connections, REST requests and history, query drafts and snippets as files in its application data folder, named io.github.mixnz.mixlab, in the usual place for your system.
• Passwords and secrets are not written to those files. They go to the credential store your operating system already provides (Credential Manager on Windows, the Keychain on macOS, the Secret Service on Linux), under the name MixLab. They are never logged, and debug output prints them as ***.

When MixLab reaches the network by itself

Everywhere else it is silent unless you tell it to connect somewhere.

• Checking for updates. The daemon reads https://github.com/mixnz/mixlab/releases/latest/download/latest.json when it starts and once a day. The request carries no identifier and nothing about you or your work.
• Packages and extensions. The index of what can be installed, and whatever you install from it, come from github.com/mixnz/mixengine-packages.
• Database tools. Dump and restore need the vendors' own tools. Only when you ask, MixLab downloads them from dev.mysql.com, get.enterprisedb.com, downloads.mongodb.org and fastdl.mongodb.org.

GitHub and those vendors see the IP address and user agent of the request, as any web server does, under their own privacy policies. We receive nothing from them.

Connections you make yourself, to a database, over SSH or as a REST request, go straight from your machine to the address you entered. Nothing of ours sits in the path.

Sync

Sync is off until you sign in, and after that every kind of data stays off until you turn it on in Settings. The default server is https://sync-0.lab.mixnz.com, run by us on Cloudflare Workers.

What the server holds:

• your email address, because it is your login and where codes are sent;
• a hash of that address, which names your account;
• a verifier derived from your password, never the password itself;
• the names you gave your machines, and when each was last seen;
• your records as ciphertext, with their sizes and the times they changed.

What it cannot see: anything inside a record, the name of any kind of data, a host, a URL, a file name or a password. The keys that would open a record exist only on your machines.

Who else is involved. Confirmation and reset codes are sent through Mailtrap, which sees your address and the letter. Cloudflare runs the server and keeps its standard request logs, including IP addresses, under Cloudflare's privacy policy; we read them only to fix faults. To stop abuse, the server counts requests per IP address and per account, and forgets each count after an hour.

A server you add yourself belongs to whoever runs it, not to us, and this section does not describe it.

Keeping and deleting

• A record you delete leaves a marker for 90 days, so your other machines learn it is gone; then the marker goes too.
• Removing a machine from your account signs it out at once.
• Deleting your account removes the account and every record outright, and leaves nothing behind that names your address.
• Resetting a forgotten password without your recovery key deletes every record, because nothing could read them any more.

Children

MixLab is a tool for software developers. It is not directed at children, and we do not knowingly collect personal data from anyone.

Your rights

Data-protection laws such as the GDPR and the CCPA give you rights to access, correct, export and delete your data. For sync, MixLab's Settings shows which machines are signed in and removes them; anything it does not do yet, deleting your account among it, goes to the address above. Everything else is on your machine and under your control: the MixEngine home, the application data folder, and the entries named MixLab in your credential store.

Changes

A change to this page updates the date at the top. Its full history is this repository's.

This page as Markdown: https://mixnz.github.io/mixlab/en/privacy.md