iscreambyte

Privacy

What gets stored, and why — in plain language.

Effective October 15, 2026.

This website

iscreambyte.com is a static site. It sets no cookies, runs no analytics scripts, and does no tracking of any kind. The web server records each request's time, page, and response, without your IP address or browser. Server error messages can include the address a request came from. Neither is used to identify or profile visitors.

Download counts. When an Aksimuth release file finishes downloading, the site records one line with only the date, the file name, the channel it came from, and whether the download came from the website or from the app's own updater. The line does not include your IP address, browser, referrer, or any identifier.

Cascadia

When you sign in to Cascadia, it stores:

  • Your account basics — the e-mail address, display name, and sign-in identity used to sign in.
  • Your work — your diagrams and documents, and their version history.
  • An audit log — a record of account and diagram actions that includes your IP address and browser user-agent. This exists for security and abuse prevention.

Cascadia uses exactly two cookies, both essential to making the app work: a session cookie (CASCADIA_SESSION) and a CSRF token (XSRF-TOKEN). There are no analytics, no sale of data, and no third-party trackers.

One ad. The public Cascadia shows one ad, fromEthicalAds, at the bottom of the Files sidebar, marked as an ad. EthicalAds chooses it by fixed topics (diagrams, Mermaid, architecture, DevOps, documentation) and your rough location, never by who you are or what you are working on. It runs in a separate, sandboxed frame that cannot see your diagrams, your account, or Cascadia's cookies. No cookies are used for the ad.

To show the ad, your browser contacts EthicalAds directly. Like any web request, that sends your IP address and your browser's user agent. The request also carries those topics and a fixed page address (/ethicalads/frame on the Cascadia site), never the address, name, or content of a diagram or document. EthicalAds then counts the ad as seen once it is on screen, notes how long it stayed on screen, and counts a click if you click it. According to EthicalAds' privacy policy, it does no behavioural targeting, targets ads only by geography and page content, uses IP addresses in real time for geo-targeting and fraud prevention and generally does not store them, and deletes logs that contain them after 10 days. The ad is not shown on phone-sized screens.

Our own sponsor card. Besides that ad, the public Cascadia shows our own sponsor card on the sign-in screen, marked "Sponsored": a short note about another iscreambyte product, or an invitation to sponsor Cascadia. Its text comes from the Cascadia site itself, so showing it contacts no one else and uses no cookies; following its link is up to you. Cascadia set up for an organisation's own work accounts shows no ads and no sponsor card.

Your browser keeps a copy of the diagrams you open (in IndexedDB) and your edits until they are saved (in local storage), so nothing you type is lost if a save doesn't reach the server. Both stay on your device and can be cleared through your browser at any time.

Sign-in. Cascadia signs you in through the iscreambyte sign-in service at auth.iscreambyte.com, with your Google or GitHub account. It receives only your basic profile (id, e-mail, name) — neither Cascadia nor the sign-in service ever sees your password. The sign-in page remembers which provider you chose last, in your browser only.

Deletion. To have your account and data deleted, e-mailhello@iscreambyte.com from your account address.

Hosting. Cascadia is hosted on Google Cloud.

Aksimuth

Aksimuth has no account and no backend. Your clusters, credentials, logs, and settings stay on your machine. Details are on theAksimuth security section. Aksimuth contacts iscreambyte.com for two things only, and both are off until you turn them on in Settings:

  • Automatic updates — once a day it fetches a signed release manifest and, when a new version exists, downloads it. Nothing about you or your clusters is sent.
  • Anonymous usage counts — at most once a day it sends the app version, the operating system, the processor type (amd64 or arm64), the update channel, the edition, and, on the very first count only, a flag marking a new install. There is no identifier, no cookie, and nothing about you, your computer, or your clusters. The server records those fields without the address the request came from, so a count cannot be linked to a person, a machine, or another day's count. iscreambyte uses the totals to see how many copies are in use and which versions and platforms to support.

Turning it off. Clear Share anonymous usage counts in Aksimuth's Settings and nothing more is sent. Retention. The count and download lines are kept in Google Cloud Logging for 30 days. Daily totals derived from them are kept in Google Cloud Monitoring for up to 24 months. Nothing is shared with or sold to anyone.

Five other features reach services that are not iscreambyte's, and each does so only when you turn it on:

  • Azure list prices — the Cost tab can fetch public list prices from prices.azure.com. It sends only VM sizes, Azure regions, and a currency; nothing about your clusters or workloads. It is off until you enable it in the Cost tab or in Settings.
  • Azure Monitor metrics — if you turn it on in Settings and choose it for a cluster, Aksimuth sends PromQL queries for that cluster to the Azure Monitor workspace you picked, with an access token from your Azure CLI that stays in memory and is never written to disk. It is off until you enable it.
  • Log Analytics — if you turn it on in Settings and choose a workspace for a cluster, Aksimuth sends log and event queries for that cluster to the Azure Monitor Logs query service, with an access token from your Azure CLI that stays in memory and is never written to disk. Queries read the cluster's Container Insights records, and Azure may bill for the data a query scans. It is off until you enable it.
  • The assistant — when you ask it a question, it sends the question and the redacted evidence it gathers (with Secret and ConfigMap values, credentials, and personal details masked) to the provider you chose: a command-line tool you have signed in to, a model API with your own key, or a model running on your own machine. Each turn shows exactly what was sent. iscreambyte receives none of it.
  • Agent access — if you enable it for a cluster, an AI agent you run on the same machine can read that cluster through Aksimuth, with the same masking. If Azure Monitor metrics or Log Analytics are on for that cluster, the agent's metric and log queries go to Azure, limited to that cluster; for logs, the agent picks a table, filters and columns and Aksimuth writes the query. What the agent then does with that data is governed by the agent's own provider.

Questions

If anything here is unclear, ask:hello@iscreambyte.com.