Pancake StackPancake Stack › Pancake Stack Manual
Privacy and your data
What stays on your Mac, what goes elsewhere and when, how secrets are kept, and the open-source software inside Pancake.
18.1What stays on your Mac
Pancake has no account and no analytics, and it sends nothing you build to Enfour. Your sites, databases, settings, backups and captured mail live in Pancake's container on your Mac. Passwords, tokens and keys live in your Keychain.
Your sites stay private until you choose otherwise: with Outside Access off, only this Mac can open them, whatever else is set. Pancake's own tools, such as Adminer, never go online.
18.2What goes elsewhere, and when
Only what you set up leaves your Mac, straight from the Mac to the service with your own credentials, never through Enfour:
| When you… | Goes to |
|---|---|
| Put a site online | Cloudflare (tunnel and DNS), or your router and DNS service. |
| Deploy or publish | Your host, static host, app platform or cloud provider. |
| Copy backups off-site or save to Pancake Cloud | Your server, bucket or iCloud Drive, encrypted on your Mac first. |
| Turn on sync | Your own iCloud (sites list and settings, no passwords). |
| Send real mail or push alerts | Your SMTP service, or ntfy, Gotify or Pushover. |
| Use a cloud AI provider | That provider, with passwords and keys removed first. |
| Create a WordPress or Laravel site, or a Python app | Downloads from wordpress.org, Packagist or PyPI. |
Apple Intelligence on your Mac sends nothing anywhere. Private Cloud Compute processes requests privately and doesn't store them.
18.3How secrets are kept
- Database passwords, API tokens, SSH keys and environment variables are kept in your Keychain, never in a site's files.
- Sites read their database details from environment variables, so they never need to be written into
wp-config.phpor.env. .envfiles, SQL dumps, keys and.htpasswdare never served to browsers, and.envfiles, dumps and.gitare never deployed.- Before anything goes to a cloud AI, Pancake removes passwords, private keys and API tokens.
The full policy is the Pancake Stack privacy policy.
18.4Open-source software
Pancake is built on open-source servers and libraries: Apache, PHP, MySQL, PostgreSQL, Nginx, Valkey, Memcached, Python, uv, cloudflared and the libraries built into them. Help ▸ Open-source licences lists every component with its version and its licence in full, made from the same pinned sources Pancake's build compiles. The source code and build scripts are on the source code page.