Privacy policy

What we collect

• Account data: your email address, organization name, role and sign-in times.
• Registry keys: a name, a short prefix and a keyed hash. The full key is shown to you once and is not stored.
• Wallet links: the address you linked, the chain ID, and the signed challenge used to prove control of it.
• Licenses and purchases: which versions you hold, the terms digest you accepted, and for onchain purchases the transaction hash and event data.
• Download records: when an install ticket was issued and used, and the IP address of the request.
• Install events, only if you enable telemetry in the CLI: patch, version, adapter digest, base model reference, runtime and client version.
• Creator uploads: datasets, rights declarations, training and evaluation records, and the artifacts produced.
• An audit log of state changes in your account, such as keys created, licenses claimed and wallets linked.

We do not use advertising trackers. The CLI sends nothing about your prompts or model outputs to us.

Why we use it

• To sign you in, check your licenses, and deliver the packages you are entitled to.
• To train and evaluate patches you ask us to build.
• To detect abuse such as key misuse, repeated download failures or probing of sealed test sets.
• To keep an accurate record of licenses and payments.

What is public

Published patches show the publisher organization name, the evaluation evidence and the package digests. Onchain purchases and registrations are public by nature: anyone can see the wallet address, amount and transaction on the chain. Linking a wallet to your account is private to us, but if you share that address elsewhere, others may connect it to you. Your email address is never shown publicly.

Datasets

Private datasets and sealed evaluation cases are stored in access-controlled storage, used only for the project they were uploaded to, and never placed on a blockchain. Details are in the dataset policy.

Who we share it with

Infrastructure providers that host the database, storage and email delivery process data on our behalf. We don't sell personal data. We may disclose data if required by law, and we will tell you when we are allowed to. The list of providers will be published before paid licenses go live.

Retention and deletion

• Sign-in links expire after use or within a short window. Unused wallet challenges expire after ten minutes.
• Private datasets are deleted when you delete them or the project, including derived training splits, subject to backup expiry.
• If you delete your account, we delete your profile, keys, private datasets and unpublished projects. We keep license and payment records and the audit log for as long as needed for accounting, dispute and legal obligations.
• Published patch versions and their evidence are kept so existing licensees can still rely on them. You can withdraw a version, which marks it withdrawn without deleting the record.
• Onchain records can't be deleted by anyone, including us.

Exact retention periods will be fixed during legal review.

Your choices

You can view and revoke keys, unlink wallets and turn off CLI telemetry at any time. You can ask us for a copy of your data, a correction, or deletion. Depending on where you live, you may have further rights under laws such as the GDPR. A contact address for privacy requests will be published here before paid licenses go live.