Privacy Policy
What Ephyra processes for the website, sign-in, production signals, quests and model calls.
Revised · Review copy
Prepared for review, not yet effective. The operator is Keith Abiola Noel, a sole proprietor in Québec, Canada. A public business mailing address, legal review and a French edition must be completed before adoption.
At a glance
- The public pages use no analytics, advertising or cookies.
- Sign-in goes through Not Organic. Ephyra stores your DID, handle and an encrypted session.
- Model providers receive the signal excerpts and code a request needs.
- Approvals are recorded by DID, because a checkpoint’s purpose is a reviewable record.
- You can ask for access, correction and deletion.
This summary is a guide to the full text below.
Who and what this policy covers
This proposed policy covers the Ephyra website and its journal, and the Ephyra deployments we operate, including their sign-in. The operator is Keith Abiola Noel, a sole proprietor in Québec, Canada, using the working name Ephyra. A public business mailing address remains to be added before adoption.
Anyone can run Ephyra themselves. The operator of a self-hosted deployment decides what it collects, is responsible for that processing, and should give its own notice to the people it affects. This policy describes how the software behaves, which can help with that notice, but it does not cover deployments we do not operate.
For a deployment we operate for an organization, the organization decides which signals and repositories to send. We process that content on its instructions as its service provider. For account, sign-in and security records, we decide the purposes ourselves.
The public website
When you visit, our hosting provider, Railway, receives standard request information: IP address, user agent, requested page, referrer and time. That information can appear in service logs we use to operate and troubleshoot the site. The public pages use no analytics, advertising, tracking pixels or cookies.
The theme switch stores your light or dark choice in your browser’s local storage, under ephyra-theme, ephyra-b-theme or ephyra-c-theme. The choice never leaves your browser, and you can clear it at any time.
The site’s pages load fonts from Google Fonts. When you open one, your browser sends your IP address and user agent to Google, which processes that request under its own privacy policy.
The journal’s articles are public AT Protocol records on a personal data server at pds.notorganic.info. Our server fetches them from there, so reading the journal does not send your information to that data server.
Signing in
Signing in sends you to Not Organic, which handles your password, passkey or other credentials under its own policy. Ephyra receives and stores three things: your DID, your handle, and the Not Organic tokens for your session.
The deployment encrypts the refresh token with AES-GCM, under a key it holds, before storing it in its database. While you sign in, your browser holds a short-lived HttpOnly cookie, ephyra_login, for up to ten minutes. The cookie ties the sign-in callback to the browser that started it.
A session lasts until you sign out or it is revoked or expires. It expires at the end of Not Organic’s refresh lifetime, or after 30 days if Not Organic does not state one.
When you sign in from a terminal, the CLI stores its session in ~/.config/ephyra/credentials.json on your computer, readable only by your user account. Running ephyra logout removes it.
When you approve or reject a checkpoint, the deployment records your DID, your decision, the time and the quest revision. The record goes in the quest’s journal and in the deployment’s audit log, because a reviewable record of who approved what is the purpose of a checkpoint.
Production signals and quests
A deployment receives the errors, traces and logs its operator’s applications send it, along with repository content and forge activity. These can include personal information about the operator’s own users, such as account identifiers, IP addresses or request contents captured in a stack trace.
The operator decides what to send. It is responsible for having a lawful basis and for removing what is not needed before sending it.
Quests record evidence, hypotheses, reproduction scripts, patches and proof as git objects under refs/ephyra/trails in the repository. Excerpts of signals can appear in that evidence. When a quest lands, its commits carry Ephyra-Trail and Ephyra-Proof trailers.
AI providers
To triage a signal, Ephyra sends an excerpt of it to the extraction and decision models the deployment chose. Those can be:
- models hosted through Not Organic, such as Clairic for extraction and Jev for decisions;
- a provider reached directly with the operator’s own keys;
- a model the operator hosts.
To work a quest, Ephyra sends the evidence, code and instructions to the coding agent the operator chose, such as Amp, Claude Code or Codex. Each provider receives the content it needs to answer the request. Hosted model calls through Not Organic use the deployment’s billing account, not the identity of the person who approved the work.
Untrusted content is marked as data in these requests, never as instructions. We do not use your content to train models. Provider retention and training depend on the provider and on the operator’s agreement with it. We do not promise zero retention, and a request is not end-to-end encrypted from the provider that answers it.
Service providers, transfers and disclosures
The service providers page lists who processes what, when, and where. Not every provider receives every person’s information. That depends on the features a deployment uses.
Information may be processed outside your province or country, including in the United States, and is then subject to the laws there.
We may also disclose information when you direct us to, when the law requires it, or when it is lawfully necessary to protect people, investigate abuse or defend legal rights.
Retention and deletion
| Record | How long |
|---|---|
| Website request logs | The hosting provider’s log retention period. |
| Sign-in state | Up to ten minutes. |
| Sessions | Until sign-out, revocation or expiry. |
| Signals, inbox items, jobs and operation records | Kept in the deployment’s database until the operator deletes them. No automatic deletion schedule is implemented yet. |
| Quest journals | Git refs in the repository, kept until someone deletes them. Copies pushed to forges, mirrors or Radicle seed nodes can persist after local deletion. |
| Approval audit records | Kept for the life of the deployment, because they explain why code landed. |
| Journal articles | Public until the author deletes them from the data server. Copies made by feeds, caches and AT Protocol relays are outside our control. |
Your choices and requests
You can ask for access to your personal information, correction of inaccurate records, an explanation of how it is processed, and withdrawal of consent where it applies. You can also ask for deletion or portability where the law provides it. Depending on where you live, you may also be able to object to processing, restrict it, or appeal a decision.
Write to ephyra@notorganic.info. Describe the request and the account or deployment it concerns. Do not send passwords, private keys or API tokens. We will verify identity in proportion to the request. We will respond within the time the law requires and explain any lawful refusal or extension.
The person in charge of the protection of personal information is the operator, Keith Abiola Noel, reachable at ephyra@notorganic.info.
You can also raise a concern with the authority responsible for your location. In Québec, that is the Commission d’accès à l’information du Québec. The Office of the Privacy Commissioner of Canada explains complaint options under the federal laws it administers.
Security
The security page describes how Ephyra protects sessions, secrets and approvals, and how to report a vulnerability. Ephyra is pre-alpha and holds no security certification.
Children
Ephyra is a tool for software teams and is not directed at children. Do not send us information about a child through signals or support requests unless it is necessary and lawful.
Changes
We will post changes here with a new revision date. Before using personal information for a new purpose, we will give any notice and obtain any consent the law requires.