Privacy

Exeora is operated by Leynier Gutiérrez González, an individual based in Mexico, who is the data controller for the personal data described here. For anything in this notice, write to hello@exeora.dev.

What is never collected

This is the part that matters most, so it comes first. Code on a machine of yours never leaves that machine. The gateway relays a tool call to the machine and relays the answer back to the AI client that asked; nothing in between is stored.

The one exception is one you choose: a project you put on Exeora Cloud is cloned onto instances Exeora operates on Fly.io, one per workspace, and lives there until you remove them. Nothing on an instance is read by Exeora other than to relay your own calls. Nothing copies files between the places a project lives: work moves between them through the repository's own remote, when you or an agent push and fetch.

• No source code. Nothing read, written or searched is kept.
• No tool arguments. Not the file paths asked for, not the patterns searched for, not the commands run. The dashboard's Logs view shows them to the project's owner as calls run, in passing, the way an approval's question does, and keeps none of them.
• No tool output. Not what a command printed, not what a file contained.

What is stored

• Your identity. When you sign in with GitHub or Google: a provider account identifier, your verified email address, your display name and your avatar URL. The identifier keeps later sign-ins attached to the same account. Verified addresses shared by both providers are linked to one Exeora account.
• Your machines. The name you gave each one, its platform, the CLI version it reported, and when it was last seen. The last-seen time is what draws the online badge. The instances Exeora Cloud runs for you are kept the same way, with the project and workspace each was made for, its state, and why it failed when it did.
• Your projects. The name and slug you chose and, when the project is a repository, the https address of its remote and its default branch, without any user name or token that was written into the address. The address is what lets a second machine or Exeora Cloud hold the same project.
• Where each project lives. For every location, the machine it is on, the absolute path of the project's directory there, and whether the copy is ready, being cloned or failed, with the reason when it failed. The path is stored so the dashboard can show you which directory a project is, and is never sent to a tool: the CLI on the machine is the authority on where a project lives.
• Your connection to GitHub, if you make one. Which installations of the Exeora app GitHub listed for you, with the account or organisation each is on. Which repository each connected project is: GitHub's id for it, its full name, and whether it is private. Your GitHub login, and the token that lets Exeora ask GitHub, as you, which repositories you can reach, with the token that renews it. Those two are stored encrypted. See connecting GitHub.
• A repository token you give. Only for a repository on another Git server that you put on Exeora Cloud. It is stored encrypted, handed to the instances of that project as they are set up, and deleted with the project.
• Authorized clients. Which AI clients you approved against which project, what each called itself, when it was authorized and when it was last used.
• The activity log. Which tool was attempted, whether its outcome is known, whether it succeeded, how long it took, an error code when it failed, and which client asked. Never the arguments, never the output. An intent and its outcome are stored separately and shown as one execution. Free Activity shows the last 24 hours; physical cleanup is described below.

Exeora for Chrome

The Chrome extension shows the dashboard's Workspace screen in Chrome's side panel. It collects nothing beyond what the dashboard does, and it reads nothing from the pages you visit: its only host permission is exeora.dev, where its requests go. Like the dashboard, it shows your profile picture, which the browser loads as an image from the provider you signed in with (GitHub or Google).

• In your browser. The extension keeps the session it was given when you signed in: a refresh token in Chrome's extension storage, so a restart does not sign you out, and an access token that lasts an hour in memory. Signing out of the panel deletes both and revokes the session on Exeora.
• On Exeora. That you approved the extension, when, and for which extension id, and one session for each browser signed in. Revoking the extension from Settings in the dashboard ends every session and forgets the approval.

What you see and do in the panel (changes, diffs, commits, terminals) passes through Exeora the same way it does from the dashboard, and is not stored beyond the activity log described above. Data the extension handles is used only to provide the side panel, is not sold or transferred to anyone, and is not used for advertising, creditworthiness or any purpose unrelated to it, in line with the Chrome Web Store User Data Policy, including its Limited Use requirements.

Why

All of it exists to provide the service and to let you see and control it: to know which machine serves a project, to show you what an agent has been doing, and to let you cut off a machine or an application when you want to. There is no advertising, no profiling and no analytics on the dashboard.

Who else sees it

Exeora runs on Cloudflare, which processes and stores this data on its infrastructure on our behalf. Signing in goes through GitHub or Google, whichever you choose, and that provider tells us the identity fields listed above. The CLI is distributed through GitHub releases. Nothing is sold, and nothing is shared with anyone else except where the law requires it.

Two more parties are involved only if you use what involves them. If you connect GitHub, Exeora asks GitHub which repositories you can reach and asks it for the tokens that clone and push. Those tokens last an hour, reach one repository, and are not stored. If you use Exeora Cloud, your instances run on Fly.io, and the repository is cloned there from its host.

Where

The service runs on Cloudflare's global network, so data is processed in whichever region serves your requests, which may be outside Mexico.

Your rights

You may ask for access to your personal data, and for it to be corrected, deleted or its processing objected to, which are the ARCO rights under Mexico's federal data protection law for data held by private parties. Two of them need no request at all:

• Access. Your account data and recent activity are shown in the dashboard, on the machines, projects, clients and activity screens. Contact us for other retained data.
• Deletion. Deleting your account removes its active identity, machines, projects, authorizations and what was stored of its connection to GitHub, and queues erasure of its audit archive. Archive erasure is asynchronous and includes a later pass to catch events already in flight. Account deletion cannot be undone.

For anything else, or if you would rather not use the dashboard, write to hello@exeora.dev.

How long it is kept

Free Activity exposes a rolling 24 hours; accounts on a longer plan use that plan's window. A recurring maintenance job removes expired rows through the archive catalog once usage accounting has consumed them. Physical copies can remain longer in stream buffers, recovery records and snapshots, and while maintenance is delayed. The visibility window is not a guarantee that all copies are physically deleted within 24 hours.

Daily usage totals outlive detailed activity so the dashboard can report monthly usage. Account metadata and those totals are kept while the account exists; archive erasure is requested when the account is deleted.

Cookies

One signed cookie, set during sign-in, so the authorization screens know who you are while you approve an application. There are no analytics or advertising cookies anywhere on this site.

Changes

This notice may change. The date above says when it last did, and a change to what is collected will be announced in the dashboard before it takes effect.