Privacy
Privacy policy.
Plain-English version of how eri handles your data. The operator is one person, in Ontario. There's not much to collect, and what there is doesn't get trained on.
Last updated · May 23, 2026
1. The short version
eri is a desktop app. Voice, gaze, and the editor run on your machine. Account state and billing run in the cloud — that's it. The operator does not train models on your prompts, your code, or your voice. This policy explains, in plain English, what data the operator collects, where it lives, and how to make it go away.
2. Who is collecting your data
eri is an independent project operated by a solo developer in Ontario, Canada. There is no corporate entity. "The operator" in this policy means that person. Contact: phlotu@gmail.com.
3. What the cloud side collects
When you create an account, the operator stores: your email; a salted hash of your password (or the OAuth identifier if you signed in with Google); your subscription state from Stripe (plan, status, renewal date); and aggregated usage counters used to enforce plan limits. That's the full list. Prompts, code, voice recordings, and gaze data are never sent to the cloud.
4. What stays on your machine
Microphone audio, the wakeword detector output, the gaze estimator output, every file in every open project, your shell history, and any local model weights all stay on your device. The eri client is designed so there is no code path that uploads them.
5. Model calls
When you trigger a cloud-backed edit, eri sends the relevant code context to Eri Cloud inference. If you've configured an external or local endpoint with your own key (BYOK), the call goes there instead and the operator does not see the request body. For the proxied case, requests are forwarded without logging request or response bodies.
6. Cookies & analytics
The website uses essential first-party cookies for sign-in sessions and remembering your theme. There may be lightweight product analytics on the website (anonymous event counts — no PII, no advertising trackers). Full breakdown lives at /legal/cookies.
7. Sub-processors
The operator uses a small set of third parties to run eri: Stripe (billing), Supabase (database + auth), Vercel (web hosting), Resend or a similar provider (transactional email), and your chosen model provider. The full current list lives at /legal/sub-processors and is updated when it changes.
8. Your rights
If you're in Canada, the EU/UK, California, or anywhere with comparable laws, you have the right to access, correct, delete, and export the personal data the operator holds about you. Use the dashboard to delete your account, or email phlotu@gmail.com. The operator will respond within 30 days. PIPEDA, GDPR, UK GDPR, and CCPA-style requests all route to the same address.
9. International transfers
Sub-processors may store data in Canada, the United States, or the EU depending on the provider. Where transfers are subject to GDPR/UK GDPR, Standard Contractual Clauses are relied on. If you'd rather not have your data leave a specific region, eri may not be the right tool right now.
10. Retention
Account data is kept while your account is active. After you delete an account, the operator removes the account record and associated data within 30 days, except for billing records that tax law requires to be kept longer (in Canada, six years).
11. Security
Passwords are stored as salted hashes — the plaintext is never persisted. All traffic uses TLS. BYOK API keys are stored encrypted in your OS keychain (macOS Keychain, Windows Credential Manager, Secret Service on Linux) and never sent to the operator's servers. The operator is one person and does not claim a SOC 2 audit, ISO certification, or anything similar. Treat eri's cloud side as the security profile of a well-run indie project, not an enterprise vendor.
12. Telemetry & crash reports
If crash reporting is enabled, eri may send anonymous stack traces and version metadata to help the operator fix bugs. Crash reports never include file contents, prompts, audio, or keys. You can disable telemetry in Settings → Privacy.
13. Training
The operator does not train models on your prompts, code, or any data you put into eri. The external endpoints you connect have their own training policies — check their privacy pages. Eri Cloud inference passes data through without retaining it for training.
14. Children
eri is not intended for users under 13 (or under 16 in jurisdictions with a higher age of digital consent). The operator does not knowingly collect data from children. If you believe a child has signed up, email phlotu@gmail.com and the account will be removed.
15. Automated decision-making
The operator does not make decisions about you that produce legal or similarly significant effects based solely on automated processing. Model output is a tool to help you write code; we do not use it to grant or deny access, set pricing tiers, or evaluate you in any way that has a meaningful real-world impact.
16. Breach notification
If the operator discovers a security incident that compromises personal data, affected accounts will be notified by email without undue delay and, where applicable laws require it, within 72 hours of discovery. The notice will explain what happened, what data was involved, what's been done about it, and steps you can take. The operator also notifies the Office of the Privacy Commissioner of Canada when required under PIPEDA.
17. Data minimization
The operator collects only what's needed to run eri. There are no behavioural advertising profiles, no third-party advertising cookies, no data brokers, no cross-site tracking, and no "shadow" telemetry that records what you type or build. If a feature can ship without collecting data, that's how it ships.
18. Do Not Track and Global Privacy Control
The website honours the Global Privacy Control signal where applicable: receiving GPC is treated as a deletion-of-cookies and opt-out-of-analytics request for that browser. Do Not Track headers are also respected as a signal even though the standard is informal.
19. Changes to this policy
If the operator makes a material change, accounts with an active subscription get an email at least 30 days before the change takes effect. Cosmetic edits are made in place. The revision date below always reflects the current version. Continued use after the effective date counts as acceptance.
20. Contact
Privacy questions, access requests, and deletion requests all go to phlotu@gmail.com. For everything else, see /contact.