What Elyra knows about you

If you accept, we use Google Analytics, loaded through Google Tag Manager. It tells us how many people arrive, where they come from and where they stop reading — and that is how we decide what to fix on this page. This is what it sees:

Pages viewed

which addresses on this site you opened, and for how long

Referrer

the link or search that brought you here — this is what tells us whether a promotion worked

Device

browser, operating system, whether it is a phone or a computer, and the language

Approximate location

city and country, inferred from the IP by Google. The IP itself does not go into the report

To do that it writes cookies in your browser — _ga and _ga_*, which last up to two years and hold a random number. That number carries neither your name nor your email, and it is what lets Google recognize that two visits came from the same browser.

The waitlist email is never sent to Google. The two things described on this page do not meet: whoever is on the list is not identified in the audience report, and the report does not know who signed up.

Audience data is kept for 14 months and then deleted by Google itself. In that processing, Google acts as a processor, under the Data Processing Terms we have accepted with them.

Measurement only starts after you accept in the cookie notice. Before you answer, or if you decline, no Google script is loaded. Your answer is kept in a cookie of ours, elyra-medicao, which lasts one year and holds only the word “aceita” or “recusada” (accepted or declined). To change your mind at any time, use Cookie preferences.

A tracker blocker also prevents measurement, and Google publishes an official opt-out add-on for the browser. None of the measurement affects how the site works: declining breaks nothing.

• Name, phone number, company or job title
• Credit card or any payment data
• Screen recording, heat maps or tracking of your mouse
• Social network pixel — no network learns from us that you were here
• Matching your email against what the measurement sees

When you submit the form, your IP passes through server memory only to rate-limit repeated attempts from the same place, and it is not stored with your signup. This domain sets only three kinds of cookie: the measurement ones, if you accept; elyra-medicao, which keeps that answer; and the session ones, created when you sign in to your account — never on a plain visit.

For your license to work on each computer where you install Elyra, we record the following per device:

Device identifier

an HMAC-SHA256 of your machine, not the hardware identifier itself — the raw value never leaves your computer

Device name

the name you gave it, such as “Janderson’s PC”

System and app version

for example win32-x64 and 0.0.1 — so we know what to support

IP address

recorded on activation, to detect usage outside the expected pattern

Last seen

when the device last validated the license

We count how Elyra's features are used, so we know what to prioritize and what is broken. The system that does this was designed with one strict rule: only a closed enum (a fixed list of possible values) or a number inside a range gets through. Free text does not exist on that path.

What happens

counts of which feature was used, where you opened something from, whether a step finished or was skipped

How each value arrives

always a closed enum (a fixed list of options) or a number inside a range — never free text

What is forbidden by construction

error messages and technical stacks (error_message, error_stack) are rejected by the validator — the whole event is discarded if any code tries to send them

The only documented exception in that validator is a technical message of up to 200 characters about a failure to install a configuration hook for another tool (it is not your content, it is a configuration file error). Apart from that, the error field is refused by construction — it is not a policy promise, it is the validator rejecting the whole event if any code tries.

Public ranking. Each month's token usage and estimated cost, by person, model and agent, appear on the open ranking at elyra.sh/ranking, which anyone can see without logging in. There you appear by first name only — never your last name, email or any other account data. People who turned telemetry off or opted out of the ranking in Settings → Privacy are left out.

When the app crashes or hits a defect and you send a report, it carries:

Message and technical stack

the error text and the trace of where it happened in the code — limited to 2 KB and 16 KB

Version, system and surface

app_version, platform and the area of the app where it happened (surface: renderer, main, daemon or updater)

What you wrote

if you fill in the “what happened?” box, that text goes along — it is the only field in the report written by you, and it is optional (2 KB limit)

Who you are

it comes from your session token, never from a field the app fills in — it cannot be forged in someone else's name

Attachments

the images or videos you choose to attach to the report, up to 4 files of 20 MB each

Before it leaves your machine, the app strips paths containing your home folder name (such as C:\Users\your-name or /Users/your-name). The server applies the same filter again, as a safeguard. No report accepts terminal content, conversation, project name or environment variable — any such field in the request body takes the whole report down.

About what you write: the “what happened?” box is optional and goes exactly as you typed it — we do not fill it in for you, nor complete it with anything from the app. It goes through the same folder-path filter above, but the rest is up to you: do not paste an API key there, nor a piece of code you do not want to share.

There are two moments of sending, and they differ. Automatic: when a screen breaks, only the message and the stack go — nothing written by you. Manual: when you press “Send report”, what you wrote goes too. Both only happen with a license active on this device; without one, the app shows you the details to copy and sends nothing.

Every time you download an installer, we record:

Who downloaded

your account, through the logged-in session

What

which version and for which system

When

the date and time of the download, and the IP and browser used

Elyra is a development environment: it is where your code, your keys and your AI conversations live. None of it is read or sent by the app, in any of the four purposes above:

• The contents of your terminal
• Your conversations with the AI
• The source code of your projects
• Your project names or your file paths
• Any of your environment variables, including API keys

The only way any of these things reaches us is if you type it into the “what happened?” box of an error report and press send. The app never fills it in on its own.

Usage telemetry comes enabled by default, with a notice the first time you open the app saying what is collected and where to turn it off. You can turn it off whenever you want, in Settings → Privacy, on the anonymous usage data toggle.

Two things turn telemetry off from the outside, and they win over any setting of yours: the industry-standard DO_NOT_TRACK environment variable, and automatic detection that the app is running inside a continuous integration (CI) environment. In neither case does a single event leave, even if the toggle is on.

The license and device data (which makes the license work) and the error reports you choose to send have no toggle — they are what makes activation and technical support exist.

Elyra Mobile is the Elyra app for Android and iOS. It is a native shell: it opens, in a view on the device itself, the mobile interface of your Elyra Cloud — the server that is yours, on a VPS or on your computer. Conversations with AI agents, the terminal and your projects come from that server and do not pass through ElyraLabs servers.

To sign in, you type the name of your Cloud and the app shows a code. You approve the device in your Elyra account (app.elyra.sh), in the browser, with a second factor by code sent to your email. No password is typed in the app. After that, this is what it keeps and uses:

Device access

Kept in the system’s secure storage — Keychain on iOS, Keystore on Android. It is what keeps the device connected to your Cloud after you approve it.

Device name

Stored so the device shows up in your account’s list of approved devices. You can change it.

Microphone

Used only when you dictate (on Android, the RECORD_AUDIO permission). The audio is sent for transcription to your own Cloud.

Camera and photos

Used only when you choose to attach a photo. The photo is sent as an attachment to your own Cloud.

Notifications

Local only, generated on the device itself. There is no push token and no push server.

Connection

HTTPS only. Unencrypted connections are disabled, except on the local network.

The mobile app contains no telemetry, analytics, advertising or error-reporting SDK.

Signing out of the Cloud in the app ends the session on the server and deletes the access stored on the device. Uninstalling the app deletes the local data. Like the rest of Elyra, it is meant for people aged 18 or over.

To request deletion of your Elyra account, sign in to the dashboard and use Profile › Delete account, or, without signing in, the form at Delete your Elyra account.

To buy and use Elyra you create an account in the dashboard (app.elyra.sh). It holds your name, your email and, if you fill it in, your company. Your password is stored only as a hash, never as the text you typed. If you sign in with Google or GitHub, we receive your name, email and profile picture from them, and no password. If you sign in with Apple, we receive your Apple Account identifier, your email — which may be an Apple relay address, if you choose to hide yours — and your name, only on the first sign-in; no password and no photo. We also keep the token Apple issues at sign-in, so we can ask Apple to revoke Elyra’s access when you delete your account.

Each time you sign in, we record a session with the IP address and browser used, and a session cookie keeps you signed in. They exist to keep you logged in and to investigate unauthorized access to your account. The session ends when you sign out or when it expires.

Payments are processed by Stripe (card) or Woovi (Pix). Your card number is typed on Stripe’s page and never passes through our servers. With Pix, the CPF you enter goes to Woovi; on our side we keep only a keyed fingerprint of it (HMAC), to recognize purchases made with the same document, and its last four digits, so you can recognize the receipt. With Pix Automático, Woovi also receives your address, of which we keep only the postal code (CEP). To prevent repeated free trials, we store only server-keyed hashes of the card identifier provided by Stripe, normalized email, Pix payer’s CPF, device verified at activation, and IP used to limit trial starts. Stripe does not send us the card number. We also decline disposable email addresses; regular purchases remain available.

We keep the history of your charges — plan, amount, dates, status and refunds — and the version of the Terms of Use you accepted when buying. Account emails, such as password resets and billing notices, are sent through an email delivery provider we hire as a processor.

For the waitlist, the legal basis is your consent (LGPD, art. 7, I), given when you submit the form. The purpose is single and declared: to let you know when the beta opens, and to send relevant news about the product. No other use.

For audience measurement, the basis is your consent (art. 7, I), given in the cookie notice. You can withdraw it at any time under Cookie preferences, and declining changes nothing about how the site works.

For your account and purchases, the basis is the performance of the contract (art. 7, V). The charge history and the record of which version of the Terms you accepted also rest on compliance with a legal obligation (art. 7, II) and the regular exercise of rights (art. 7, VI): that is what lets us prove a charge or a refund.

For the license and devices, the basis is performance of the licensing agreement (art. 7, V): without that data there is no way to know that your device is entitled to open the app. For usage telemetry and error reports, the basis is the legitimate interest in maintaining and improving the product (art. 7, IX), with the opt-out described above as the way to object.

In private storage on Vercel, our infrastructure provider, acting as a processor. Your email is encrypted before it is written — which is why the record field is named emailEnc and not email. Anyone who obtained the raw file would not read the address without our key, which does not live alongside the data.

We do not sell, rent or share the list, and we do not use it to feed anyone's advertising.

The license, the error reports and the download records live in Supabase's Postgres database and in Vercel's storage, both contracted by us as processors. The installers themselves live in a private Cloudflare (R2) bucket, and the download link is signed with a 60-second validity — passing it on is useless.

Every error report also becomes an issue in a private repository of our organization on GitHub, contracted by us as a processor, where the team tracks the fix. The issue carries the entire report — including your name, your email, what you wrote and the attachments. That issue is read by people on the Elyra team, who may also receive it by email from GitHub, and by the AI assistants the team uses to write code. Attachments are shared through a link that works for 7 days for whoever holds it. If you ask for your data to be deleted, we also delete, on GitHub, the issues that contain it. Reports sent through our WhatsApp bot follow the same path and carry the text, the image (when there is one), and the name and phone number of whoever sent it.

Usage telemetry goes to PostHog, a product analytics platform contracted by us as a third-party processor. We send PostHog nothing from the other three purposes — license, error and download do not pass through it.

If you join the Elyra community on WhatsApp, your name and number are visible to the other members, as in any group. WhatsApp belongs to Meta, and using it is governed by Meta’s terms.

Several of these providers — among them Vercel, Supabase, Cloudflare, GitHub, PostHog, Google and Stripe — store data outside Brazil. That international transfer relies on the contractual safeguards they offer (LGPD, art. 33).

If a security incident occurs that may pose a significant risk or harm to you, we notify you and Brazil’s data protection authority (ANPD), as the LGPD requires (art. 48).

Waitlist: until the beta opens and you are invited, or until you ask for deletion — whichever comes first. If the beta is canceled, we delete the whole list.

License and devices: for as long as your account and your license exist. Revoking or deactivating a device changes its state, but does not erase the history by itself — deletion of account data is always on request, as described below.

Account: for as long as it exists. Sessions: until you sign out or they expire. Charge history and the record of accepted Terms: for as long as tax and consumer law require, even after the account is deleted.

An open item we are admitting here: we do not yet have a defined retention period for error reports and download records, nor automatic deletion over time. Until that is decided, what applies is the deletion-on-request paragraph right below — not a fixed period that does not exist yet.

The LGPD (art. 18) guarantees that you may ask, at any time, for confirmation that we process your data, access to it, correction, portability, withdrawal of consent and deletion — for the site and the app. Write to contato@elyra.sh and we reply within 15 days.

Deletion is always done by us, at your request — there is no button that deletes the account instantly. While signed in, request it in the dashboard, under Profile › Delete account (app.elyra.sh/conta/excluir): there is no email to answer, we complete it within 15 days, we email you when it is done, and until then you can cancel the request. On deletion, we deactivate your devices, revoke the license, ask Apple to revoke Elyra’s access if you sign in with it, and delete whatever we are not legally required to keep, such as the charge history.

To request deletion of your account without the app and without signing in, use the form at Delete your Elyra account.

If we do not answer in time, or the answer does not settle it, you can complain to the ANPD.

ElyraLabs, the company behind Elyra, is the controller of the data described here. For any matter concerning this page, the channel is contato@elyra.sh.

Elyra is meant for people aged 18 or over, and we do not knowingly collect data from children or teenagers.

If what we do with your data changes, this page changes with it and the date at the top is updated. A change that widens the purpose of the processing is announced by email to account holders and everyone on the list, before it takes effect.