Privacy

The short version

Your source code never reaches us. Archis compiles, indexes, retrieves and selects context entirely on your machine. Our servers handle your account, billing, licence checks, workspace administration, support requests and release metadata, plus CLI analytics only if you turn them on. Everything they hold is listed below.

What we hold

• Account: your email address, display name, avatar URL and which providers you have signed in with, from Google or GitHub via Firebase Authentication.
• Billing: a Stripe customer reference, your plan, subscription status, period dates and seat count. Card details are held by Stripe and never reach our servers.
• Devices: a one-way hash of a random installation identifier your CLI generates, plus platform, architecture, CLI version and last-seen time. We do not collect hardware serial numbers, MAC addresses or machine names.
• Licence checks: each time the CLI renews its licence we record which device, account and workspace it was issued to, the plan and when. These records are deleted automatically about 34 days after issue.
• Organizations: workspace name, members, roles, seats, policies and an append-only audit log of administrative actions. Where a Team workspace is billed by active developers, the first and last date in each billing period on which each member used the workspace's licence, kept for 400 days so an invoice can be explained.
• Support: the requests you open, the replies, and any screenshots or reports you choose to attach.
• Operational logs: request metadata with a hashed IP address. Access tokens, refresh tokens, ID tokens, activation codes and payment data are never logged.

CLI product analytics

Telemetry is off until you turn it on. Check with chi telemetry status, turn it on with chi telemetry on, off again with chi telemetry off, and inspect exactly what would be sent with chi telemetry preview — that command prints the pending batch and sends nothing.

In continuous-integration environments nothing is collected and you are never prompted, regardless of the setting. Team administrators control the mode for their whole organization, and off is the default.

Never collected — in any mode

There is no setting that enables any of the following, because the server rejects it and the endpoint to receive it does not exist:

Collected when you opt in

Every event below is fixed by an allowlist enforced on our servers. An event that is not on this list is rejected. A property that is not declared for its event is rejected. Numeric values are placed in coarse buckets before storage — we store 1k-10k, never 4,271. Adding a metric requires a server deploy, which is what makes this list reviewable in a single diff.

Identifiers in telemetry

Batches carry a peppered hash of a random installation identifier — not your account, not your IP address. Events are linked to an account only when you are signed in and your organization's telemetry mode is full. In aggregate mode nothing is traceable to a person. Timestamps are truncated to the hour by the client, because minute-level timing on a single developer's machine is a behavioural fingerprint and buys no analytical value.

Analytics events are deleted automatically after 400 days by a database-enforced expiry.

Website and account-portal analytics

The public site and signed-in portal send product analytics to PostHog. That stream is separate from CLI telemetry: it covers funnel events such as sign-in, checkout, downloads and documentation navigation. Events are linked to your Firebase user id after you sign in. Source code, repository contents, prompts, tokens and secrets are never included. Session recording is disabled.

Diagnostics

chi doctor prints what it found and sends nothing; chi doctor --copy also puts that report on your clipboard, to paste into a support request. A crash prints a link that opens a support request in the portal with the version, the platform and where in Archis it died already filled in — you decide whether to submit it. Both can contain repository paths, so read them before sharing. Nothing is uploaded unless you choose to attach it to a support request, and Team administrators can forbid uploads entirely.

Subprocessors

• Google Firebase Authentication — sign-in
• Coolify — application hosting
• Cloudflare — DNS, and R2 for the CLI artifacts you download
• MongoDB Atlas — account, licensing and analytics storage
• Stripe — payments and invoicing
• PostHog — website and account-portal product analytics
• A transactional email provider — invitations and account notices

Final list, regions and the DPA are pending counsel review before launch.

Your choices

• Disable telemetry at any time with chi telemetry off.
• Delete the local analytics queue with chi telemetry purge.
• Revoke any device from the portal or with chi keys devices --revoke <id>.
• Request export or deletion of your account data at [email protected].