Privacy

What this covers

The eidos CLI, the Eidos MD desktop app, eidosmd.com, and Eidos online (online.eidosmd.com and the account site, account.eidosmd.com), all made by The Virtual Panda. Eidos online is used only once you sign in. A team’s own server is run by that team, and what it keeps is theirs.

What stays on your computer

Everything you make: blueprints, tasks, comments, canvases, saved AI Agent conversations, and the settings of each project are files in the project’s folder. What belongs to no project, such as the speech model and any key you enter, is kept in the app data folder on your machine. None of it is sent to us unless you put the project on Eidos online (below), and nothing in the CLI or the app reads it to report on it.

What reaches eidosmd.com

Five things besides the usage and error reports below, and nothing that identifies you:

• An install count. After a framework or other package installs from the Registry, by eidos install or from the app, one request goes to eidosmd.com/api/installs with the package’s name and nothing else, so the Registry can show how often it is installed. The site keeps a running total and a count per day for each package, the daily counts for ninety days. Installing from a folder, a repository, or a git URL sends nothing. Turn it off with --offline, or by setting EIDOS_NO_TELEMETRY to any value in the environment the CLI or the app runs in.
• A download count. The download links at eidosmd.com/download/<platform> redirect to the current build, and the redirect adds one to a count for that platform and version.
• Registry listings. To show what the Registry offers, the CLI and the app read its listing from eidosmd.com, the same file this site’s Registry pages read.
• Updates. The desktop app asks dl.eidosmd.com whether a newer version exists, and downloads it when one does.
• Feedback, only when you send it. Send Feedback in the app, or eidos feedback, sends the kind you pick, your description, the eidosmd version, your operating system (its name, release, and architecture), and the view it was sent from. It goes to Eidos online’s service, online.eidosmd.com/api/feedback, which keeps it for the maintainer to read and keeps nothing about who sent it: the address it came from only counts, hashed, against a limit on sends. Nothing from your projects, no file names, and no user or machine identifier go with it. EIDOS_NO_TELEMETRY does not stop it, because it is only sent when you send it.

Usage and error reports

The app and the CLI send anonymous reports of how they are used and what goes wrong, so the next release fixes what actually breaks and builds what people reach for. They are on unless you say no. The app asks once, on its first launch after the update, and sends nothing until you have answered; the CLI says so the first time it runs instead, and sends nothing on that run.

• What a usage report carries. An event from a fixed list (the app opened, a project opened, a page shown by its kind, a command run by its name, a setting changed, a plugin switched on or off, something created or saved, a first such as your first blueprint) with its own short values, and with each: a random install id, a random session id, a random id for the project (kept in its local.yaml, never made from its name or path), the version, your operating system and architecture, your language, and how long ago you installed, in ranges. A project’s size goes in ranges, such as 11 to 50 blueprints. A name you gave (a collection, a property, a plugin of your own) is sent as custom.
• What an error report carries. The kind of error, its message, and its stack, with every path replaced and quoted text cut, the version, your operating system, the same random install id, and where in the app it happened. The desktop app also says when a run starts and ends, and how many errors it met, so the share of runs that end without a crash can be counted.
• What never goes. Your name, your email, a project’s or a file’s name or path, or a word of anything you wrote.
• Where it goes. Usage reports go to eidosmd.com/api/usage and are kept in Cloudflare’s Workers Analytics Engine for about three months. Error reports go to eidosmd.com/api/errors, which forwards them to Sentry, the error service that groups them; the forward carries nothing of your address, so Sentry sees Cloudflare, not you. No advertising or analytics company receives either, and neither is sold or shared.
• Seeing and stopping them. Preferences → General → Usage and error reports shows every report as it left and turns them off, which stops the next send in every window. Setting EIDOS_NO_TELEMETRY to any value turns them off too, and the CLI sends none where CI is set.

What we do not keep

The code that answers these requests stores a package name, a platform, a version, and numbers, and for the usage reports the random ids below, and nothing about who asked: no address and no identifier of yours. Like any website, eidosmd.com is served by a hosting provider, Cloudflare, which handles each request’s network details to deliver it.

Eidos online, once you sign in

Nothing in the app needs an account. Once you sign in, Eidos online keeps what follows so your devices and your team can reach it. It runs on Cloudflare, whose servers store it.

• Your account. Your email, and what you add on the account site: a name, a username, a picture, a password (kept as a hash, never as typed), two-step sign-in, and Apple or Google if you connect them. Each device you are signed in on is listed by its name, with when it was last active, the app or browser it signed in from, and the network (IP) address it signed in from.
• Your picture. If you have not added one, the account site asks Gravatar for the picture tied to your email, sending Gravatar a hash of the email, not the email itself.
• Your settings, kept the same on every device: preferences, appearance and themes, hot keys, and your Me page. Sync my settings turns this off.
• A synced project. Once you turn on sync, every file of the project’s folder is kept on the service, with the history of its edits and its deleted files, so each member receives it. Your own files never go: me.md, each plugin’s local.yaml and local/ folder, .git, and node_modules. A project you do not sync sends nothing.
• Members and invites. Who is on a project, the access each has, and the invites sent. An invite by email sends that address a link.
• Payments. Stripe takes your card in its own fields on the Plan and billing page and keeps it, with your invoices. Eidos never sees the card number, only the brand, the last four digits, and the expiry date Stripe shows back. Eidos keeps your plan: its seats, storage, and server licences.
• Email. Sign-in codes, invites, receipts, and the few emails about a plan are sent through Resend.
• Apple and Google. Signing in with either goes through Apple or Google, which tell Eidos online who you are.
• A new password is checked against known breached passwords by sending Have I Been Pwned only the first five characters of its SHA-1 hash, never the password.
• Errors the service meets are reported to Sentry, as the app’s are, with emails, quoted text, paths, and ids taken out first. The service never sends a request’s headers or body with one.
• Support requests you open on the account site are kept with your account, with the answers.
• What Eidos staff see. An account’s profile, devices, projects, and plan, and a project’s name, sizes, members, and when it was last edited. Staff tools never open a project’s files or show their names.
• Download your data and Delete account are on the account site’s Profile. Deleting is immediate and cannot be undone: each project you own is handed to a member you pick or deleted, your seats, storage, and licences end at Stripe, and your account, settings, and plan are erased. Stripe keeps the invoices as the law asks, and a file’s history in someone else’s project keeps your edits under a deleted account.
• A team’s own server keeps its projects and accounts on that server, not with Eidos. Its licence check sends Eidos only the licence key, a random id the server made for itself, and its count of editors.

How long Eidos online keeps things

Everything below goes when you delete your account, except where it says otherwise.

• A synced project is kept while it is on Eidos online. Its text history keeps the newest 500 editing sessions and none older than 90 days. Its list of deleted files keeps the newest 500, and the asset files removed or replaced in it are kept so they can be restored. Deleting the project from Eidos online removes all of it.
• A sign-in lasts 7 days on a device and renews each day you use it. Signing a device out ends it at once.
• Invites by link last 1, 7, or 30 days, as you pick, and by email 30 days.
• Support requests are kept with your account, until you delete it.
• Feedback is kept with no set end. It carries nothing that says who sent it.
• Invoices stay with Stripe, as tax and accounting law asks, after the account is gone.
• After you delete your account, a file’s history in someone else’s project keeps your edits under Deleted account, and our internal count of what happened on the service keeps a random account id that names nobody any more.

Who handles it, and where

We use a few companies to run Eidos online, each for one job and only with what that job needs. None of them is allowed to use it for anything else.

• Cloudflare runs and stores the service, this site, and the account site.
• Stripe takes payments and keeps cards and invoices.
• Resend sends the service’s emails.
• Sentry groups error reports.
• Apple and Google, only if you sign in with them.
• Have I Been Pwned checks a new password, by the first five characters of its hash.
• Gravatar serves a picture for an account that has not added one.
• Where Cloudflare stores the service’s data is not pinned to one country: it may be in the United States or in another country where Cloudflare runs. We are a US company, and Stripe, Resend, and Sentry handle data in the United States.

Your rights

Wherever you live, you can see what we keep about you, correct it, take it with you, and have it deleted. Most of that is a button: Download your data and Delete account on the account site’s Profile, and your name, email, and picture on the same page. For anything else, such as asking what we keep in more detail or objecting to something, write under Support on the account site, or to the address below, and a person answers within 30 days.

We keep your account and your synced projects to run the service you signed up for, and the anonymous usage and error reports to fix and improve Eidos, which you can turn off. We do not sell or share personal information, for advertising or anything else, and we send no marketing email: only sign-in codes, invites, receipts, a failed payment, the one trial notice, and a seat someone offers you. If you are in the EU or the UK and think we got something wrong, you can also complain to your data protection authority.

Services you connect yourself

Some features talk to another service, most with your own account or key. That traffic goes straight from your computer to the service, not through us, and that service’s own terms and privacy policy apply:

• The AI Agent. It runs the coding agent you already use (Claude Code or Codex, for example) on your computer, signed in as you, in the project’s folder. What you ask, and the files it reads to answer, go to that agent’s provider.
• Dictation. By default your speech is transcribed on your computer: the speech model is downloaded once from Hugging Face and jsDelivr and then runs offline. If you turn on hosted transcription and enter your OpenAI key, each recording is sent to OpenAI with that key.
• Git. Fetch, pull, and push go to the remote you set up, such as GitHub, through git on your machine and the sign-in git already has.
• Registry packages and plugins. A package’s files, and a community plugin’s release, are downloaded from GitHub, where their authors publish them.
• Pictures. Where a person has no picture of their own, the app asks Gravatar for the one tied to their email, sending a hash of the email, never the email. It is on by default; Show Gravatar pictures in Preferences turns it off, and then nothing is sent.
• Jira. The Jira plugin, a community plugin from the Registry, talks directly to your Jira site with the API token you give it.

This website

eidosmd.com runs no analytics script and sets no cookies. It remembers your theme and your language in your browser’s local storage, which never leaves your browser. Its fonts are served from the site itself, and the download counts it shows, npm’s included, come through the site, so a page here makes no request to anyone else.

The account site, account.eidosmd.com, sets only the cookies it needs to work: one that keeps you signed in, and one that keeps the Plan and billing page open, which ends after an hour unused. Neither tracks you anywhere else. Its Plan and billing page loads Stripe’s card fields from Stripe, and a picture may come from Gravatar.

Changes

When this page changes, the date at the top changes with it. How the keys you enter are stored is on the Security page.

Contact

Write to The Virtual Panda at 800 N King Street, Suite 304 #2638, Wilmington, DE 19801, United States, or use Send Feedback in the app or eidos feedback. Put your email in the message if you want an answer.