Privacy Policy

1. Foundational Architecture: Desktop-First Workspaces

Unlike centralized SaaS tools that store your full workspace files on remote databases, Pluto is engineered by Hylunian with desktop workspace boundaries. Your workspace source files, terminal execution logs, and session databases remain stored directly on your desktop machine.

2. Data That Stays Exclusively on Your Machine

The following operational artifacts never leave your local physical hardware and are never transmitted to Hylunian servers:

• Long-Term Conversation Vaults: Chat histories, SQLite WAL database files, memory checkpoints, and vector embeddings remain saved in your local directory (e.g. ~/.pluto/vault.db).
• Subprocess Shell Commands & Outputs: Terminal commands, execution stdout/stderr streams, and environment variables are processed directly by your local operating system kernel.
• Local Workspaces & Source Files: Any directories inspected, refactored, or written by Pluto remain isolated to your workstation.
• Local Keyring & Tokens: Third-party API credentials (Google OAuth PKCE tokens, model tokens) are stored in your encrypted local filesystem.

3. Website Portal Data Collection

When you register for the Late November 2026 beta testing cohort through this website (hylunian.com), we collect only:

• Contact Information: Your registered email address to issue beta authentication keys and deliver download binaries.
• Authentication Data: Cryptographically hashed passwords managed securely via Supabase.

We never sell, monetize, or license your contact details to data brokers or advertising third parties.

4. Third-Party Model Providers and Local Mode

If you configure Pluto with third-party model inference endpoints (such as Google Gemini API or Anthropic), inference prompts are transmitted directly from your client to that provider under their respective enterprise privacy terms. When running local open-weights models (via llama.cpp or Ollama), zero network traffic is dispatched externally.

5. Cookies and Tracking Technologies

This website uses only essential session authentication cookies provided by Supabase. We do not use third-party tracking pixels, marketing cookies, cross-site trackers, or behavioral analytics scripts.

6. User Rights (GDPR and DPDPA Compliance)

In accordance with international privacy frameworks including the General Data Protection Regulation (GDPR) and the Digital Personal Data Protection Act (DPDPA), you retain the right to:

• Request full disclosure of your registered email and waitlist status.
• Request immediate and permanent deletion of your account from our beta registry.
• Revoke authorization for beta communications at any time.

7. Data Protection Officer and Privacy Contact

To exercise your privacy rights, request data purging, or discuss Hylunian architecture safety, contact our engineering office: