Privacy Policy

Who we are

Pyloxa is made by ChiYu-Huang, an individual developer in Taiwan (“we”, “us”). We decide how the personal data described here is used. Write to support@pyloxa.com about anything in this policy.

At a glance

The website

Hosting and fonts

pyloxa.com is hosted on GitHub Pages. When you load a page, GitHub receives your IP address and logs it for security purposes, as it does for every GitHub Pages visitor. The site’s typeface is loaded from Google Fonts, so Google also receives your IP address and browser details when it sends the font; no cookies are involved. Cloudflare answers the DNS lookup for the domain.

Visit statistics

• Cloudflare Web Analytics runs on every page. It counts page views, referring sites, countries, browser types and page load speed. It uses no cookies or local storage and does not fingerprint visitors.
• Google Analytics 4 runs on the home pages and the page-not-found page, but only for visitors outside Europe (see below). It records page views, clicks on download links and the fact that the early-bird form was submitted (not the address you entered). Advertising features and Google signals are off. Google says Google Analytics 4 does not log or store IP addresses. Event-level data is kept for up to 14 months; we see only aggregated reports.
• Visitors in Europe: before loading Google Analytics, the page reads your device’s time zone. If it is in Europe, which covers the European Economic Area, the UK and Switzerland, or in one of their overseas regions, or if it is UTC or can’t be read, the page doesn’t load Google Analytics at all and Google receives nothing from it. Only Cloudflare Web Analytics counts your visit.
• Cookies: elsewhere, Google Analytics sets the cookies _ga and _ga_PWKKJHQV92, which last up to two years, to tell new and returning visitors apart. If Google still locates you in the EEA, the UK or Switzerland, it sets no cookies. You can block these cookies in your browser or install Google’s Google Analytics opt-out add-on.

Pro early-bird list

If you enter your email address in a “Notify me” form, the address goes directly to Buttondown, the service we use to send email. Buttondown sends you a confirmation email first, and you join the list only after you confirm.

• What is kept: your email address, tags showing that you joined the Pro early-bird list and which language page you used, and when you signed up. Buttondown also records technical data such as your IP address, browser and approximate location, as described in its privacy policy.
• What we use it for: one email when Pro launches, with the early-bird offer. We don’t add you to other lists or share your address with anyone else.
• How long: until you unsubscribe or ask us to delete it. Every email has an unsubscribe link. After you unsubscribe, Buttondown keeps a record so you are not emailed again; write to us if you want the address removed completely.
• Joining is optional. Without it you only miss the launch email; downloading and using Pyloxa need no email address or account.

The Pyloxa app

No account, no telemetry

Pyloxa needs no account and has no server of its own. It sends us no usage data, crash reports, project files, prompts or credentials. The usage statistics in Settings are computed on your computer and never sent.

Network requests Pyloxa makes

• Update check: at startup and every 12 hours, Pyloxa asks GitHub (api.github.com) for the latest Pyloxa release and the CLI compatibility catalog. Like any internet request, it reveals your IP address to GitHub; it also carries Pyloxa’s version number, but no project or usage data. Turn it off in Settings → Notifications and updates.
• Installing or updating a CLI: only when you click and confirm, Pyloxa runs the official install command, which downloads from npm or from the CLI’s provider.
• Git and GitHub: fetch, pull, push and pull requests happen only when you choose them, through your own git remotes and your own GitHub CLI sign-in.
• Links in the app, such as the changelog, open in your web browser, where the website section above applies.

AI agents

Pyloxa runs Claude Code, Codex CLI and Gemini CLI on your computer. Those tools send your prompts, your code and the files they read to Anthropic, OpenAI and Google under your own account or API key, and those providers’ terms and privacy policies apply. We never receive this content. Pyloxa does not read, copy or send the CLIs’ sign-in credentials. For Gemini CLI, Pyloxa uses a separate settings folder in which Gemini CLI’s usage statistics are turned off.

Data stored on your computer

• %APPDATA%\Pyloxa holds the projects you opened, conversations, plans, task records and logs, settings and usage statistics.
• API keys you add are encrypted with Windows secure storage and kept in the same folder. Pyloxa passes a key only to the CLI process that runs your task.
• %LOCALAPPDATA%\Pyloxa\worktrees holds the git worktrees where agents work.
• Uninstalling Pyloxa keeps these folders so that you don’t lose your history. To remove everything, delete both folders after uninstalling, then run git worktree prune in your projects.

Diagnostics and bug reports

Settings → Usage and feedback → Copy diagnostics copies your Pyloxa, Windows and CLI versions to the clipboard; nothing is sent. Issues on GitHub are public and covered by GitHub’s privacy statement, so never paste API keys, tokens or code you can’t share publicly.

Services we use

These services handle data for the purposes above. They may process it outside your country, including in the United States.

We don’t sell or rent personal data, and we don’t use it for advertising.

Legal bases

If you are in the EEA, the UK or Switzerland, we rely on:

• Your consent for the early-bird list, given when you confirm your email address. You can withdraw it at any time by unsubscribing.
• Our legitimate interest in running a secure website and knowing how many people visit and download Pyloxa, for hosting logs, fonts and Cloudflare’s cookieless visit counts. The site doesn’t load Google Analytics when your device’s time zone is in Europe.

Your rights

You can ask us to tell you what personal data we hold about you, give you a copy, correct it, stop using it or delete it. These rights come from Taiwan’s Personal Data Protection Act and, for visitors in the EEA, the UK and Switzerland, from the GDPR, which also lets you object to processing, receive your data in a portable format and complain to your local data protection authority.

Write to support@pyloxa.com. For the early-bird list, write from the address concerned so that we can find it. We reply within 15 days and complete a request within 30 days. The visit statistics we see are aggregated and not linked to your name or email address, so we usually can’t pick out one visitor’s records.

Children, security and changes

• The website and the app are not meant for children. Please don’t join the early-bird list if you are under 16.
• The website is served only over HTTPS. Only we can access the early-bird list.
• When what we collect changes, we update this page and the date at the top before the change takes effect. Planned changes that will be covered here before they start: Pro sign-in and payments (handled by a payment provider acting as the merchant of record; we never see your card details), and optional usage statistics in the app that are sent only if you agree. Earlier versions of this page are in the site’s public GitHub repository.
• This policy is also available in Traditional Chinese. If the two versions differ, the English version applies.