Privacy policy

1. Who this policy covers

Eido is the Australian operator of the Eido desktop application, eido.so, and updates.eido.so. In this policy, “Eido”, “we”, and “us” mean that operator.

We use the practical standards in the Australian Privacy Principles as our baseline for everyone. Where the Privacy Act 1988 (Cth) or another privacy law applies, we also follow the obligations that law places on us. This policy is notice. Agreeing to it is not consent to unrelated or new uses of information.

This policy covers information handled by Eido. Services you connect using your own account or API key also have their own terms and privacy practices.

2. What stays on your device

The installed Eido Profile is a local SQLite database. It can hold your Ideas, boards, cards, connections, attachments, prompts, generated results, conversations, Mods, history, settings, and activity or provenance records. Eido does not operate a hosted Profile database or cloud sync service today. When you sign in, Eido creates or uses an Account for hosted features and loads an Account snapshot; that snapshot does not contain your Profile content.

Your OpenRouter and Linkup API keys are stored outside the Profile and are excluded from Portable Exports. They are kept in local files protected by your signed-in operating-system account and file permissions. They are not encrypted by Eido or stored in the operating system's credential vault, so another process running as the same operating-system user may be able to read them.

You can create a Portable Export of the logical Profile and its referenced assets. It does not include API keys, SQLite working files, or every device-only setting. Local agents and command-line tools you invoke can make bounded, allowlisted reads or changes to the installed Profile; their activity can be recorded in it.

3. When information leaves your device

Nothing is sent to an AI or web provider merely because it is on a board. A transfer happens when you start an action that needs an outside service, when a signed-in Account snapshot performs the essential managed-route eligibility check described below, or when you separately allow product analytics.

You run AI

Eido can send the compiled prompt, relevant connected card content, selected settings, and included images or files.

OpenRouter routes the model you choose to a downstream provider selected under OpenRouter's routing and your account settings, or a locally invoked AI tool handles the request under its own provider account. You start the run.

You read, search, or research the web

Eido can send the public page address, search question, page request, or research brief needed for the action.

Jina Reader, Linkup, OpenRouter, or a routed provider performs the action, depending on the feature and credentials you use.

Managed-route access evaluation

When a signed-in Account snapshot loads and evaluates managed OpenRouter or managed Linkup access, Eido's server sends PostHog only an opaque Eido Account ID and the current Tier and rollout audience. This essential service check runs even when optional product analytics is off.

The evaluation contains no board or card content, prompts, AI output, provider keys, URLs, filenames, or other task data. Stale or unavailable account facts are sent as unknown; the audience allowlist is server-only.

You allow product analytics

Eido sends a random installation identifier, a launch-scoped session identifier, and a small allowlist of product outcomes, app version, platform, architecture, and coarse reliability data.

PostHog receives this only after you opt in. You can withdraw in Eido's Privacy settings.

You visit, download, or check for updates

Cloudflare receives ordinary connection information such as IP address, request time, requested page or file, and network or browser information.

Cloudflare serves and protects the website, installers, and signed update files. These requests do not upload your Profile.

Eido does not proxy AI or web requests through an Eido server. The request goes from your device to the service performing the action. Context can include more than the text visible in one card, because Eido may compile connected material and attachments for the run.

Eido does not ask you to place sensitive personal information in a board or prompt. Keep sensitive information local unless you understand the recipient's terms and have authority to disclose it, especially where it concerns another person.

4. Optional product analytics

Product analytics is off until you make an affirmative choice. Browser Do Not Track also keeps it off. Declining does not remove an Eido feature.

If you opt in, Eido sends PostHog a random installation identifier and allowlisted events such as a session starting, a card or connection being created, an onboarding milestone, whether an AI run started or succeeded, a coarse failure or duration category, an import or export, a feature outcome, or an update stage.

The analytics boundary is built not to send board or card content, prompts, AI responses, filenames, URLs, file paths, Profile, Idea, card or run identifiers, model names, provider keys, raw error messages, console output, session replay, or autocaptured interface text. Eido does not call PostHog's person-identification feature. The random installation identifier is pseudonymous, not proof of an anonymous person.

Withdrawing stops future events and removes the local installation identifier. It does not automatically delete events already held by PostHog. The analytics installation identifier is not linked to your Eido Account or name, so we may be unable to locate historical events after the local identifier has been removed.

5. Providers and their jobs

We name material providers rather than hide them behind “trusted partners”. Their policies can change, and the selected AI route can use additional subprocessors. Check the provider controls connected to your own account before sending sensitive material.

OpenRouter and routed model providers

Perform online AI runs you start using your OpenRouter API key. OpenRouter receives the compiled run material and routes it to the selected model provider. Attachments may use separate tools: Eido's current PDF path asks OpenRouter to use Cloudflare AI for parsing. Retention and model-training rules depend on your OpenRouter settings, the selected endpoint, and enabled tools. Eido does not currently force Zero Data Retention on the request. Read OpenRouter's privacy policy, provider information, and ZDR controls.

Linkup

Performs web search, page fetch, or research when you add a Linkup key and use those tools. It can receive the search question, public page address, filters, and research brief. A submitted research job cannot currently be cancelled at Linkup; Eido's Cancel action stops waiting and polling. Read Linkup's privacy policy.

Jina Reader and Elastic

Fetch a public webpage when you ask Eido to read that address. The service receives the address and ordinary network metadata, not the rest of your board through that feature. Jina documents a short cache for repeated reads. Read the Jina and Elastic legal notice.

PostHog

Receives the essential managed-route evaluation fields described above when a hosted snapshot requires them, and receives the limited product analytics described above only after opt-in. PostHog processes them under the region, retention, and network-data settings configured for Eido's project. Read PostHog's privacy policy.

Cloudflare

Serves and protects eido.so, installers, and signed update files. It processes ordinary network and security metadata. The site is static and Eido adds no advertising or website-analytics scripts. Cloudflare also participates in PDF parsing when that OpenRouter feature is used. Read Cloudflare's privacy policy.

AI tools installed by you

Eido can invoke supported tools such as Claude Code, Codex, or Antigravity on your device. “Locally invoked” does not necessarily mean local inference: the tool may send prompts and attachments to its provider using your existing account. That provider's terms and privacy practices apply.

6. What we handle and why

Local Profile and settings

Eido's software handles Profile content and device settings to save, display, edit, export, recover, and run the features you request. The operator does not receive a hosted copy through ordinary local use.

AI and web requests

Eido sends the request material to provide the action you started. Where EEA or UK law applies, the usual basis is taking steps at your request or performing our agreement with you. Separate consent may be needed for sensitive information or another purpose.

Account and managed-route eligibility

When you sign in, Eido uses an Account to load the current Account snapshot for hosted features. An essential managed-route evaluation may send PostHog only the opaque Account ID, current Tier, and rollout audience, even when optional product analytics is off. It never sends prompts, queries, results, board or card content, attachments, or provider credentials.

Analytics

If you consent, limited analytics helps us understand activation, feature use, reliability, and update success. Consent can be withdrawn at any time without affecting earlier lawful handling.

Website, downloads, updates, and security

Routine request data is processed to deliver pages and files, verify updates, maintain availability, and protect the service. If EEA or UK law applies, we rely on our legitimate interests in secure, reliable delivery where those interests are not overridden, and on legal obligations where required.

7. Overseas processing

Eido is operated from Australia. Cloudflare uses a global network. OpenRouter and some model providers process in the United States or other countries shown in their current provider information. Linkup states that its processing occurs in the European Union. PostHog can be configured for the United States or European Union. Local AI tools can use the locations disclosed by their provider.

The countries involved can change with the model, endpoint, tool, subprocessor, and your account settings. Where cross-border privacy rules apply to Eido, we take reasonable steps and will put an applicable lawful transfer mechanism in place before Eido initiates a transfer that requires one. A privacy policy is not itself a transfer safeguard.

8. Retention and deletion

Local Profile data remains on your device until you edit or delete it, replace the Profile, remove application data, or the operating system removes it. Deleting an Idea removes it from the active logical Profile, but limited recovery generations, tombstones, blob material, quarantined files, or operating-system backups may remain for a time. Eido does not promise immediate secure erasure of every physical copy.

API keys remain in their separate local files until you clear them or remove the relevant application data. Clearing a key does not promise forensic secure erasure from storage media or backups.

Provider retention follows the provider, endpoint, account settings, and contracts described above. For analytics, the PostHog project setting controls the maximum event-retention period. We retain legal records only while reasonably needed for safety, disputes, or legal obligations.

9. Security

Eido uses measures intended to protect the product boundary, including an isolated desktop renderer, a restrictive content security policy, permission-protected credential files, defensive SQLite settings, bounded local agent interfaces, and cryptographically verified updates. No software or storage method is perfectly secure. Your device security, operating-system account, connected providers, and backups remain part of the protection boundary.

If a data breach affects personal information Eido controls, we will assess it and notify affected people and regulators where required by law, and otherwise where notice would help people protect themselves.

10. Your choices and rights

• Keep ordinary board work local by not starting online AI or web actions.
• Choose which supported AI route or tool handles a run.
• Decline or withdraw product analytics in Privacy settings.
• Clear stored API keys.
• Create a Portable Export of your Profile.
• Edit or delete Ideas in the active Profile, subject to the local recovery limits above.
• Ask us to access, correct, delete, restrict, or explain information Eido controls, where reasonably possible and legally required.
• Complain about our handling of personal information.

Local product use can remain account-free, but signing in creates or uses an Eido Account. The operator does not hold your local Profile, so we usually cannot access, correct, or delete that local content for you. A request may require enough information to verify your identity and find the relevant record without exposing more data than necessary. Legal rights are subject to exceptions; if we refuse a request, we will explain why where the law requires it.

11. Children

Eido is for people aged 18 or older, or the age of legal majority where they live. It is not directed to children. Do not use Eido to send a child's personal information to an online provider unless you are legally authorised and the provider permits it. If we become aware that a child has provided information to Eido's operator, we will investigate.

12. AI and automated decisions

Eido's current AI features help generate, organise, and explore material. Eido does not use personal information to make eligibility, employment, credit, health, insurance, or similarly significant automated decisions about people. AI output can still affect a person if a user chooses to rely on it. Review important output and keep a person responsible for consequential decisions.

13. Regional information

Australia

We aim to apply the practical protections described in this policy to everyone. If the Privacy Act applies to our handling, you may have rights under the Australian Privacy Principles. You can complain to us first and, where the Act applies, to the Office of the Australian Information Commissioner.

European Economic Area and United Kingdom

If EU GDPR or UK GDPR applies, you may have rights to information, access, correction, erasure, restriction, portability, objection, consent withdrawal, and safeguards for certain significant automated decisions. You may complain to the supervisory authority where you live or work. These rights are not absolute. Australia is not treated as adequate by the EU or UK, so applicable transfers need a separate lawful mechanism. If Eido begins targeting these markets in a way that requires an EU or UK representative, we will publish that representative's details before doing so.

California and other United States states

If a state privacy law applies, you may have rights to know, access, correct, delete, or receive certain information, and to opt out of certain sale, sharing, targeted advertising, or profiling practices. Eido does not use personal information for cross-context behavioural advertising and does not receive payment for personal information. Whether a vendor relationship has a statutory “sale” or “sharing” label depends on the law, contract, and actual use. We will not discriminate against you for exercising an applicable right.

14. Changes to this policy

We will update the effective date and keep prior material versions available when practical. If a change materially expands what Eido collects, why it is used, or who receives it, we will give a clear notice before the new practice begins where practical and obtain consent where law requires it. We will not treat this policy as blanket permission for an unrelated use.