Privacy

Nothing described in "The contract a future telemetry channel must follow" below is live yet. Circinus — the runtime you install — has no telemetry client, no hosted telemetry endpoint, and no account system; it runs entirely on your machine and calls nothing of ours. That section is a forward disclosure of the contract any future telemetry and hosted-service work in Circinus is bound to follow, so you can hold us to it before it exists rather than after.

This website (circinus.horo.run) is a separate, narrower case, and it is live now — see "Website analytics (this site)" below.

The local-first baseline, which is live today​

No context leaves your machine unless you configure your own model provider key (BYOK — bring your own key). There is no Circinus-operated service today, no telemetry endpoint, and no account. The enforcement decision at the action boundary is a local read against a local SQLite database — it never requires a network round trip.

Website analytics (this site)​

This is about circinus.horo.run itself — the marketing/docs website you are reading — not the circinus runtime described everywhere else on this page. They are governed separately and this section will not be conflated with the runtime telemetry contract below.

This site is instrumented with Google Analytics 4 (GA4) to measure basic acquisition: which pages get viewed, whether the install/quickstart path gets clicked, and which marketing channel (utm_source/utm_medium/ utm_campaign/utm_content) a visit came from. GA4 is provided by Google — using it means Google processes visitor data for this site (page paths, referrers, UTM values, and Google's own coarse device/geo/IP-derived signals) under Google's terms, separate from the Google Cloud/Neon/Dodo Payments sub-processor list below, which is about the hosted product service, not this website.

• The GA4 Measurement ID is never hardcoded. It comes from an environment variable the Production deploy pipeline sets; HORO-348 (a separate, external GA-account ticket) is what supplies a real one. With no ID configured, GA does not load and fires nothing — this is the default today, since HORO-348 has not shipped.
• Local development and any preview/staging build must not contaminate Production GA data. The site only loads GA when a Measurement ID is present and the build is gated as production (see docusaurus.config.js); the operational guarantee is that the Measurement ID variable is set only in the Production deploy pipeline.
• The event parameters are low-sensitivity by design: a page identifier, UTM string values (bounded length, expected from a fixed channel list — see ANALYTICS.md in the site source), and for a not-yet-built "fake door" feature-interest event, a closed feature_id enum. The same denylist as the runtime's applies here: no prompt/source/code content, no tool arguments, no repository names or paths, no raw provenance text, no secrets, no customer/company names.
• A GA outage or a blocked script never breaks the page. Event calls are no-ops (not errors) whenever window.gtag isn't defined, and the loader itself degrades silently on failure.
• No cookie-consent banner ships with this instrumentation yet; that is a known, accepted gap for the Alpha rather than a hidden one, to be revisited once HORO-348 actually turns GA on for real visitors.
• GA's own data-retention window will be set when the GA4 property is created under HORO-348; this page does not promise a specific number ahead of that because none exists to promise yet.

The contract a future telemetry channel must follow​

When Circinus adds a hosted service, it will support two distinct kinds of outbound call, governed differently. They will not be conflated.

1. Passive product telemetry — background usage counts and flags, sent without you acting in the moment. Gated by a telemetry.enabled setting that is off by default. If it is off, none of this is sent, period.
2. Explicit account actions — things like checkout or entitlement refresh, which you trigger yourself. Typing the command and confirming it is the consent for that one action, independent of the telemetry setting — turning telemetry off will not block you from managing an account you chose to create. These calls carry their own closed request schemas, separate from the telemetry allowlist below.

Telemetry will be opt-in and disclosed before it sends anything​

• Default will be off. A fresh install will send nothing.
• Enabling it will require an explicit telemetry.enabled = true in the config file — no implicit enablement from an environment variable, from having an account, or from having paid.
• The first run after install will state plainly that telemetry is off, exactly what it would send if enabled, and how to turn it on.
• Turning telemetry off will remove the passive telemetry path entirely — there is no planned "minimal" or "essential" tier that ignores the setting.

The complete allowlist for passive telemetry, once it exists​

This is the entire list. Adding a field requires a new ADR (ADR-0011 in the repository, which this page summarizes; the repository itself is not yet public).

Plus a transport-level sent_at timestamp and a schema version. That is the entire list — no rule identifiers, no finding categories, no tool names, and no content are on it.

What will never be sent, under any setting​

Prompt content, source or document content, source code, shell and tool arguments, repository names, file paths and path fragments, raw provenance text, secrets/tokens/credentials of any kind, inferred customer or company names, hostnames/usernames/IP addresses collected by us, and anything derived from the above by hashing, truncation, or embedding. A hash of denylisted content is still denylisted — hashing does not make it safe to send.

install_id and session_id will be randomly generated, never derived from your hostname, MAC address, username, or machine id.

Retention and deletion, once telemetry exists​

• Telemetry rows: kept for 90 days, then deleted by a scheduled job. That is a retention limit, not a target.
• Deletion on request: you will be able to email a published address quoting your install_id (shown by circinus status), and matching rows will be deleted within 30 days. There is no self-serve deletion API or DSAR portal planned for the Alpha — that is the honest posture rather than a hidden gap.

Sub-processors, once the hosted service exists​

The Alpha's planned sub-processors for the hosted product service are Google Cloud (hosting), Neon (database), and Dodo Payments (billing). No others are planned, and this list will be kept current here rather than only in an internal document. Separately, and already live, this website uses Google Analytics 4 (Google) — see "Website analytics (this site)" above.

What this page does not claim​

This is an Alpha posture, stated plainly rather than implied away. Cloud Run's own HTTP request logs will contain client IP addresses, as any HTTP service's do — "we never collect IP addresses" would be false, so this page does not say it. Those addresses will not be joined to install_id, will not be exported, and are subject to the hosting platform's default retention. Separately, this page makes no compliance claim: no DPA, no SOC 2 report, no GDPR representative, and no sub-processor register beyond the list above.

Account-action data, once payment/accounts exist​

Explicit account actions (checkout, entitlement refresh, expressing interest in a not-yet-built feature) will use their own closed request schemas, still bound by the denylist above. The only place anything content-shaped will ever legitimately appear is an email address you typed on purpose, for that one purpose — for example to be notified if a feature you expressed interest in ships. Billing records will be kept as long as a subscription is active and thereafter as required for tax and accounting.

Today​

There is no pricing purchase flow, no runtime telemetry client, and no fake-door feature request yet. This website's GA4 instrumentation exists in code but sends nothing until HORO-348 configures a real Measurement ID — see "Website analytics (this site)" above. See Pricing and the docs for what is actually available right now.