Privacy

Nothing described in "The contract a future telemetry channel must follow" below is live yet. Circinus — the runtime you install — has no telemetry client, no hosted telemetry endpoint, and no account system; it runs entirely on your machine and calls nothing of ours. That section is a forward disclosure of the contract any future telemetry and hosted-service work in Circinus is bound to follow, so you can hold us to it before it exists rather than after.

This website (circinus.horonom.com) is a separate, narrower case, and it is live now — see "Website analytics (this site)" below. (This site moved here from circinus.horo.run in HORO-569; the old address now redirects.)

The local-first baseline, which is live today​

No context leaves your machine unless you configure your own model provider key (BYOK — bring your own key). There is no Circinus-operated service today, no telemetry endpoint, and no account. The enforcement decision at the action boundary is a local read against a local SQLite database — it never requires a network round trip.

Website analytics (this site)​

This is about circinus.horonom.com itself — the marketing/docs website you are reading — not the circinus runtime described everywhere else on this page. They are governed separately and this section will not be conflated with the runtime telemetry contract below.

This site is instrumented with Google Analytics 4 (GA4) to measure basic acquisition: which pages get viewed, whether the install/quickstart path gets clicked, and which marketing channel (utm_source/utm_medium/ utm_campaign/utm_content) a visit came from. GA4 is provided by Google — using it means Google processes visitor data for this site (page paths, referrers, UTM values, and Google's own coarse device/geo/IP-derived signals) under Google's terms, separate from the Google Cloud/Neon/Dodo Payments sub-processor list below, which is about the hosted product service, not this website.

• The GA4 Measurement ID is never hardcoded. It comes from an environment variable the Production deploy pipeline sets. HORO-348 has shipped: a real Production GA4 property/stream now exists and is live on this site. A GA4 Measurement ID is not itself a secret — it ships in this page's own HTML/JS to every visitor's browser by design.
• Local development and any preview/staging build must not contaminate Production GA data. The site only loads GA when a Measurement ID is present and the build is gated as production (see docusaurus.config.js); the operational guarantee is that the Measurement ID variable is set only in the Production deploy pipeline, never in a local/preview build.
• The event parameters are low-sensitivity by design: a page identifier, UTM string values (bounded length, expected from a fixed channel list — see ANALYTICS.md in the site source), and for the "fake door" feature-interest events, a closed feature_id enum plus (for a qualified follow-up) a fixed lead_source value. The optional email address on a fake-door follow-up goes only to Circinus's own first-party backend — GA4 receives the fact that a qualified lead occurred, never the address itself. The same denylist as the runtime's applies here: no prompt/source/code content, no tool arguments, no repository names or paths, no raw provenance text, no secrets, no customer/company names.
• A GA outage or a blocked script never breaks the page. Event calls are no-ops (not errors) whenever window.gtag isn't defined, and the loader itself degrades silently on failure.
• No cookie-consent banner ships with this instrumentation yet, now that GA is live for real visitors; that is a known, accepted gap for the Alpha rather than a hidden one.
• IP addresses are anonymized at collection (anonymizeIP: true). Email addresses are not sent to GA4 in any event by construction — client-side discipline, not GA's own redaction, is the primary control. GA4's own Data Redaction settings (email redaction; redaction of any sensitive query parameter) are a recommended defense-in-depth measure on top of that, not a substitute for it — server-side Measurement Protocol events in particular are not covered by client-side redaction at all.
• GA's data-retention window is the property's own setting, configured separately from this codebase.

The contract a future telemetry channel must follow​

When Circinus adds a hosted service, it will support two distinct kinds of outbound call, governed differently. They will not be conflated.

1. Passive product telemetry — background usage counts and flags, sent without you acting in the moment. Gated by a telemetry.enabled setting that is off by default. If it is off, none of this is sent, period.
2. Explicit account actions — things like checkout or entitlement refresh, which you trigger yourself. Typing the command and confirming it is the consent for that one action, independent of the telemetry setting — turning telemetry off will not block you from managing an account you chose to create. These calls carry their own closed request schemas, separate from the telemetry allowlist below.

Telemetry will be opt-in and disclosed before it sends anything​

• Default will be off. A fresh install will send nothing.
• Enabling it will require an explicit telemetry.enabled = true in the config file — no implicit enablement from an environment variable, from having an account, or from having paid.
• The first run after install will state plainly that telemetry is off, exactly what it would send if enabled, and how to turn it on.
• Turning telemetry off will remove the passive telemetry path entirely — there is no planned "minimal" or "essential" tier that ignores the setting.

The complete allowlist for passive telemetry, once it exists​

This is the entire list. Adding a field requires a new ADR (ADR-0011 in the repository, which this page summarizes; the repository itself is not yet public).

Plus a transport-level sent_at timestamp and a schema version. That is the entire list — no rule identifiers, no finding categories, no tool names, and no content are on it.

What will never be sent, under any setting​

Prompt content, source or document content, source code, shell and tool arguments, repository names, file paths and path fragments, raw provenance text, secrets/tokens/credentials of any kind, inferred customer or company names, hostnames/usernames/IP addresses collected by us, and anything derived from the above by hashing, truncation, or embedding. A hash of denylisted content is still denylisted — hashing does not make it safe to send.

install_id and session_id will be randomly generated, never derived from your hostname, MAC address, username, or machine id.

Retention and deletion, once telemetry exists​

• Telemetry rows: kept for 90 days, then deleted by a scheduled job. That is a retention limit, not a target.
• Deletion on request: you will be able to email a published address quoting your install_id (shown by circinus status), and matching rows will be deleted within 30 days. There is no self-serve deletion API or DSAR portal planned for the Alpha — that is the honest posture rather than a hidden gap.

Sub-processors, once the hosted service exists​

The Alpha's planned sub-processors for the hosted product service are Google Cloud (hosting), Neon (database), and Dodo Payments (billing). No others are planned, and this list will be kept current here rather than only in an internal document. Separately, and already live, this website uses Google Analytics 4 (Google) — see "Website analytics (this site)" above.

What this page does not claim​

This is an Alpha posture, stated plainly rather than implied away. Cloud Run's own HTTP request logs will contain client IP addresses, as any HTTP service's do — "we never collect IP addresses" would be false, so this page does not say it. Those addresses will not be joined to install_id, will not be exported, and are subject to the hosting platform's default retention. Separately, this page makes no compliance claim: no DPA, no SOC 2 report, no GDPR representative, and no sub-processor register beyond the list above.

Account-action data, once payment/accounts exist​

Explicit account actions (checkout, entitlement refresh, expressing interest in a not-yet-built feature) will use their own closed request schemas, still bound by the denylist above. The only place anything content-shaped will ever legitimately appear is an email address you typed on purpose, for that one purpose — for example to be notified if a feature you expressed interest in ships. Billing records will be kept as long as a subscription is active and thereafter as required for tax and accounting.

Today​

There is no pricing purchase flow and no runtime telemetry client. This website's GA4 instrumentation is live — see "Website analytics (this site)" above — and the /roadmap fake-door feature-interest form is live too. See Pricing and the docs for what is actually available right now.