Privacy Policy
Effective Date: July 7, 2026
Expletus ("we", "us", or "our") is dedicated to protecting and respecting your privacy. This Privacy Policy describes how we process, store, handle, and secure information when you download, install, execute, configure, or use the Orbicus software applications, background engine, command-line interfaces, VS Code extension, and the orbicus.dev website (collectively, the "Software").
We adhere to the European Union General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679), the California Consumer Privacy Act of 2018 (CCPA), as amended by the California Privacy Rights Act of 2020 (CPRA), and other applicable global data protection frameworks.
1. Local-First Architecture & Data Controller/Processor Designation
Local Processing Default: The Software operates strictly as a local-first application. All processing of code context, chat history, folder names, system parameters, commands, and workspace information occurs locally on your machine.
Legal Designation: Because we do not collect, copy, store, or transmit your development data, source code, files, or API credentials to our servers, Expletus does not act as a "Data Controller" or a "Data Processor" under the GDPR or CPRA for your local development assets. You are the sole controller and processor of your local data.
2. Specific Categories of Information and Processing Behavior
The Software processes various categories of data locally on your device's filesystem. Below is the mapping of how these categories are processed:
| Data Category | Local Storage Location | Transmission / Processing Details |
|---|---|---|
| API Credentials (API Keys) | Stored locally in config files or VS Code storage. | Never transmitted to Expletus. Transmitted directly to Third-Party Providers (OpenAI, Anthropic, Google) to authorize LLM inference. |
| Source Code & File Context | Remains in your designated workspace folders. | Snippets or file fragments are read locally and sent directly to Third-Party Providers as part of Prompt context. Never saved or sent to Expletus servers. |
| Conversation & Chat Logs | Saved locally in your user home directory. | Stored in local database files for chat continuation. Never exported, processed, or indexed by Expletus. |
| Terminal Logs & Commands | Temporary cache in local files and system memory. | Processed locally to monitor build statuses and command outcomes. No terminal outputs are transmitted externally except to the configured AI API if requested in the context. |
3. Direct Connections to Third-Party AI Services
The Software connects your local device directly to Third-Party Providers. Prompts containing code, file context, and instruction text are sent directly to their servers to generate completions.
Provider Processing: Your prompts and outputs are subject to the privacy terms, data retention cycles, and API processing policies of the configured Third-Party Providers. Expletus does not act as a proxy, middleman, or broker. We do not inspect these payloads. We strongly recommend configuring your Third-Party accounts to opt out of training models on API payloads.
4. GDPR Data Subject Rights
If you are a resident of the European Economic Area (EEA), you possess specific rights regarding your personal data under the GDPR. Because Expletus does not store, copy, control, or possess any of your workspace data or conversation histories, we cannot access, export, or delete this data for you.
- Right to Erase (Deletion): You can erase all personal data processed by the Software by deleting your local configuration directory and clearing VS Code extension settings.
- Right of Access & Portability: You can access or copy your settings and conversation databases directly from the local filesystem on your device.
- Right to Rectify: You can modify your stored credentials, custom agents, and settings at any time via the Settings UI in the Software.
5. California Consumer Privacy Disclosures (CCPA/CPRA)
For California residents, the CPRA provides rights regarding personal information.
- No Sale or Sharing of Data: Expletus does not sell, lease, rent, trade, or share your personal information or codebase contents with any third party.
- Non-Discrimination: We will not discriminate against you in pricing, availability, or feature access if you exercise any privacy rights under the CPRA.
6. Telemetry, Analytics, and Opt-in Diagnostics Policy
In our current version, the Software does not collect product analytics, crash logs, usage telemetry, or licensing parameters online.
Opt-in Safeguard: In the event that future updates introduce telemetry or diagnostic metrics (e.g. to identify startup failures or unexpected crashes), such features will be disabled by default (opt-in only). We will request your explicit, active consent before transmitting any telemetry payloads, and we will never include file paths, source code context, or API keys in telemetry bundles.
7. Security Safeguards
We recommend configuring appropriate operating system user permissions on the local application directory to restrict local system access to authorized user profiles on your machine.
8. Children's Privacy (COPPA Compliance)
The Software and our website are not intended for children under 13 years of age. We do not knowingly collect or solicit personal information from children under 13.
9. Contact Information
For privacy inquiries, GDPR data queries, or concerns regarding local storage practices, you can contact Expletus at:
Website: expletus.be