# Privacy

## The short version

Nodeau Alpha sends nothing anywhere. There is no telemetry, no analytics, no
crash reporting and no licence check.

## What stays on your machine

Everything:

- your prompts and the model's responses — Nodeau does not log them by design
- your model files
- your API key
- your hardware details
- your install logs
- your support bundles

## What leaves your machine, and when

Only what you initiate:

| Action | What is fetched |
|---|---|
| `install.sh` | The Nodeau release and its checksum, from the distribution site |
| `nodeau install` | Container images and packages, from their publishers |
| `nodeau model install` | The model weights, from the model's publisher (Hugging Face) |

Those are downloads. Nothing is uploaded.

## Support bundles

`nodeau support bundle` writes a file to your disk and stops. It is not
uploaded, and Nodeau has no endpoint to upload it to. If you want us to see it,
you attach it to an email yourself.

Bundles exclude model weights, API keys, kubeconfig credentials, SSH keys, PEM
material and K3s node tokens, and are scanned for credential patterns after
assembly. Prompts and model output are never collected.

It is a plain `.tar.gz`. Open it and look before you send it.

## Inference is local

Your prompts go to a model running on your own GPU, reached over `127.0.0.1`.
They do not traverse your network, and they do not reach us. That is the point
of the product.

## Future telemetry

If opt-in telemetry is ever added it will be off by default, will state exactly
what it sends, and will never include prompts or responses. Nothing of the kind
exists in Alpha.