Privacy Policy

Zilix ("Zilix," "we," "us," or "our") provides a desktop daemon, an Electron desktop IDE, and a mobile companion app (collectively, the "Service") that let a developer pair coding agents running on their own machine with a mobile device and drive them remotely. This Policy explains what data the Service collects, why, how it's protected, and your rights over it.

By installing, pairing with, or otherwise using the Service, you agree to the practices described in this Policy. If you do not agree, do not use the Service.

1. Who this applies to

This Policy covers everyone who interacts with the Service in any capacity:

• individual developers who install the daemon, the desktop IDE, and/or the mobile app;
• anyone who pairs a device with someone else's daemon (e.g. a teammate granted access);
• visitors to Zilix's websites, documentation, and download pages;
• anyone whose information is incidentally processed through the Service's optional sign-in feature (Section 4.5).

If you are located in the European Economic Area, the UK, or Switzerland, see Section 10 for your GDPR rights. If you are a California resident, see Section 11 for your CCPA/CPRA rights. If you are a parent or guardian, see Section 12 regarding children's privacy.

2. The short version

• Your source code never leaves your machine. The daemon runs locally; agent sessions, files, and terminals stay on your hardware. The mobile app and desktop IDE talk to your daemon over an end-to-end encrypted channel — Zilix, as a company, does not have a server that stores, indexes, or can read your code.
• We collect a small amount of crash/error telemetry from the mobile app (stack traces, scrubbed of anything that looks like a secret) and a push notification token so we can alert your phone when an agent needs you.
• If you use optional sign-in, we (or your identity provider) process your email address and an opaque subject identifier — nothing else about your account activity.
• We do not sell your data. We do not run advertising. We do not build cross-app profiles of you.
• The Service is not intended for processing protected health information (PHI) or other regulated health data. Redaction in the Service catches secret-shaped values (API keys, tokens, credentialed URLs) — it does not detect or de-identify PHI, and you should not route it through the Service today.
• Everything below explains exactly what, why, and how you can opt out or delete it.

3. Data we do not collect

Because this is unusual for a developer tool and worth stating plainly, before listing what we do collect:

• We do not collect, transmit, or store your source code, repository contents, terminal output, or file contents on any Zilix-operated server. All of that stays on the machine running the daemon and travels only across the direct, end-to-end encrypted channel between your paired devices.
• We do not run a cloud build, cloud agent execution, or cloud storage service that your code passes through.
• We do not use your code, prompts, or agent conversations to train any model, ours or a third party's.
• We do not sell, rent, or trade personal information to data brokers or advertisers.

4. Data we collect, and why

4.1 Account & device pairing data (local-first)

To pair your phone with your daemon, the Service generates and stores:

• an ed25519 device identity keypair, and
• a bearer token authorizing that device.

These live in your device's secure hardware-backed storage (expo-secure-store on mobile; the OS keychain / equivalent on desktop) and in the daemon's local configuration on your own machine. They are never transmitted to Zilix.