Privacy

01Website and clients

This notice distinguishes this static website from Nerva’s Relay / Control services. The website has no sign-in, forms, analytics scripts, advertising trackers, external fonts or third-party CDNs. A small self-hosted script enhances motion, reading progress and appearance previews, and keeps numeric performance measurements only in the current page’s memory. It does not transmit these measurements or write logs or storage. Language links do not write cookies or browser local storage.

Your browser still sends an IP address, requested path, request time and headers such as browser type to the hosting endpoint. The supplied nginx configuration disables access logs and records only critical errors. Hosts, network gateways and hosting providers may process additional logs; their actual scope and retention remain to be confirmed. The absence of tracking scripts does not prevent servers from receiving request information.

02Account, authentication and administration

Registration and sign-in services receive email addresses, raw passwords, installation names and credentials. TLS protects transport, but these services process the original values after TLS termination; they are outside Host end-to-end encryption. The password database stores salted scrypt-derived values. Access, refresh and Connector tokens are checked using SHA-256 digests.

Services store account, installation and computer IDs, names, types, creation and revocation times, plus public keys, key identifiers, recipients and encrypted key envelopes. Normal key-registration interfaces do not upload private identity keys or raw data keys. Key directories and initial trust still depend on the server. Administrative functions can access relevant account, device and audit information; host / database operators are not limited to fields exposed by administrative UI roles.

If email verification or recovery is enabled, mail infrastructure receives email addresses and verification / recovery links, and Control can process recovery materials. If purchases or subscriptions are enabled, services also process account associations with transactions, products, subscription states and dates. Availability depends on deployment and version. These functions are outside encrypted Host content.

03Live encryption and routing

On the E2EE-capable remote Host channel, relay code forwards opaque encrypted frames without decrypting session content. The device-side Connector / Host decrypts it, after which agents and selected models or tools can process plaintext under their own policies. Encryption depends on endpoints, keys and a trusted directory; it does not guarantee secrecy against compromised endpoints or malicious key distribution.

Servers can still see associated account, installation, computer, Host / node / channel identifiers, public keys and key IDs, authorization generations, online state, direction, timing, frame sizes, byte counts and connection-close information. Sequence numbers, nonces and authentication tags in encryption envelopes do not make traffic anonymous. Not all source metadata is concealed.

Ingress services process socket IPs or IPs forwarded by trusted proxies for rate limiting and node routing. An optional local country database can infer a country from an IP address. That lookup implementation does not call an external geolocation service.

Compatibility HTTP / WebSocket proxies remain a separate path. Relay processes can read methods, paths, forwarded headers, status, bodies and message bytes, including model credentials carried in requests. The Host channel’s encryption properties do not extend to every version, sign-in, administration or all proxy traffic.

04Encrypted archives and local copies

When archives are enabled for the deployment and account, Control stores device-generated ciphertext blocks and encrypted key envelopes. Authorized devices decrypt locally to read uploaded history. Readable archives do not let an offline computer execute instructions, and unuploaded content may be unavailable.

Servers still store source, computer, Host, object, publication, revision and key / epoch identifiers, block counts, sizes, kinds, sequences, nonces, digests and producer-reported progress. Encrypted directory content does not encrypt every outer association. Whether a native session ID is encrypted depends on the path; notifications may still process those IDs in plaintext.

Receiving devices may cache decrypted archive content. Local working directories, native agent histories, caches and system or external backups are separate copies. They are not all guaranteed to be encrypted by the archive key or erased at sign-out.

05Optional offline ciphertext queue

The offline queue is an optional server mechanism, off by default. Only when explicitly enabled in a deployment and supported by both clients and recipients should conforming clients seal a self-contained encrypted envelope on-device before submitting it for pickup when the computer is reachable. The server does not decrypt it or replay live tunnel frames. It validates envelope structure but cannot prove that submitted content was actually encrypted. This description does not claim that currently released clients implement a queue UI, automatic resending or execution.

Servers can see account, computer, installation, queue-message and key IDs, target service, status, size, times, digests and lease / receipt information. These metadata are outside the encrypted content. A queue status of ‘delivered’ means a Connector acknowledgment; it does not prove agent execution, successful actions or user reading.

Pending payloads are valid for at most 24 hours after enqueue. Payloads are cleared on delivery acknowledgment or expiry processing. Delivered receipt metadata are retained until 24 hours after acknowledgment; expired-message receipts remain for an additional 24 hours after the scheduled expiry (about 48 hours from enqueue). While the service is active, background batch cleanup is attempted about every 60 seconds, and relevant requests can also process expiry. Downtime, lock contention or cleanup failures can delay physical removal. Backups may retain data longer; this is not a promise that every copy disappears within 24 hours.

06Notifications, diagnostics and logs

Push delivery processes APNs device tokens, environment, account / installation / computer identifiers, session IDs, event keys, kinds, times and retry state. Host attention notices may also contain Host / runtime / agent / session references, interaction and turn IDs, revisions and consumption receipts. APNs may receive generic notification text and routing IDs. Generic text does not anonymize these identifiers or prove delivery or reading.

When cross-device smart notifications are enabled, services process installation identity, visibility, activity times and short leases associated with computers / targets. The shared lease implementation uses current database state with a 45-second validity period and removes expired entries while running. Downtime can delay physical cleanup. This information can be associated with known sessions.

Client diagnostics can be linked to accounts and installations, storing event times, connection / failure kinds, operations, HTTP status, error codes, retry counts and delays. Services also process connection events, administrative audits, service errors and node / API byte and latency metrics. Diagnostic fields have format and length restrictions, but not every field has a semantic allowlist; arbitrary clients cannot be guaranteed never to embed other information.

07Retention, revocation and deletion

The reviewed source does not establish one fixed automatic expiry for account records or encrypted archives. Cleanup code removes service events, computer connection events, client diagnostics and node / API metrics older than 30 days, subject to cleanup jobs running. This is not a universal retention period. Ordinary push events and cancellation records have their own expiry cleanup. Actual retention and deletion policies for log exports, audits, backups and third-party services still require publisher confirmation.

Signing out an installation, removing a computer or resetting a password revokes identities, credentials and connections within the relevant scope. Revocation does not remotely erase decrypted content or recover copied keys.

The current service includes an account-deletion interface requiring reauthentication. Client access depends on version and deployment. Deletion clears account login identities, device authorizations, push data, diagnostics and other account data, and propagates revocation. Archive ciphertext may enter a pending-deletion state for background batch cleanup, temporarily retaining only revoked, scrubbed association skeletons. Downtime or cleanup failures can delay completion; immediate erasure is not promised.

Deletion records and action / time audit entries stripped of identifying fields expire after 30 days and are removed by cleanup jobs. This does not anonymize every operational record. Revocation queue entries for completed deletions are also cleaned by that process. Deletion does not automatically erase native local history, recipient copies, external provider records or all backups. Handling deletion after backup restoration and final erasure deadlines still require operator confirmation.

08Your choices and notice updates

Connect only computers and agents you are authorized to use. Check recipient devices and permissions, and revoke installations, remove computers or use account deletion where available. For privacy questions, refer to the contact details at the top; incomplete fields must be completed before release. This page does not separately designate a jurisdiction or response deadline.

This notice is based on local security documents and service source reviewed on the stated date, not evidence of production configuration. Update it when versions, enabled functions or operating policies change. Chinese and English describe the same scope; neither is designated as controlling.