Privacy Policy

Last updated: 2026-10-29

What this policy covers

This policy describes what information xLyra Cloud stores and what that information is used for. Cloud is the account and plugin-market service of the xLyra project. The xLyra program can run on its own. An instance that is not bound to Cloud does not send any data to Cloud. Browsing the plugin market and installing from it are anonymous reads of static files, and do not require an account.

The rules for using Cloud are in the Terms of Service.

Accounts

You can sign in with GitHub, or with an email verification code. What Cloud stores for an account is listed below.

GitHub sign-in

If you sign in with GitHub, Cloud stores:

  • GitHub user id
  • login name
  • display name
  • avatar URL
  • UI language

Email sign-in

If you sign in with email, Cloud stores:

  • the normalized email address
  • a one-time verification code (valid for a short time, and usable only once)

Records related to the code include the IP address of the request.

Two-factor authentication

If an administrator enables two-factor authentication (TOTP) on an account, Cloud stores the encrypted TOTP secret and recovery codes.

Sessions and cookies

Session records

After you sign in, Cloud stores a session record. The record includes the IP address and the User-Agent.

Audit log

Administrative actions and sensitive actions are written to an audit log. The log records the operator, the action, and the IP address.

Instance binding and reports

What is stored at pairing

When an instance is paired, Cloud stores:

  • the instance public key
  • the suggested name
  • the xLyra version
  • the platform
  • the source IP of the pairing request

Periodic reports after binding

After binding, the instance reports once every 15 minutes. Each report includes:

  • the xLyra version
  • the platform (operating system, architecture, and runtime)
  • the list of installed plugins, and for each plugin its id, version, status, source (market, manual, or builtin), and whether it is enabled
  • aggregate counts

Cloud also records the latest source IP and the online time.

What is not reported

A report does not include:

  • the site address
  • API keys
  • any configuration values
  • user or request data
  • a plugin's own data

How to stop reporting

There is no switch to turn this reporting off. The only way to stop it is to unbind the instance. Unbinding stops the reporting. You can unbind an instance in the Console at any time.

Developer information

For a developer, Cloud stores:

  • display name
  • contact details the developer enters
  • agreement version
  • signing public key and fingerprint
  • namespace
  • submitted plugin packages
  • changelog
  • review records

API tokens are stored only as hashes.

What the information is used for

The information above is used to:

  • provide sign-in and accounts
  • provide the instance list and online status
  • review and publish plugins
  • security and abuse prevention

Cloud does not sell personal information, and it does not use this information for advertising.

Third parties

Cloud uses these services:

  • GitHub, for OAuth sign-in
  • Cloudflare, for the CDN and for hosting static files on R2
  • an email delivery service, which sends the verification email only for email sign-in

Information that is public

After a plugin passes review and is published to the market, the public signature index includes:

  • plugin id
  • version
  • the developer's display name
  • the signature fingerprint
  • the changelog
  • the permission declarations

Your rights

You can unbind an instance in the Console, and you can view your own instances and your own submissions. For anything else, use GitHub Issues. This policy does not promise a time for those requests, and it does not promise a deletion deadline.

This page is terms text maintained by the project. For questions, use GitHub Issues.