Privacy Policy — Cyrus

Cyrus is operated by Nxeon, which is the controller of the personal data described here. You can reach us at [email protected]. The Cyrus Terms of Service and the general Nxeon Privacy Policy apply together with this policy.

• Account identity: your name, email address and sign-in method, which come from your Nxeon account. If you sign in with Google, Google gives us your email address, name, profile picture and a Google account identifier (see Google user data below). Cyrus has no separate password.
• Your Cyrus username (handle) and optional bio, if you create a creator profile. These are public.
• What you give Cyrus: prompts, change requests, uploaded files and images, designs and settings, and what you write in support messages and reports.
• What Cyrus produces: generated source code, compiled files and assets, project history, and the results of tests, build logs and (when you use it) test-server runs.
• Tokens and payments: your token balance and the append-only ledger of grants, holds, charges and refunds; plan and storage records; payment status and references from Stripe. We do not receive or store your card number.
• Usage, safety and diagnostics: build outcomes, errors, limits you hit, IP address, device and browser information, and security events used to keep Cyrus working and to detect abuse.
• Website analytics on cyrus.my: page views of the Cyrus site and app (the page, the site or campaign tag you came from, your country and device type). We do not store your IP address or browser user agent for this, and never what you type into the prompt box on the landing page.
• Cookies and similar storage on cyrus.my: see Cookies and analytics below.
• Referrals and partners: your personal referral code, the code or link you joined with and who referred you, clicks on referral and partner links (stored with a one-way hash of the visitor's IP address, never the address), and, if you apply to become a partner, the application you write. A person who referred you sees you only as an anonymous code.

• To run Cyrus: sign you in, create and deliver builds, keep your projects, charge tokens and process payments. Basis: performing our contract with you.
• To keep Cyrus and others safe: scan builds and assets, prevent fraud and abuse, enforce limits and the terms, respond to reports. Basis: our legitimate interests, and legal obligations.
• To maintain and improve Cyrus: measure build quality and reliability using aggregate outcome data (see below). Basis: legitimate interests.
• To contact you about your account, builds, billing and important changes. Basis: contract and legitimate interests.
• Marketing attribution and advertising measurement on cyrus.my, only if you consent in the cookie banner. Basis: your consent, which you can withdraw.
• To meet tax, accounting and legal requirements. Basis: legal obligation.

We do not sell your personal data. We do not use it for advertising profiles, and we do not show ads in Cyrus.

Cyrus is a Nxeon product and sign-in is handled by your Nxeon account. When you choose "Continue with Google" on the Nxeon sign-in page, we ask Google for the basic profile scopes only: openid, email and profile. We request no other Google API scope and we do not access your Gmail, Drive, Calendar, Contacts or any other Google service.

• What we receive: your Google account identifier, email address, name and profile picture URL.
• What we use it for: only to sign you in and to identify your Nxeon and Cyrus account (to match you to an existing account or create one, and to show your name and picture in your account). Nothing else.
• What we do not do: we do not sell Google user data, do not use it for advertising or to build advertising profiles, do not transfer it to others except as needed to run the service for you (see Who we share data with) or if the law requires, and do not let people read it other than as needed for security, support and legal reasons.
• Retention: we keep it for as long as your account exists. When your Nxeon account is deleted we delete it, apart from records we are legally required to keep. You can also remove the Google link and revoke access any time in your Google Account settings (Security, Third-party access).

Cyrus's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Cyrus builds with third-party AI models. To generate or change a build, our build service sends the model the text of your request, the instructions and reference material Cyrus adds, and the project files and assets the task needs (for example your existing source code, specs, images you attached, and build or test output used to repair a build). Anthropic, PBC currently provides the models and processes this data on our behalf to return a result.

Your payment details are never sent to the model provider. Do not put secrets or other people's personal data into prompts or uploads, because the model provider will receive what you include.

We use your build outcomes to improve Cyrus (for example which kinds of requests fail and why). That learning data is limited to outcome facts and counts, not your prompt text, source code, file contents, plugin names or user identifier. We do not use your content to train AI models ourselves.

We share data only with providers that help us run Cyrus, under contract, and with others only as the law requires:

• Anthropic: AI model processing of prompts and project material, as above.
• Google: sign-in with Google, if you choose it.
• Stripe: card payments and billing. Stripe handles your card details.
• Cloudflare: content delivery, network security and proxying for cyrus.my, which sees the traffic that passes through it.
• Nxeon's infrastructure and hosting providers, including backup storage: where Cyrus, its database and its build servers run.
• Email delivery provider: transactional emails such as build results and account notices.
• Authorities, courts and professional advisers when the law requires or to protect rights and safety; and a successor if the business is transferred, subject to this policy.

Things you publish are public: your Cyrus username, published mod pages, media, posts, comments and ratings are visible to anyone and can be copied. Assets added to the shared community library are public domain (CC0), carry no credit, and can be used by anyone.

Cyrus and its providers process data in several countries, which may differ from where you live. Where the law requires safeguards for such transfers we rely on appropriate mechanisms such as standard contractual clauses with our providers.

On cyrus.my we use strictly necessary storage: a secure session cookie that keeps you signed in, short-lived sign-in state cookies used during the Nxeon sign-in handoff, and a cookie that remembers your cookie choice (kept for 180 days).

Optional cookies or storage are only set if you accept them in the cookie banner. "Analytics" allows capture of the referral code and campaign tags (UTM) of the link you arrived from, kept for up to 30 days. "Marketing" additionally allows ad click identifiers (such as fbclid and gclid). If you consent, a record of that consent and of the attribution is saved with your account at sign-up, and may be used to report a sign-up or purchase conversion to the advertising platform; the report carries a one-way hash of your email and no raw personal data. "Reject all" is as easy as "Accept all", nothing optional is stored before you choose, and your choice does not affect your access to Cyrus.

Website analytics: we count visits with our own first-party tool, with no third-party analytics scripts. If your browser sends Do Not Track or Global Privacy Control, the tool sends nothing at all. If you have not accepted analytics, a visit is counted anonymously (the page, the site you came from, campaign tags, your country and device type) with no identifier and nothing stored on your device. If you accept analytics, we also set a random visitor ID cookie (cyrus_vid), replaced every 30 days, so that we can tell new from returning visitors; it is not linked to your account. Visits by automated programs are counted separately and left out of our figures.

Product analytics: we also measure how Cyrus is used from records it already keeps for your account (for example when you sign in, claim a username, see a plan, start or finish a build, install a mod or buy tokens), in aggregate, to improve the product and to understand cost. These reports do not include your prompts.

We keep data while your account is active and as needed to provide Cyrus. Our practices today:

• Projects, builds, assets, published pages, preferences and similar content: until you delete them or your account, or you ask us to erase your Cyrus data.
• Token ledger, plan and payment records: kept after account deletion, because they are accounting and financial records that the law and our own audit needs. They are not used for anything else.
• Build records: kept as a cost and audit record. When you ask us to erase your Cyrus data, the prompt, change request and plugin name on them are removed and the record is detached from you.
• Data export files: available for 7 days, then removed.
• Consent records: a consent choice is valid for 180 days, after which we ask again.
• Website analytics: raw visit events are deleted after 90 days; daily totals that contain no personal data are kept. The plan-screen events described above are kept until you ask us to erase your Cyrus data.
• Backups: encrypted backups of Cyrus systems age out on a rolling schedule; erased data can persist in backups until they expire, which we aim to complete within about 90 days.
• Server and security logs: kept for a limited time for security and troubleshooting.

Depending on where you live (for example under the GDPR, UK GDPR or similar laws) you can ask us to access, correct, delete, restrict, object to the processing of, or receive a copy of your personal data, and to withdraw consent you gave. You also have the right to complain to your data protection authority.

• Export: in Cyrus, open Account, Data, and choose "Request export". You receive a downloadable archive of the Cyrus data we hold about you (up to a size cap per table; the export says when something was cut).
• Erasure: in the same place choose "Request deletion". After a 14 day waiting period during which you can cancel, we delete or anonymise your Cyrus data: personal API keys, notifications and preferences, projects with their revisions and assets, published mod pages and posts, creator profile, ratings, stars and collections are deleted; build records have the prompt and plugin name removed and are detached from you; reports and remix and fork credits you made are anonymised. The financial token and plan records are retained, as described above.
• Your Nxeon account itself (profile, invoices, servers) is exported and deleted through Nxeon's account tools and the general Nxeon Privacy Policy, and is not part of the Cyrus export.
• Anything else, or if you cannot use the tools: email [email protected]. We may ask you to confirm your identity first.

We protect Cyrus with encryption in transit, access controls, scanning of generated code, isolated build workspaces without network access for the model, secure cookies, encrypted backups, audit logging of staff actions and a security review process. No system is perfectly secure, and you should keep your own backups.

Cyrus is not for people under 18, as in the Nxeon Terms, and we do not knowingly collect data from children. If you think a child has given us data, contact us and we will delete it.

We may update this policy. The version and date at the top show when it last changed, and we will notify you of material changes in the product or by email. Questions, requests and complaints: [email protected], or the Nxeon contact page.