Privacy policy

Last updated 6 November 2026

This policy explains what Euklea (“we”) collects when you use the Euklea app or join the waitlist at euklea.ai, why, who else receives it, how long we keep it and how to have it deleted.

The controller of your personal data is Michał Florczak, trading as Euklea, NIP 5521733765, Poland, reachable at [email protected].

What we collect and why

The euklea.ai waitlist

If you join the waitlist, we collect your email address, the time you joined, the source “euklea.ai landing”, what you told us you want from Euklea and, if you wrote it, why it matters to you now. We use the email to send one email when Euklea is live, and nothing else; we read your answers to decide what to build first. Loops (operated by Astrodon Corporation, USA) is our processor: it stores the waitlist and sends that email on our behalf.

Every email has an unsubscribe link. You can also unsubscribe by writing to [email protected]. For people who do not sign up for Euklea, we keep waitlist data until Euklea is live plus 30 days, or until they unsubscribe, whichever comes first.

Your Google account

You sign in with Google (OpenID Connect, scopes openid email profile). We receive and store your Google account ID, email address and whether Google verified it, your name and the address of your profile picture. We use them to sign you in, to check that your email is invited to the beta and to show who is signed in. We never see your Google password.

Your session

Signing in sets a session cookie holding a random token. We store only a SHA-256 digest of it; the session ends when you sign out or after 30 days without use. A short-lived cookie (10 minutes) ties a sign-in to the browser that started it.

Your projects

What you create and decide in Euklea: your site’s address and settings, the analyses, page plans, briefs, drafts, revisions and notes, the changes you ship and the access tokens you create for coding agents (stored only as SHA-256 digests).

Google Search Console (optional)

When you connect Search Console, you grant a separate consent for the read-only scope https://www.googleapis.com/auth/webmasters.readonly with offline access. Through it we read the list of properties your Google account can see and, for the one property each project uses: search performance (clicks, impressions and average position per search query, page and day), the property’s sitemaps, and the URL Inspection result of pages you shipped through Euklea. We store this per project to show your results, to find pages whose clicks fell and to plan pages around what your site already has. The refresh token Google issues is stored encrypted (AES-256-GCM).

We keep up to 16 months of this history and delete older rows. When you disconnect Search Console we revoke the token at Google and delete everything read through it at once; choosing another property for a project deletes what was read from the previous one.

GitHub (optional)

You can install Euklea’s GitHub App on repositories you choose. It asks for: metadata (read), contents (read and write), pull requests (read and write), checks, commit statuses and deployments (read), workflows (read and write) and actions (read). We use it to read the files of the branch and folder you link, to open branches and pull requests with the pages you approve, to add a checks workflow when you ask for it, and to follow those pull requests, their checks, logs of failing checks, deployments and build previews. GitHub tells us about changes through webhooks. Access tokens for the App are kept in memory only, until shortly before they expire. Euklea never merges a pull request. You can remove the App at any time in your GitHub settings.

Analytics on your site (optional)

If you turn on site analytics, Euklea adds a tracker of Umami, an open-source analytics tool that Euklea runs on its own server, to your site. Your visitors’ browsers load it from Euklea’s address (https://alpha.euklea.ai/t/script.js) and send page views to https://alpha.euklea.ai/t/send. It sets no cookies. A page view carries the page address and title, the referrer, the screen size and the browser language. Euklea passes the visitor’s IP address and browser user agent on to Umami so it can tell visitors apart and place them in a country, and drops any other identifying field the page view carries. Page views are collected while the project’s analytics is on; turning it off stops the collection. For these visitors you are the controller of the data and Euklea processes it on your behalf; tell your visitors about it in your own privacy policy.

Public web pages

To analyse your site and its competitors, Euklea reads publicly available pages, and for up to 90 days after you ship a change it checks every 6 hours that the page is live.

Records of provider calls and server logs

Every call to a paid provider is recorded (which provider, what for, when, its cost) so we can keep to daily spending limits. The server’s technical logs hold the request path, method, a request ID and your account ID, never request bodies, tokens or cookies. Your IP address is used in memory to limit request rates and is not written to Euklea’s logs.

Legal bases

• Contract (Art. 6(1)(b) GDPR): your account, your projects and what Euklea does in them at your request, including the work done through GitHub and the AI and search data providers.
• Consent (Art. 6(1)(a) GDPR): connecting Search Console, which you give in Google’s own consent screen and withdraw at any time by disconnecting it.
• Legitimate interest (Art. 6(1)(f) GDPR): keeping Euklea secure and working: sessions, rate limits, server logs, records of provider calls and spending limits, and backups.
• For visitors of your site, Euklea processes analytics data on your behalf (Art. 28 GDPR).

Who else receives data

Euklea uses these services as processors, with its own accounts, only to do what you ask of it:

We do not sell your data, do not use it for advertising and do not share it with anyone else unless the law requires it.

Google API Services: Limited Use

Euklea’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Search Console data is used only to provide and improve the features you see in Euklea; it is transferred to others only as needed to provide those features (as listed above), for security, or to comply with the law; Euklea never uses it for advertising, sells it or uses it to train generalised AI or machine-learning models; and no person reads it unless you ask us to (for example for support), it is needed for security, or the law requires it.

Cookies and browser storage

Euklea sets only the two cookies needed to sign in (above). The app stores your colour theme and sidebar preference in your browser’s local storage, and unsent notes on a draft in its session storage. There are no advertising or third-party tracking cookies, and the Euklea app itself is not tracked by analytics.

How long we keep data

Security

Euklea is served only over HTTPS, with Secure, HttpOnly cookies. OAuth refresh tokens and sign-in secrets are encrypted at rest with AES-256-GCM; session and agent tokens are stored only as digests. Every request is checked for its session, a CSRF token and the account it belongs to. Administrative access to the server goes through Cloudflare Access.

Where data is stored

Euklea’s application, database, analytics and backups run on one server at Hetzner in the European Union, reached through Cloudflare. The other services listed above process what Euklea sends them in their own data centres, which may be outside the European Union.

Your rights

You have the right to access your data, to have it rectified or erased, to restrict its processing, to receive it in a portable format and to object to processing based on legitimate interest. Where processing rests on your consent, you may withdraw it at any time without affecting what was done before. Write to [email protected]; we answer within 30 days. You can also disconnect Search Console and remove the GitHub App yourself at any time.

You may lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, uodo.gov.pl) or with the data protection authority of the country where you live.

Children

Euklea is not meant for anyone under 16.

Changes

We will update this page when what Euklea does with data changes, and tell signed-up users by email at least 14 days before a significant change applies.