Know what you share.

Data on your computer

Solara stores conversation history, generated output, project references, memory, action and recovery records, preferences and local diagnostics in its app profile. Attachments can include retained originals, extracted text, document images, media frames and transcripts. Your project files and worktrees occupy their own local directories.

Saved provider API keys and the desktop's retained sign-in credential use Electron's operating-system-backed credential encryption. This does not encrypt the entire conversation database, attachment store or project. Protect your operating-system account and any backups you make.

File approval and stale-file checks govern reviewed edits. EA 0.13-62 runs local chat commands in an automatic AppContainer Sandbox using temporary project and tool copies. Command output files are discarded; reviewed edits persist separately. Manual Terminal, goals and task workspaces remain separate. This does not isolate the entire application.

Your configured providers

When Solara requests a model response, the selected endpoint can receive your message, supplied conversation history, recalled memory, project context, file excerpts, tool results and included attachment content. Project context can contain filenames and code. Plan mode still makes model requests.

Provider credentials authenticate requests to the configured endpoint. Model-list requests also contact that endpoint: saving a connection, opening a configured provider or refreshing its models can make a network request. Use only an endpoint you trust.

Solara uses your explicit provider/model selection. A provider's own auto-routing option can select an underlying model if you choose that option. Provider charges, retention and use of submitted content depend on your provider agreement and account settings. Review those terms before sending content.

Attachments and optional features

Document extraction and bundled OCR prepare local content that can later enter a model request. Audio/video import can send extracted audio to the active provider and model for transcription during preparation, before you send the chat message. This can incur provider charges. Do not import private recordings to explore the interface.

Optional voice features use their configured speech route. Online tools and connected services can send the content needed for the actions you authorize. Review those permissions before use; they are outside the suggested first local-project trial.

If you explicitly enable remote command execution for a conversation, approved command content and workspace identifiers go to the configured service. Solara does not automatically transfer repository contents. Manual Terminal, goals, delegated tasks and worktrees remain local. A remote target is not a promise of isolation or cleanup.

Account, website and downloads

The account flow sends the email you enter to Supabase Auth and its configured email delivery service. Account records include identifiers, email, access status and desktop-session verification timestamps so the service can check access. New verified accounts activate automatically. Administrators can revoke or restore access; revoked email identities remain blocked until explicitly restored or removed with a subsequently closed account. Account access can require online revalidation.

The portal keeps sign-in state in browser storage when that storage is available. Its session is separate from the desktop's encrypted retained credential. Optional profile fields and a profile picture are uploaded only when you save or upload them in the portal.

Controlled download requests use Supabase and an AWS gateway serving a private installer bucket. Redeeming a ticket records the tester, release, time and browser user-agent. Download links are access credentials; do not forward them or include them in reports.

Cloudflare Pages serves the public site and portal. Visiting those sites, signing in and downloading sends ordinary network requests to the services involved. These information pages add no forms, analytics scripts or account requests. Hosting, email and gateway logging, regions and retention still need operator confirmation; there is no claim that these services keep no request logs.

The initial trial uses your own provider account. Alpha access does not establish a Compute purchase, credit balance or API entitlement. This notice does not describe an activated paid Compute service.

Feedback you choose to send

The portal's Overview → Send feedback form sends your category and message, associates the report with your tester account and the portal's release when present, and timestamps it. The text is sent as entered after trimming surrounding whitespace. Write your actual installed version in the report; it may differ from the portal's current release.

Optional screenshots are resized and re-encoded in your browser, then uploaded separately to private Supabase Storage. Reports and screenshots are associated with your tester account and made available to Solara administrators for support. Do not include confidential material.

Metadata removal does not hide visible secrets. Crop or redact API keys, sign-in links, tokens, personal information, source code and sensitive file paths before selecting images. Report text is not automatically made safe by the screenshot processor.

If screenshots fail after the report is saved, the form can retry missing images against that report. The upload retry window is not a data-retention or deletion promise. Submitted reports and uploaded images are not recalled by closing the form.

Local diagnostics and optional analytics

Essential reliability events are recorded locally. Optional remote sharing is off by default and is controlled under Settings → Account → Data sharing → Anonymous usage analytics. Delivery depends on the configuration of your exact release.

In a build with a configured endpoint, enabling that control can send queued, sanitized reliability and feature-use events over HTTPS. Fields include app version, operating system, event type, provider/model identifiers, timing, outcome and selected counts. This is pseudonymous telemetry: events use a persistent random installation identifier.

The telemetry allowlist is designed to exclude prompts, source code, patches, raw terminal output and arbitrary environment values, and to scrub recognized paths and secrets. This restriction applies to the telemetry payload, not to model requests or feedback that you write yourself.

Disabling optional sharing does not erase previously delivered events, local history or submitted feedback. Never upload a complete profile, database, credential file or raw log collection as routine feedback.

Controls and their limits

Chosen retention period: 30 days. The period begins when an account is closed, when a support case is resolved, or when telemetry is collected. Active accounts and open support cases do not expire merely because they are 30 days old. A closed account's email block is deleted with its account data; afterward, that email can register as a new account.

In the portal, open Settings → Close account. Confirming ends access immediately and shows when deletion is due. After 30 days, the scheduled worker deletes the hosted account, profile photo and email block. Failed deletions are kept for retry, so the due date is not a promise of deletion at an exact second. Support reports and their images keep their separate 30-day period after resolution; open cases remain. Telemetry expires 30 days after collection, including events delivered late.

• Review your configured endpoint and exact model before sending. Switching models can expose supplied conversation context to the newly selected provider.
• Leave optional analytics off if you do not want that sharing. Account, provider and feedback requests are separate data flows.
• Use the portal's profile controls to edit optional fields or remove its profile picture. This is not account deletion.
• Deleting a conversation removes local records and attempts attachment cleanup. It is not a secure-erasure guarantee and does not retract content from a provider, a report or a backup.
• Portal and desktop sign-out controls are session actions. They do not promise deletion of account records, projects, conversations or previously submitted content.

Local chats, projects and copies held by your chosen model providers are outside this account-deletion worker. Previously fetched image URLs can briefly remain cached after deletion. For access, correction or deletion questions, email solara@mailbox.org. Do not interpret access revocation, uninstalling or signing out as an account-closure request.

Operational details still being completed

• The detailed email-handling procedures for lost-access and privacy requests.
• Separate deletion procedures for mailbox copies, service logs and backups. The database worker does not delete these copies.
• The final service-provider list, email delivery operator, hosting regions and data-access responsibilities.
• How to request access, correction or deletion, including any limits and response times.

These remaining procedures are not yet finalized. For questions about this notice, email solara@mailbox.org. A signed-in tester can also raise a concern using portal feedback. No support response time is promised here.