Privacy Policy

Elia is a self-hosted AI agent platform. The controller of the data described here is the operator of the Elia instance you signed up to. For questions, contact privacy@elia.app.

Account data. Your email address and a password hash. Passwords are hashed with Argon2id and are never stored or logged in a recoverable form.

Sign-in with Google. If you choose to sign in with Google, we receive your Google account identifier, your email address, your display name and your profile picture URL. We request only these scopes: openid, email and profile. We do not request access to Gmail, Drive, Calendar, Contacts or any other Google service, and we cannot read your files or messages.

Agent data. The agents, tasks, conversations, memory entries and files you create. On a self-hosted instance this data lives on the machine running the instance, not on ours.

Technical data. Authentication and audit events (sign-in, sign-out, access-control failures) with timestamps, and the user agent of the client that made the request.

To authenticate you, to isolate your workspace from every other account, to run the agents you ask for, and to keep an audit trail of security-relevant events.

We do not use your data for advertising, we do not sell it, and we do not use Google user data to train machine-learning models.

Elia's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• Google user data is used only to authenticate you and to show your own name and address to you.
• It is never transferred to third parties, except as needed to provide the service or to comply with the law.
• It is never used for advertising, and never sold.
• No human reads it, except where you ask us to, where it is required for security, or where the law requires it.

Session data is kept while your account is active. Audit events are kept for as long as needed for security review. When you delete your account, your account record, workspace, agents, tasks and memory are deleted from the instance.

Cookies are used strictly for authentication: elia_access and elia_refresh are HttpOnly, and elia_csrf is readable by the app so it can send it back in the x-csrf-token header. We set no advertising or analytics cookies.

We do not sell your data and we do not share it with advertisers. Your data is shared only with the infrastructure you chose to run the instance on, and with the LLM provider configured by the instance operator for the agent calls you make.

You can request a copy of your data, correct it, or have it deleted by writing to the contact address above.

To revoke Elia's access to your Google account at any time, visit myaccount.google.com/permissions and remove Elia. Revoking access does not delete your Elia account; it only stops future sign-ins with Google.

Elia is not intended for anyone under 16, and we do not knowingly collect data from them.

If this policy changes in a way that affects you, we will say so on this page and update the date at the top.