domios

Domios Privacy Policy

Version 1.0 (privacy-1.0). Effective: 23 October 2026.

1. Controller

Individual Entrepreneur Andrey Kovalev (ინდივიდუალური მეწარმე ანდრეი კოვალევ), Georgian identification number 302218142, registered by the National Agency of Public Registry, Tbilisi, Georgia, is the controller of the personal data described here. Contact for privacy requests: g.andry90@gmail.com.

Which laws apply

We process personal data under the Law of Georgia on Personal Data Protection (2023), supervised by the Personal Data Protection Service of Georgia. Because we offer Domios to people in the EU/EEA and the United Kingdom, the EU General Data Protection Regulation (GDPR Art. 3(2)(a)) and the UK GDPR also apply to their data. EU/EEA and UK users can reach us directly at g.andry90@gmail.com for any privacy matter.

2. What stays on your machine

Domios runs locally. Your prompts, messages, terminal output, files, paths, workspace and tab names, memory, sessions and credentials stay on your machines. We do not receive them, except the limited installation and analytics data listed in Section 3.

3. What we process

Data When Purpose Legal basis (GDPR Art. 6) Retention
Account: Firebase UID, email address, display name, sign-in provider (Google, Facebook or email) You create an account or sign in Provide the account, sign-in and support Contract, 6(1)(b) Until you delete the account (see Section 6)
Plan and entitlement: plan, status, period end, cancellation flag, Paddle subscription and customer identifiers You buy or manage a plan Grant paid access and sign entitlements Contract, 6(1)(b); legal obligation for records, 6(1)(c) Account lifetime; billing records for as long as tax and accounting law requires
Installation reports: random installation ID, machine label, platform, app version, installed plugins with versions and enabled state, counts of workspaces, tabs and memory items, last-seen time The signed-in app reports periodically Apply plan limits to machines, show your installations, support, abuse prevention Contract, 6(1)(b), for plan limits; legitimate interests, 6(1)(f), for support and abuse prevention 30 days after the last report
Mesh: installation ID, the machine's published network endpoint (IP address or host name and port), Mesh public key and pairing/membership records. Mesh traffic goes directly between your machines and never reaches our servers You enroll machines in Mesh Connect your machines Contract, 6(1)(b) Endpoint until you withdraw it, sign out or delete the account; pairing records until unpaired or account deletion
Product analytics: event name and catalog properties, random installation ID, event ID, timestamp, your Firebase UID if signed in, and the IP address of the request, which Amplitude uses to derive approximate location (country, region, city) Only if you opt in; off by default Understand product use Consent, 6(1)(a) Up to 24 months from collection, then deleted. Opting out stops collection immediately and clears local queued events and identifiers; we delete events already sent on request
Server logs: IP address and request metadata Any request to our servers Security, abuse prevention, operation Legitimate interests, 6(1)(f) Up to 30 days; logs tied to a specific security incident are kept until it is resolved

Analytics never include prompts, messages, terminal output, paths, workspace or tab names, email addresses, display names, session IDs, peer identities, credentials or model names. The full event catalog is in Settings > Privacy > What we collect. Turn analytics off there or with domios analytics disable; this clears queued events and identifiers.

Account data is required to create an account and buy a plan; without it you can still use Domios on the Free plan. Analytics are optional. If you are below the age of digital consent in your country (13 to 16 in the EU/EEA, 13 in the UK), turn on analytics only with your parent's or guardian's consent.

Domios collects and sends no crash reports. Crash logs stay on your machine.

Payment details such as card numbers and billing address are collected by Paddle as Merchant of Record under Paddle's privacy policy. We do not receive card numbers.

4. Processors and recipients

5. International transfers

We are established in Georgia, outside the EU/EEA and UK, and collect your data directly from you to provide the Services. Our processors (Google, Amplitude, Vercel) process data in the United States and other countries. Transfers to them rely on the EU-US Data Privacy Framework (and UK Extension) where the recipient is certified, and otherwise on the European Commission's Standard Contractual Clauses with the UK Addendum; the same safeguards meet the Law of Georgia on Personal Data Protection. You can request a copy at g.andry90@gmail.com.

6. Your rights

You may access, rectify, erase, restrict or object to processing of your data, receive it in a portable form, and withdraw consent at any time without affecting earlier processing. Where we rely on legitimate interests (server logs, support and abuse prevention), you may object at any time on grounds relating to your particular situation. Contact g.andry90@gmail.com. You can complain to the Personal Data Protection Service of Georgia (https://personaldata.ge), and, if you are in the EU/EEA or UK, to the supervisory authority where you live or work (in the UK, the ICO).

Deleting your account

To delete your account, email g.andry90@gmail.com from the address on the account and ask for deletion. We will delete your account and all personal data associated with it, including your entitlement and installation records, and confirm within one month of your request (GDPR Art. 12(3)); we may ask you to verify that the account is yours. Records that tax law requires us to keep, and payment data held by Paddle as an independent controller, are retained only as the law requires. Any remaining copies in backups are deleted in the normal backup cycle. Data on your own machines is not affected.

7. Automated decisions

We make no decisions with legal or similarly significant effects based solely on automated processing. Plan limits apply automatically according to your plan.

8. Children

You must be at least 13 years old, or the minimum age required in your country to consent to use Domios, if that is higher. If you are under 18, you need your parent's or legal guardian's permission. Only adults may buy a plan. If you believe a child below the minimum age has given us personal data, contact g.andry90@gmail.com and we will delete it.

9. Changes

We publish each version at https://domios.dev/privacy with a version number and date, and email registered users at their account address at least 30 days before a material change takes effect.