Privacy
Iblis is local-first. Prompts, lyrics, and generated tracks never leave your machine unless you explicitly export them.
What the desktop app sends
- Update and catalog checks. The packaged shell polls
https://storage.googleapis.com/iblis-dist/shell/latest.ymlon launch and every 30 minutes. Plugin screens fetch the signed catalog fromhttps://iblis.meiuxmeiux.com/api/v1/catalog.jsonwhen opened or refreshed. These requests reveal your IP address and User-Agent to Google Cloud Storage or our web server; their standard access logs apply. - Plugin downloads. When you install a plugin, the shell downloads its assets from URLs declared in the signed catalog. These URLs may be hosted by us or by trusted third parties (HuggingFace, R2, GitHub Releases). Each host sees your IP and User-Agent during the download.
- Diagnostics. Off by default. If you turn diagnostics on
in Settings (levels: off / errors / verbose), the shell can send a
redacted bundle of its own logs and environment — app and
plugin versions, engine health, GPU/OS info, and recent log lines with
filesystem paths, tokens, and personal identifiers stripped — to
https://iblis.meiuxmeiux.com/api/v1/diag.php. You trigger it explicitly ("Send diagnostics now"); if enabled, it also auto-sends once when an engine fails to launch, so the error reaches us without a manual paste. Bundles are size-capped, stored off the public web root, readable only by the developer, and deleted after 30 days. Prompts, lyrics, and generated audio are never included. - Crash reports. Captured only while diagnostics is on, as part of the bundle above. Off by default.
- Community Styles. Publishing a trained style uploads the finished style adapters and their metadata to our community library; the app shows an explicit consent screen before any upload. The server records the upload with a hashed install id. Your audio source material never leaves your machine; only the trained adapters and the metadata you typed do.
- Product key activation. A product key is only needed
for the hosted community services (publishing and downloading community
Styles, uploads); generation, training, and everything else local work
without one. If you enter a key, the shell sends the key, a hashed install id, and a hashed machine
fingerprint — salted SHA-256 digests of your network-adapter
hardware addresses, both a combined digest and a per-adapter one so a
dock or a swapped card is recognized as the same machine rather than a
new one; the raw addresses never leave your machine — to
https://iblis.meiuxmeiux.com/api/v1/keys/, then repeats a smaller renewal call roughly weekly while the key is active. Per activation, the server retains those hashes, your IP address, and the app version, in a per-key event log used for abuse control (activation caps). No account is created. Without a product key, none of these requests happen, and everything local keeps working.
What the website does
iblis.meiuxmeiux.com is plain Apache + PHP. No analytics. No third-party JavaScript. Standard access logs are kept for 30 days, then deleted.
Feedback form. A report sent through /feedback stores what you typed (type, title, description, and the optional app version, build, operating system, diagnostics reference, and email address), your browser's User-Agent, and a salted hash of your IP address used only for rate limits; the address itself is not stored. Reports may become public GitHub issues with your email address and other personal details removed. Your email is only used to reply to that report. To have a report deleted, email iblis@meiuxmeiux.com with its reference number.
Future cloud features
Any future feature that uploads content from your machine to a remote server will be off by default, gated behind an explicit per-job consent, and clearly described in this policy before launch.