Privacy
Iblis is local-first. Prompts, lyrics, and generated tracks never leave your machine unless you explicitly export them.
What the desktop app sends
- Update and catalog checks. The packaged shell polls
https://storage.googleapis.com/iblis-dist/shell/latest.ymlon launch and every 30 minutes. Plugin screens fetch the signed catalog fromhttps://iblis.meiuxmeiux.com/api/v1/catalog.jsonwhen opened or refreshed. These requests reveal your IP address and User-Agent to Google Cloud Storage or our web server; their standard access logs apply. - Plugin downloads. When you install a plugin, the shell downloads its assets from URLs declared in the signed catalog. These URLs may be hosted by us or by trusted third parties (HuggingFace, R2, GitHub Releases). Each host sees your IP and User-Agent during the download.
- Diagnostics. Off by default. If you turn diagnostics on
in Settings (levels: off / errors / verbose), the shell can send a
redacted bundle of its own logs and environment — app and
plugin versions, engine health, GPU/OS info, and recent log lines with
filesystem paths, tokens, and personal identifiers stripped — to
https://iblis.meiuxmeiux.com/api/v1/diag.php. You trigger it explicitly ("Send diagnostics now"); if enabled, it also auto-sends once when an engine fails to launch, so the error reaches us without a manual paste. Bundles are size-capped, stored off the public web root, readable only by the developer, and deleted after 30 days. Prompts, lyrics, and generated audio are never included. - Crash reports. Captured only while diagnostics is on, as part of the bundle above. Off by default.
- Community trainings. Starting a Training uploads the finished style adapters and their metadata to our community library — that is the feature's explicit consent screen, shown before every training. The server records the upload with a hashed install id. Your audio source material never leaves your machine; only the trained adapters and the metadata you typed do.
- Product key activation. If you enter a product key
(unlocks Training, Generation, and the community Styles library), the
shell sends the key, a hashed install id, and a hashed machine
fingerprint — salted SHA-256 digests of your network-adapter
hardware addresses, both a combined digest and a per-adapter one so a
dock or a swapped card is recognized as the same machine rather than a
new one; the raw addresses never leave your machine — to
https://iblis.meiuxmeiux.com/api/v1/keys/, then repeats a smaller renewal call roughly weekly while the key is active. Per activation, the server retains those hashes, your IP address, and the app version, in a per-key event log used for abuse control (activation caps). No account is created. Without a product key, none of these requests happen, and everything local keeps working.
What the website does
iblis.meiuxmeiux.com is plain Apache + PHP. No analytics. No third-party JavaScript. Standard access logs are kept for 30 days, then deleted.
Future cloud features
Any future feature that uploads content from your machine to a remote server will be off by default, gated behind an explicit per-job consent, and clearly described in this policy before launch.