- This website has no analytics, no tracking pixels, no cookies, no accounts and no forms. We do not know who visits it.
- The Cymela CLI runs entirely on your own computer. We operate no servers for it, and it never sends anything to us.
- Your API keys stay on your machine in
~/.cymela/. They are sent only to the model provider you chose, never to Cymela. - Your prompts and code go to the model provider you selected. That transfer is between you and them — read their privacy policy, because that is the one that governs it.
- Your conversation transcripts are written to your own project folder. Deleting them is a local file deletion; nothing is held elsewhere.
This summary is provided for readability and does not replace the full text below.
Who we are
Cymela is an independent artificial-intelligence research project. It is operated by a private individual resident in the Republic of Serbia, not by a registered company. For the purposes of the Serbian Law on Personal Data Protection (Zakon o zaštiti podataka o ličnosti, ZZPL) and, where it applies, the EU General Data Protection Regulation (GDPR), that individual is the data controller for the limited processing described in this policy.
Controller contact: contact@cymela.com. This address reaches the operator directly and is monitored.
The operator is not named individually on this page. Cymela is a non-commercial research project with no user accounts, no user database and no payments, and the processing described below is minimal. The operator's full legal name and address will be provided on any legitimate request — including from a supervisory authority, a court, or a person pursuing a genuine legal claim — and will be published here if Cymela is incorporated or begins taking payments.
"Cymela", "we" and "us" in this document refer to that operator. "You" refers to a visitor to this website or a user of the Cymela CLI.
The website
This website is a set of static pages. It does not run analytics, advertising, tracking pixels, session recording, fingerprinting, or any third-party script that reports your visit to anyone. There are no user accounts, no sign-up forms and no comment fields. We do not build a profile of you and we could not identify you if we wanted to.
Every asset this site loads — stylesheets, scripts, images, and fonts — is served from this domain only. The page makes no request to any third-party server, so no other party learns your IP address, your browser, or that you visited at all. Web fonts are self-hosted specifically for this reason: loading them from a font CDN would disclose your IP address to that provider on every page view, which is exactly the kind of quiet data transfer this policy exists to rule out.
Cookies
This site sets no cookies at all — first-party or third-party. Because of this there is no consent banner, and none is required.
Local storage
One value is written to your browser's local storage on the CLI page: the key
cymela.shell, which remembers whether you picked CMD, PowerShell, WSL, Linux or macOS
so the install command matches your system on your next visit. This is a functional preference you
set yourself. It contains no identifier, it is never transmitted anywhere, and clearing your
browser data removes it.
Server logs
Like any website, the server that delivers these pages processes the technical information necessary to deliver them — including your IP address, the requested file, and your browser's user-agent string. This is inherent to how the web works. This site is served by Cloudflare, which handles that processing as our hosting provider under its own privacy terms. We have not enabled analytics on it, we do not use these logs to identify, profile or track visitors, and we do not combine them with anything else.
The Cymela CLI
This is the part most worth reading carefully, because it is where the meaningful data handling happens — and almost none of it involves us.
Cymela operates no backend for the CLI. There is no Cymela account, no Cymela API, no Cymela server that your prompts pass through. The tool is a program that runs on your computer and talks directly to a model provider you choose and pay for yourself. We receive nothing — not your prompts, not your code, not your keys, not usage statistics, not crash reports.
What the CLI stores, and where
All of the following are plain files on your own disk. None of them are transmitted to us.
0600) on operating systems that support
them. Keys may alternatively be supplied through environment variables, in which case nothing
is written to disk at all.
Because transcripts and attachments live inside your project directory, you should add
.cymela/ to your .gitignore if you do not want them committed to a
shared repository. We recommend this.
What leaves your machine
When the CLI is running, network requests fall into the following categories — and no others. None of these services are operated by Cymela. One category is open-ended by design and is flagged as such below.
x-app, identifying the request as coming from Cymela, and
x-session-id, a random value generated locally per session for request
correlation. The session identifier is not linked to you, is not stored by us, and is
regenerated each session. A few internal code paths — the persona sanitizer and the vision
call below — do not send those headers at all.
html.duckduckgo.com and api.duckduckgo.com) and to
Wikipedia (en.wikipedia.org). If — and only if — you configure a Brave Search
API key, queries also go to api.search.brave.com, authenticated with that key.
Each service's own privacy policy governs its request.
api.deepseek.com instead, together with the instruction describing
what to look at. This happens when a DeepSeek key is available — either because DeepSeek
is your active provider or because DEEPSEEK_API_KEY is set. A separate full
override exists via CYMELA_VISION_API_KEY and CYMELA_VISION_MODEL.
With no such key present, images are not sent anywhere and the CLI tells you so.
generativelanguage.googleapis.com with the API key in the URL query string
rather than a header — meaning the key can appear in intermediate server logs. That is
Google's interface, not a choice we make, but you should know it before pointing the CLI
at a Gemini key you care about.
npm install. This is npm's
infrastructure, governed by npm's own policies.
One thing that deliberately never leaves your machine: the CLI refuses to send any message you
type wearing its reserved AUTOMATED MESSAGE marker (described in the
Terms, Section 09). That check runs locally in the
composer. The blocked text is not transmitted to anyone, the refusal notice is shown briefly and
never stored, and no record of the attempt is kept or reported — there is no server for it to be
reported to.
Model providers
The CLI is provider-neutral. You choose which service processes your prompts, and you bring your own account and API key. Supported providers currently include OpenRouter, OpenAI, Google (Gemini), Anthropic, Mistral, DeepSeek, Groq, SiliconFlow, Qwen, Moonshot, Zhipu and NVIDIA.
Your relationship with that provider is directly between you and them. Cymela is not a party to it, does not receive a copy of what you send, and has no control over how the provider stores, retains, trains on, or discloses your data. Providers differ enormously on these points — some retain prompts for extended periods, some train on them by default, and some are subject to different national jurisdictions than others.
Before sending confidential, proprietary or personal data through the CLI, read the privacy policy and data-retention terms of the specific provider you have selected. If you are handling other people's personal data, that provider — not Cymela — is the processor you need to have assessed and, where required, contracted with.
Because these providers are located worldwide, using them will generally involve an international transfer of whatever you send. That transfer is initiated by you, from your machine, under your own account, on terms you agreed with the provider.
Model weights and repositories
Where Cymela publishes software, model weights or research artifacts, these are hosted on third-party platforms — npm, GitHub and Hugging Face. Downloading them is a transaction between you and that platform, under that platform's privacy policy rather than ours. Those platforms log the request. We do not see those logs.
What reaches us is narrower than people tend to assume. Download and install counts arrive as aggregate totals only — a number per day, no identities attached, and no way for us to tell one download from another or a person from an automated one. We cannot see who installed the CLI. Neither npm nor Hugging Face offers publishers that, and we have not asked for it by any other route.
There is one place names are visible, and it is public by design. If you star, watch or fork a repository, or open an issue or a pull request, your username and whatever your platform profile shows publicly are visible to us in exactly the way they are visible to anyone else who opens that page. We do not collect it, export it, or build anything from it. If you contribute code, the name and email address configured in your git client become part of the public commit history — that is how git works everywhere, and it is set by you rather than by us.
If you email us
If you write to contact@cymela.com — about a partnership, a bug, or anything else — we will hold your email address and the contents of your message for as long as needed to deal with the matter and to keep a record of the correspondence. Email is handled by a third-party mail provider on our behalf. We do not add correspondents to any mailing list and we do not use your address for anything other than replying to you.
Legal bases for processing
Where the GDPR or the ZZPL applies to the limited processing described above, we rely on the following bases:
- Legitimate interests (Art. 6(1)(f) GDPR) — for the technical server logs necessary to deliver and secure this website, and for handling correspondence you initiate. Our interest is in operating a functioning, secure website and answering people who contact us; this is balanced against the minimal and non-intrusive nature of the data involved.
- Performance of a contract or steps taken at your request (Art. 6(1)(b) GDPR) — where you contact us about a collaboration, partnership or similar arrangement.
We do not rely on consent for anything on this website, because nothing here requires it. We carry out no automated decision-making or profiling that produces legal or similarly significant effects concerning you.
Your rights
Under the ZZPL and the GDPR you have the right to request access to the personal data we hold about you, to have it corrected or erased, to restrict or object to its processing, and to receive it in a portable format. You may exercise any of these by writing to contact@cymela.com. You do not need an account to make a request, and we will not charge you for it.
In practice, the only personal data we are likely to hold about any individual is an email exchange they started. We cannot provide access to CLI data, prompts or transcripts, because we never receive them — those files are on your own computer and entirely under your control. For data held by a model provider, you must direct your request to that provider.
If you believe your data has been handled unlawfully, you may lodge a complaint with the Serbian Commissioner for Information of Public Importance and Personal Data Protection (Poverenik), or, if you are in the EU or the UK, with your local supervisory authority.
Retention
Correspondence is kept for as long as the matter is live, and for a reasonable period afterwards as a record. Technical server logs are short-lived and are not archived. We keep no separate copy of the platform statistics or public activity described in Section 06 — what those platforms show us, they show us, and it leaves our view when they change it. Everything the CLI produces is retained for exactly as long as you keep the files, because they are your files.
Children
Cymela's products are developer tools intended for adults and are not directed at children. We do not knowingly collect personal data from anyone under the age of 15 (the threshold under Serbian law; the applicable age is 16 under the GDPR, or lower where a Member State has legislated for it). If you believe a child has sent us personal data, contact us and we will delete it.
Changes to this policy
Cymela is under active development, and this policy will change as the products do — particularly if we ever introduce a hosted service, accounts, or telemetry. If that happens, this page will be updated before the change ships, and the version number and date at the top will be revised. Any change that materially reduces your privacy will be announced on this site rather than made quietly.
Contact
Questions about this policy, or about anything else on this site, go to contact@cymela.com.
See also our Terms of Use, which govern your use of the website, the CLI and any models we publish.