Consortium
Get Started

Privacy Policy

Last updated: February 16, 2026

This Privacy Policy describes how Consortium Contributors (“Consortium,” “we,” “us,” or “our”) collects, uses, and shares information when you use the Consortium application, CLI tool, and related services (collectively, the “Service”). The Service is available at https://consortium.dev and through mobile applications on iOS and Android.

1. Information We Collect

1.1 Account Information

When you create an account, we may collect:

  • Email address (if you sign up via email OTP)
  • Name and username (optional profile fields)
  • Profile avatar (if you upload one)
  • Public cryptographic keys (Ed25519 and Curve25519, generated on your device)

If you sign in with a third-party provider:

  • GitHub: Your GitHub user ID, username, profile information, and primary verified email address. Your GitHub OAuth access token is encrypted at rest on our servers.
  • Google: Your Google ID and profile information.

1.2 End-to-End Encrypted Content

The following data is stored on our servers in end-to-end encrypted (E2EE) form. This means it is encrypted on your device before transmission, and our servers cannot read or access this content:

  • Session messages and conversation history with AI coding agents
  • Session metadata (working directory, hostname, OS, tool list)
  • Machine metadata (hostname, platform, CLI version)
  • Project and card content
  • Direct messages between users
  • Key-value store data and artifacts

Only you (and, for direct messages, the intended recipient) hold the keys to decrypt this content.

1.3 Security and Authentication Data

For security and abuse prevention, we collect:

  • Authentication events: Event type (login, signup, OTP request), IP address, user-agent string, and timestamp.
  • Session tokens: Persistent signed tokens for maintaining your authenticated session.

1.4 Billing Information

If you subscribe to a paid plan, we use Stripe to process payments. We store only your Stripe customer ID, subscription ID, and usage records. We do not store your credit card number or payment card details — these are handled entirely by Stripe. See Stripe’s Privacy Policy.

1.5 Push Notification Tokens

If you enable push notifications, we store your device push token to deliver notifications (e.g., when an AI agent needs your approval).

1.6 VPS Instance Data

If you use our managed VPS feature, we store instance metadata (provider, IP address, region, status) and SSH private keys encrypted at rest on our servers.

1.7 Analytics

We use PostHog for anonymous usage analytics in the mobile and web applications. Analytics data includes:

  • An anonymous, randomly generated user identifier
  • App lifecycle events (app open, app close)
  • Interaction events (e.g., account created, message sent, feature usage)

Analytics data does not include message content, session content, or any E2EE data. The CLI tool does not collect any telemetry or analytics.

1.8 Support Tickets

If you contact support through the app, we collect the subject, message content, and associated account information to resolve your request.

2. How We Use Your Information

We use the information we collect to:

  • Provide, maintain, and improve the Service
  • Authenticate your identity and manage your account
  • Deliver push notifications you have opted into
  • Process payments and manage subscriptions
  • Detect and prevent fraud, abuse, and security incidents
  • Respond to support requests
  • Analyze anonymous usage patterns to improve the Service

We do not use your E2EE content for any purpose, because we cannot access it.

3. Encryption and Security

3.1 End-to-End Encryption

Consortium is designed with end-to-end encryption at its core. Your master secret (a 32-byte cryptographic key) is generated on your device and is used to derive all encryption keys. The server never receives your plaintext master secret.

  • Content encryption: AES-256-GCM for session data; XSalsa20-Poly1305 for legacy sessions
  • Key exchange: Curve25519 (TweetNaCl crypto_box) for key wrapping
  • Signing: Ed25519 for identity verification
  • Recovery phrase: A 24-word BIP39 mnemonic is generated at account creation as an offline backup of your master secret

3.2 OAuth Account Recovery

If you sign in with GitHub or Google, an encrypted copy of your master secret is stored on our servers to enable account recovery on new devices. This copy is encrypted using a server-side key derived from our master secret. This is a convenience trade-off: it allows seamless multi-device access for OAuth users but means the server operator could theoretically decrypt this value. Users who require the highest level of security should use the recovery passphrase method instead.

3.3 Server-Side Encryption

Certain operational data (GitHub OAuth tokens, VPS SSH keys) is encrypted at rest on our servers using keys derived from a server master secret.

4. How We Share Your Information

We do not sell your personal information. We may share information in the following limited circumstances:

  • Service providers: We use third-party services to operate the Service, including Stripe (payments), Mailgun (email delivery), PostHog (analytics), ElevenLabs (voice features), LiveKit (real-time communication), Hetzner and Vultr (VPS provisioning), and Expo (app updates). These providers receive only the minimum information necessary to perform their functions.
  • GitHub and Google: When you use OAuth login or GitHub integrations, information is exchanged with these providers as necessary for authentication and functionality.
  • Legal requirements: We may disclose information if required by law, regulation, legal process, or governmental request.
  • Safety: We may disclose information if we believe it is necessary to protect the rights, safety, or property of Consortium, our users, or the public.

Because session content and messages are end-to-end encrypted, we cannot share this data even if compelled — we do not have the ability to decrypt it.

5. Data Retention

  • Account data: Retained as long as your account is active. You may request account deletion at any time.
  • E2EE content: Encrypted blobs are stored as long as your account is active. Upon account deletion, all associated encrypted data is deleted from our servers.
  • Authentication events: Retained for up to 90 days for security and abuse prevention.
  • Analytics data: Retained in anonymous, aggregated form. Individual analytics events are retained per PostHog’s data retention policies.
  • Billing records: Retained as required by applicable tax and financial regulations.

6. Your Rights and Choices

Depending on your jurisdiction, you may have the right to:

  • Access the personal information we hold about you
  • Correct inaccurate personal information
  • Delete your account and associated data
  • Export your data
  • Object to or restrict certain processing of your data
  • Withdraw consent where processing is based on consent

To exercise these rights, contact us at the channels listed below.

6.1 Guest Access

You may use certain features of the Service without creating an account (“guest mode”). Guest usage does not require providing any personal information.

6.2 Push Notifications

You can disable push notifications at any time through your device settings.

7. Children’s Privacy

The Service is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will take steps to delete that information.

8. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. We take appropriate safeguards to ensure your information is protected in accordance with this Privacy Policy.

9. Open Source

Consortium is open-source software released under the MIT License. You may audit the source code, including all encryption and data handling logic, at https://github.com/ConsortiumAI. You may also self-host the Service for full control over your data.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy and revising the “Last updated” date. Your continued use of the Service after changes are posted constitutes your acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or our data practices, you can reach us at: