Privacy policy

1. Who we are

This policy explains how Styx (“we”, “us”) handles personal information. We are responsible for the information described here. Styx is provided by Nic Flemmer, trading as Styx. Questions, requests and complaints go to hello@heystyx.com.

This policy covers the Styx desktop app, the Styx account service it signs in to, and this website (heystyx.com).

2. What stays on your computer

Styx is a desktop app. The following is stored only on your computer, and we have no access to it:

• your projects, their files, branches and worktrees, and the changes your agents make;
• your agent sessions and conversations;
• the credentials you connect for deploy and server targets (Vercel, Supabase, AWS, Google Cloud, Fly.io, Railway, Render, GitHub, SSH). These are kept in your operating system's keychain (the macOS Keychain, Windows Credential Manager, or the Secret Service keyring on Linux);
• the approvals and audit log that record what your agents asked for and what you allowed;
• your settings and preferences.

When you use an AI coding agent through Styx (Claude Code, Codex, Gemini CLI, Cursor, OpenCode), the agent runs on your computer under your own account with that provider, and talks to that provider directly. What those providers do with your data is governed by your agreement with them, not by this policy. The same applies to the cloud and hosting services your agents deploy to.

3. Your Styx account

Signing in is optional: all of Styx works without an account. If you sign in with GitHub or Google, we receive and keep:

• your email address, name and profile picture link, as provided by GitHub or Google;
• which of the two you signed in with, and your ID with that provider;
• your plan and when it ends;
• when your account was created and when you last used Styx.

We never see your GitHub or Google password. We use this information to sign you in, to tie your usage counts to your account (see below), and to contact you about your account. An account doesn't unlock or limit anything in the app. Keeping this information is necessary to provide the account you asked for.

When git on your computer has no name and email set, Styx uses your account name and email to sign the commits it makes. This happens on your computer.

Sign-in codes expire within minutes. The tokens that keep you signed in expire on their own, and signing out revokes all of them.

4. Usage counts

Styx counts a fixed list of events, and nothing else. Each count is only the event's name and how many times it happened. The list is fixed in the app's source code, and these are all of them:

Using the app

• a Styx window was opened;
• first-run setup was finished;
• a project was added;
• the first-run walkthrough was shown, played to the end, or closed early.

Working with agents

• an agent was started;
• a message was sent to an agent;
• an agent finished its first piece of work in a session (counted once per session);
• an agent's work was landed on the main branch.

Access and deploys

• an access request was approved;
• a deploy was started.

When something goes wrong

• an agent could not start or stopped straight away, with one of seven fixed reasons: its program is not installed, it would not launch, it is not signed in, it is out of date, its account hit a usage or rate limit or ran out of credit, it reported another error, or it closed with an error within its first seconds;
• Styx crashed: a window, one of its helper processes, or the app itself (noticed the next time you open it).

With the counts, Styx sends its version number, your operating system (macOS, Windows or Linux), and an install id: a random code your copy of Styx makes the first time it runs. The install id is not made from your computer, your name or anything else about you, and on its own we cannot tell who it belongs to. While you are signed in, the counts are also tied to your account.

This lets us see how many people use Styx and which parts they reach. The counts never include a project, file, path, branch, command, prompt, the text of a message or anything your agents produce: the app is built so that it cannot attach them. Our server does not store your IP address with them. Repeats are added together, and Styx sends what it has every few minutes and when it quits. You can turn counts off at any time in Styx under Settings › Account › Send usage counts. We keep them for six months and then delete them, and an install we have not heard from in six months is forgotten. We rely on our legitimate interest in understanding how Styx is used; you can object by turning them off.

Styx is open source, so you can also run it yourself. Running it from the source code with pnpm dev never sends counts. A build you package yourself sends them to us like a release does, unless you point it at a different server (with STYX_API) or turn the setting off.

Feedback

If you send feedback from the app, we receive your message, your email address if you type one (or your account's, if you are signed in), Styx's version, your operating system and your install id. We use it to read and answer what you wrote and to improve Styx, and keep it for a year. Nothing from your projects is attached.

If you tick Include diagnostics when you send feedback (it is off unless you do), we also receive the last part of Styx's own log file, so we can see what went wrong. Passwords, keys and tokens are masked before it leaves your computer. The log can include the names and folders of your projects and the names of the agents you use, but never the contents of your files or anything your agents wrote. It is kept with your feedback, for a year.

5. This website

Hosting

heystyx.com is hosted on Google Cloud. Like any web server, it records each request (IP address, browser, page and time) to keep the service running and secure. These logs are kept for 30 days.

Download counts

The Mac and Windows Download buttons go through our server, which adds one to a daily count and sends you on to the file. The count records only where the click came from: a short tag in the link (such as ?from=hn) or the name of the website you came from. No cookie is set, and your IP address and browser are not stored with it. The Linux download is on GitHub, so that link goes straight there and our server doesn't count it.

Analytics and cookies

We use Google Analytics, loaded through Google Tag Manager, to understand which pages and links bring people to Styx. It records the pages you view, the parts of the page you reach, clicks on download and outside links, where you came from (including campaign tags in links), your approximate location (country and city, derived from your IP address, which Google Analytics does not store), and your device and browser type.

• Before you choose, and if you decline, no analytics cookies are set. Google receives cookieless signals without identifiers, which it uses only to estimate totals.
• If you accept, Google Analytics sets the cookies _ga and _ga_VT0TQG7CF8, which last up to two years. Google Analytics keeps event-level data for two months.

You can change your choice at any time: open cookie settings. The site also stores two settings in your browser (not cookies): your light or dark theme, and your cookie choice.

6. Who else handles your information

We don't sell personal information, and we don't share it for advertising.

7. International transfers

Our account service and database run in the United States. Where your information moves across borders, it is protected by our providers' data processing terms, including standard contractual clauses where the law requires them.

8. How long we keep it

9. Your rights

You can ask us to show you the personal information we hold about you, correct it, delete it, give you a copy, or stop using it. You can withdraw consent to cookies at any time. Turning off usage counts stops them at once. To delete your account and its usage counts, email hello@heystyx.com from the address on your account; we will do it within 30 days and confirm when it's done.

If you are unhappy with how we handle your information, please tell us first. You can also complain to your data protection authority: in South Africa, the Information Regulator; in the UK, the Information Commissioner's Office; in the European Union, the authority where you live.

10. Children

Styx is a tool for software developers and isn't meant for anyone under 16.

11. Security

Everything between the app, the website and our servers is encrypted in transit. Our service secrets are held in Google Secret Manager, and access to account data is limited to named administrators. No system is perfectly secure; if we learn of a breach that affects you, we will tell you and the relevant authorities as the law requires.

12. Changes

When we change this policy we update the date at the top. If a change matters, for example we start collecting something new, we will say so on this site and in the app before it takes effect.

13. Contact

Nic Flemmer, trading as Styx. Email hello@heystyx.com.