Privacy Policy

Last updated: February 27, 2026

Locus is built by Nebula Platform Pty Ltd ("we", "us", "our"). We take your privacy seriously — especially because our product is designed around keeping your documents local and private. This policy explains what data we collect, why, and what we do with it.

What Locus does with your documents

Locus indexes your documents locally on your machine. Your files are never uploaded to our servers, never stored in our infrastructure, and never shared with third parties.

When you ask a question, only small relevant text fragments (chunks) are sent to an AI provider (Anthropic's Claude or OpenAI, depending on your plan) to generate an answer. These fragments are sent via encrypted HTTPS connections and are not stored or used for model training by either Locus or the AI provider.

Data we collect

• Account information: Email address and name when you sign up. Used for authentication and billing.
• Payment information: Processed by Stripe. We never see or store your full card number.
• Usage metrics: Query count, files indexed (count only, not content), and app version. Used to enforce plan limits and improve the product.
• Error reports: Crash logs and error messages, which may include file names but never file contents.

Data we do not collect

• The contents of your documents
• Your search queries or AI responses
• File paths or directory structures
• Screen recordings, keystrokes, or browsing history

Third-party services

We use the following services to operate Locus:

• Supabase — Authentication and user account management
• Stripe — Payment processing and subscription management
• Anthropic (Claude AI) — AI query processing for Focus plan users
• Cloudflare — Website hosting, DNS, and security

Each service operates under their own privacy policies. We only share the minimum data required for each service to function.

Your API key (Command plan)

If you use the Command plan with your own API key, your key is stored locally on your device using your operating system's secure credential storage. It is never transmitted to our servers. Queries made with your own key go directly from your machine to the AI provider.

Cookies

The Locus desktop app does not use cookies. Our website (locusdocs.com) uses only essential cookies required for authentication. We do not use tracking cookies, analytics pixels, or advertising scripts.

Data retention

Your account data is retained while your account is active. If you delete your account, we remove your personal information within 30 days. Anonymised usage statistics may be retained for product improvement.

Your rights

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and data
• Export your account data

To exercise any of these rights, email us at hello@locusdocs.com.

Children

Locus is not intended for use by anyone under the age of 16. We do not knowingly collect data from children.

Changes to this policy

We may update this policy from time to time. We'll notify you of significant changes via email or an in-app notice. The "last updated" date at the top of this page will always reflect the most recent version.

Questions? Reach us at hello@locusdocs.com.