Every claim above is checkable. Section 3 lists every network call the software can make.
This policy covers two separate objects, and conflating them is how privacy claims become misleading. We keep them apart throughout:
Where a statement applies to only one of these, it says so.
LBrain reads directories you nominate and builds a searchable index. Your source files, the extracted
text, the embedding vectors, and the SQLite database all live under ~/.lbrain/ on your own
machine (or wherever LBRAIN_HOME points). Nothing is copied off the device by the act of
indexing.
LBrain does not delete or modify your source files. It reads them. Your files remain authoritative; the index is a derivative cache that can be deleted and rebuilt at any time.
We cannot access any of it. Not because we promise not to look, but because there is no mechanism by which it would reach us.
A privacy claim is only worth something if it is exhaustive. This is the complete list. None of these endpoints belongs to Metavolve.
| What triggers it | Where it goes | What is sent |
|---|---|---|
| First run with the on-device provider | Hugging Face (falls back to Google Cloud Storage) | A model download request (~67 MB). Discloses your IP address and the fact that you fetched this model. No document content. After this, indexing and search work offline. |
--provider gemini / --provider openai, or passing --gemini-key / --api-key |
Google or OpenAI | The text of your documents and your queries, sent under your own API key, for embedding. Governed by that provider's privacy policy, not this one. |
lbrain consolidate | Google (Gemini) | Clustered passages of your corpus, for abstraction synthesis. Only runs when you invoke it and a key is configured. |
lbrain lair-from-repo | Google (Gemini) | Repository content you point it at. |
Tier-2 archive (lbrain archive, opt-in) | Google or OpenAI, then Arweave | Session content for snapshot generation, then the encrypted archive to Arweave. See §5. |
pip install lbrain / git clone | PyPI, GitHub | Ordinary package-download requests, under their policies. |
What is absent from this table is the point: there is no row for Metavolve. The software has no endpoint of ours to call.
Earlier builds treated an API_KEY variable found anywhere — including one merely exported in
your shell — as a request to embed remotely. A developer who already had that variable set could run the
documented setup command and have their corpus sent to Google without being told. That was wrong and
we fixed it on 27 July 2026. A hosted provider is now selected only when you pass the key explicitly on
the command line, and lbrain init tells you when it has found and ignored an ambient key.
The HTTP transport has no authentication and serves your entire corpus to anyone
who can reach the port. The default bind is 127.0.0.1. Do not bind it to 0.0.0.0
or expose it on an untrusted network without putting authenticated TLS ingress in front of it.
The stdio transport sends nothing over a network — it speaks to a local process on standard input and output.
LBrain has an optional Tier-2 feature that writes an encrypted archive to Arweave, a permanent public storage network. It is off by default, you supply the wallet, and you pay the network fee.
This is not storage for its own sake. A local index is editable — by you, by any process running as you, and increasingly by the agents you invite in. That is fine for a working cache and unacceptable for a record you need to rely on later. Permanence supplies the missing half: an attestation that cannot be quietly revised, timestamped and independently verifiable, against which the editable local system can be checked. It is the ground-truth fallback that makes "what did we decide, and when" answerable rather than merely plausible — for you, and for an agent that has to trust what it is handed.
The LBrain software contains no telemetry, no analytics, no crash or error reporting, no licence verification, and no update check. We do not count installs. We do not know how many people use it or what they use it for, and we have chosen not to find out.
lbrain.ai is a static site hosted on Google Firebase Hosting. Serving a page produces standard web request logs — IP address, user agent, referrer, timestamp, requested path — which Google processes on our behalf and retains for a limited period under its own retention settings. We use these only to understand whether the site is working.
We run no analytics, no advertising, no tracking pixels, and set no cookies. There is nothing to consent to because nothing is collected beyond those server logs. We do not sell or share personal information, as those terms are used in the CCPA/CPRA.
For this website, if you are in the EU, UK, California or another jurisdiction granting data subject rights, you may request access, correction, deletion, or restriction of the limited data described in §7. Write to privacy@golden-codex.com. We respond within 30 days, and will tell you if we need up to 60.
For the software, there is a limit we should be honest about rather than paper over: we hold no copy of your data and no identifier that could link any data to you. If you asked us for a copy of your information, or to delete it, we would have nothing to give you and nothing to erase. That is not an evasion — it is a description of the architecture, and it is the point of building it this way. Your data is on your disk; you delete it by deleting it.
LBrain is a developer tool and is not directed to children under 16. We do not knowingly collect information from children.
Material changes will be posted here with a new date. Because this policy makes factual claims about software behaviour, it is versioned alongside the code — the revision history is public in the repository, so you can see what changed and when.
Privacy: privacy@golden-codex.com
Legal: legal@metavolve.com
Security disclosure: curator@golden-codex.com
Metavolve Labs, Inc. — a Delaware corporation
San Francisco, California, United States