Privacy Policy
This policy explains the information handled by Exalto Capture, Exalto Seal and this website: the local capture tooling, the hosted sealing, verification and Trace-sharing service, and your account.
Local capture stays local
The local proxy on your machine handles application plaintext and provider credentials. Under the Exalto Capture Protocol (ECP), the remote notary witnesses encrypted traffic and protocol metadata; it does not receive your API key, your prompts or the provider’s responses. Captured Traces stay in an encrypted archive on your machine. Sealing one sends the notary only what the protocol needs in order to sign, never the plaintext, and publishes nothing; sharing is a separate, explicit action.
Account information
If you sign in with Google, we use your stable Google account identifier, display name, and profile image to operate your account. We check that Google reports a verified email address but do not retain the address. Google access is limited to openid, email, and profile. If configured, GitHub sign-in remains available for existing accounts and requests identity only, without repository, organization, or email access. Provider access tokens are not retained.
Shared Traces
Sharing is an explicit action on a Sealed Trace. The service verifies and safety-scans a submitted .llmtrace package before admission, then hosts the disclosed conversation and the exact admitted package at a stable link. Header values are hidden by the package’s default disclosure policy, but request and response bodies, including prompts, responses, tool definitions and tool results, may be accessible to anyone with the link. Do not share content you are not permitted to disclose.
Service processing
One-off verification does not retain an uploaded package. Sharing retains the exact admitted package and its normalized trace so visitors can inspect the Trace and independently verify the original bytes. Temporary intake objects are removed after admission or rejection.
Plan, usage, and billing
We record the capture and sealing usage your account settles and the storage your shared packages occupy, so allowances and balances can be enforced. Paid plans and additional sealing are processed by Stripe as our payment processor; card details are handled by Stripe and are not stored by this service.
Devices and API keys
Connecting a device stores a rotating device credential and the metadata needed to list and revoke it. A deployment API key is stored only as a verifier; the complete key is shown once at creation and cannot be retrieved afterwards. You can revoke either from hosted Account settings.
Cookies
The hosted service sets host-only cookies only where they are strictly necessary. Signing in sets a session cookie, and the sign-in redirect briefly sets state and verifier cookies for that one exchange. Separately, unlocking a password-protected shared Trace sets a cookie for that Trace so you are not asked again for 24 hours; that one is set for visitors who are not signed in. We do not set advertising or cross-site tracking cookies.
This website
capture.exalto.ai serves static pages and runs no advertising or analytics scripts. When you open a page, your browser asks the hosted service whether you are signed in, so the header can offer your account; the pages with a download button also read the current release version from our download storage. The landing page embeds one post from X, loaded from X’s servers with a do-not-track request; X may set its own cookies when that embed loads, under X’s privacy policy.
Deleting your account
Deleting your account removes the account record, queues every hosted Trace it owns for deletion, and signs you out. Local Traces on your own devices are not touched; disconnecting or deleting does not remove evidence you hold locally.
Trace reports
A report retains the selected reason and optional note for moderation. Reports are append-only. A keyed network-derived value rate-limits submissions separately, and the application does not store the reporter’s raw IP address in the report record.
Your choices
You choose whether a shared Trace is Unlisted or Listed. Both start accessible to anyone with the link; Unlisted only keeps it out of public Traces. After admission, you can stop sharing, require a password, or set an expiry. Keep private captures and credentials under your control. For privacy questions or requests, contact the Exalto Seal operator through the project’s support channel.
Updates
We may revise this policy as the service evolves. The current version will always be available on this page.