The short version. This website sets no cookies and has no forms, no accounts and no advertising or cross-site tracking scripts. It counts page views with Cloudflare Web Analytics, which uses no cookies. Soma, the program, runs on your computer, and its calls to the outside are listed below, in full.
This page covers soma.gravicity.ai and the Soma beta. Somaverse (somaverse.ai) accounts and hosted services have their own privacy page when that service opens.
Who is responsible
Gravicity AI, an independent project of a sole proprietorship in Ontario, Canada. Our privacy officer is Curtis Mercier, at privacy@gravicity.ai. We follow Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA).
The website
What we collect ourselves: page-view counts. The site uses Cloudflare’s web analytics, which counts page views without cookies and without following you from site to site. We see totals such as which pages were viewed, where visitors came from, and their country and browser type. We do not see who you are. We set no cookies, and there is nothing on the site to sign up for or fill in.
What your browser keeps on your own device. The site saves three small settings in your browser’s local storage so the page looks the way you left it: your light or dark theme (soma-theme), the sky mood (soma-sky-mood) and the speed of the audio player (nova-player.speed). They never leave your browser. Clear them any time in your browser settings.
Our host. The site is served by Cloudflare. Like any host, Cloudflare receives your IP address and the usual request details (the page, your browser type) in order to deliver the page and protect the site.
Other companies your browser contacts when a page loads. These see your IP address and browser details, under their own policies:
| who | why | when |
|---|---|---|
| Cloudflare (Web Analytics) | counts page views, without cookies | every page |
| Fontshare (Indian Type Foundry) | the Clash Display and Satoshi fonts | every page |
| Google Fonts | the Manrope font | every page |
GitHub (raw.githubusercontent.com) | the community hub pages and the community stats fetch the hub’s index file | only the pages that show hub content |
When you follow a link to GitHub, npm or somaverse.ai, that site’s policy applies from there.
The Soma beta (the program on your computer)
Soma runs locally and keeps its memory, notes and settings in folders on your machine. We do not receive them. We run no server that your copy of Soma reports to by default, and Soma has no analytics of ours. Soma does not send an install count.
Soma does make some calls over the network. Here they all are:
| what | where it goes | what it sends | when |
|---|---|---|---|
| Your model provider (Anthropic, OpenAI, OpenRouter, Cohere or another you set up) | the provider you chose | your prompts, the files and tool output the agent includes, and your own API key | whenever you chat. We never see this and do not proxy it. The provider’s terms and privacy policy apply, so choose with that in mind. |
| Install and update | github.com/meetsoma/soma-beta (git over HTTPS) | what any git client sends: your IP address and a git user-agent | when you install and when you run soma update |
| Community content | raw.githubusercontent.com/meetsoma/community and the GitHub API | your IP address and the file requested; the item names you ask for | at start-up after your first run (a small template check), and when you use the hub |
| Model list (from the Pi runtime Soma is built on) | pi.dev, run by the Pi project, not by us | the provider name in the address of a model-list request | when Soma refreshes its model list |
| Web search, if you turn it on | Brave Search (with your own key) or a SearXNG server you point it at | your search words | only when you use it |
| Documentation and package lookups | pi.dev, Cloudflare docs, public docs sites | your search words | only when you run those commands |
| The Somaverse link, if you pair it | somaverse.ai | until you allow more, only that a turn started or ended and the name of the tool running. With acceptPrompts on, also your messages and tool output. | only after you pair with soma login. It does nothing before that. |
You can stop most of these: work offline, use a local model, or leave the optional ones off.
Why we use information, and who sees it
- To run the website and keep it safe. (our host)
- To understand which pages are read, from the page-view counts above.
- To answer you, if you email us. We use your address and message to reply, and keep the thread for as long as we need it to deal with your request and two years after.
- To fix and improve Soma, from reports you choose to send us.
We do not sell personal information. We do not use it for advertising.
If you write to us we keep your email and what you tell us. By writing to us you agree that we may reply and keep the thread. You can ask us to delete it.
Where it is kept
Cloudflare, GitHub and the other companies above run servers in several countries, including the United States. Your information may be handled there, under those countries’ laws.
Your rights
Under PIPEDA you may ask us what we hold about you, ask us to correct it, ask us to delete it, and withdraw consent where consent is the reason we hold it. Write to privacy@gravicity.ai. We will answer within 30 days. If you are not satisfied, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).
If you live in Quebec or the EU other rights may apply to you.
Children
Soma is not meant for anyone under 13. We do not knowingly collect a child’s information.
Safeguards
We limit who can read what we hold, and we use the security practices described on the Security page. If you find a problem, tell us there.
Changes
If we change this page we change the date below, and for a material change we will say so on the home page. Older versions are kept in the public repository’s history.
Effective October 29, 2026.