Legal and compliance

Summary of legal docs and operational compliance for the Clavue platform and imux product. Formal pages control.

Formal documents

• Terms of Service
• Privacy Policy (master + product URL table)
• Short privacy alias /privacy
• Acceptable Use Policy (AUP)
• End User License Agreement (EULA)

Per-product privacy URLs (for store forms)

Aligned with Cursor (/privacy), Warp (/legal/privacy-policy), Claude master legal pages: one policy, stable per-product URLs.

• imux macOS — https://www.clavue.com/privacy-policy/imux-macos
• imux Windows — https://www.clavue.com/privacy-policy/imux-windows
• imux Mobile (com.imux.mobile) — https://www.clavue.com/privacy-policy/imux-mobile
• Clavue Mobile (com.clavue.xw) — https://www.clavue.com/privacy-policy/clavue-mobile
• Clavue Web — https://www.clavue.com/privacy-policy/clavue-web
• Clavue API — https://www.clavue.com/privacy-policy/clavue-api
• imux Remote Daemon — https://www.clavue.com/privacy-policy/imux-remote
• Master — https://www.clavue.com/privacy-policy

imux brand mirror uses the same paths on https://www.iccjk.com/… (deployed with clavue.com).

Image safety & provenance

• Prompt safety: blocks sexual, sensitive political, CSAM, extreme violence, non-consensual intimate imagery, etc. (enabled by default on api.clavue.com / membership gateway).
• Provenance: each successful image is bound to a membership account with prompt hash, content SHA-256, request id; PNGs embed tEXt metadata (ClavueImageId / ClavueUserId, etc.).
• Operator lookup: admin console “Image provenance” by id / user / hash (admin token).

Data & membership

• Membership data (accounts, sessions, usage) lives under IMUX_MEMBERSHIP_STORAGE_DIR; Clavue session secrets are not shared with third-party model vendors as product keys.
• Chat content is forwarded through the membership gateway to upstream inference to produce replies; do not submit secrets or government IDs.
• Payments via Alipay / WeChat and similar; full card numbers are not stored in the client.

Security practices

• Transport: api.clavue.com / www use TLS (Let’s Encrypt).
• Content safety: membership chat gateway applies light high-confidence blocks (configurable; does not impede local toolchains).
• imux local: tool calls respect seatbelt / path policy and approvals, complementary to cloud text policy.

Acceptable use

Do not use the service for malware, unauthorized intrusion, CSAM, or clear violent-crime assistance. Accounts may be rate-limited or disabled.

Third-party components

imux integrates open-source components such as Ghostty/libghostty; see docs/third-party-compliance.md and product legal pages.