Privacy Policy
Last Updated September 30, 2026
This Privacy Policy explains how Butterfly Interaction, Inc. (“Butterfly,” “we,” “us,” or “our”) may collect, use, store, and share personal information when you:
- visit our website at https://www.butterfly.so;
- join the Pond waitlist or participate in the Pond Early Preview;
- download, install, or use Pond, including the Pond installer; or
- communicate with us through email or other official Pond or Butterfly channels.
In this Privacy Policy, our website, Pond, the Pond installer, and our related services and official community channels are collectively called the “Services.”
We aim to collect only the information reasonably needed to operate, secure, troubleshoot, and improve Pond, support users, communicate with our community, and meet our legal obligations.
This policy explains what we collect and why. If you do not agree with this policy, please do not access our website or use Pond.
If you have questions about this Privacy Policy or how we handle personal information, contact us at hello@butterfly.so.
What We Collect and Why
The information we collect depends on how you interact with Pond, our website, and our community spaces.
Information You Give Us Directly
When you sign up for the Pond waitlist or communicate with our team, you actively share information with us:
- Waitlist and Early Preview Access: Your email address when you sign up. We use the waitlist to send Early Preview invitations and related Early Preview communications.
- Messages From Our Website: The name or email address, message, and other information you submit through our website contact form. We also record when the message was sent.
- Support and Feedback: Bug reports, diagnostic logs, screenshots, or support messages you choose to send us. If you contact us or take part in our official Discord or GitHub spaces, we can see your username or handle, public profile information, and anything you post or send. Posts on GitHub or in our Discord may be visible to other people. Before submitting a screenshot, recording, log, or file, please review it and remove personal, confidential, or sensitive information that is not necessary for us to investigate the issue.
Information We Collect Automatically
When you visit our website or use Pond, we may automatically collect technical and usage information. Depending on what you use, this may include:
- Device & Usage Details: When you submit the waitlist form, we record the operating system family reported by your browser so we can prioritize platform support. Our hosting provider (Vercel) receives your IP address and browser information in standard server logs as part of serving the site.
- Analytics: We use Plausible, a privacy-focused analytics service, proxied through our own domain. It does not use cookies or store persistent identifiers. It records the page visited, referrer, and general device information, and on the Pond page it records whether you opened or submitted the waitlist form.
We use this information to run, secure, troubleshoot, and improve Pond, our website, and our services. The Pond installer collects additional technical and diagnostic information, as explained below.
Pond Installer Technical and Diagnostic Information
When you open the Pond Windows installer, it automatically checks your system compatibility and collects setup diagnostics to help us fix installation failures. This collection starts as soon as the installer opens, even if your device does not pass the initial compatibility check.
This information may include:
- Attempt IDs and Timestamps: Each installer attempt receives a randomly generated attempt ID. This allows us to connect events from the same attempt, including restarts requested by the installer. Records may also include event and diagnostic IDs, timestamps, and the installer version. A fresh launch or a new attempt after a successful or failed installation receives a new attempt ID. Pond does not link separate attempts to the same device or user.
- Computer Hardware: Device manufacturer, product model and model family, total memory, CPU manufacturer and model, processor core and thread counts, GPU model and driver version, BIOS or firmware information, and information about physical disks such as manufacturer, model, capacity, connection type, media type, and disk count.
- Windows and Prerequisite Status: Windows version and build, UEFI status, Secure Boot and BitLocker status, virtualization support and status, hypervisor presence, WSL and Virtual Machine Platform status, and whether Windows requires a restart.
- Storage Configuration: Windows volume capacity and free space, sector sizes, the amount of storage requested for Pond, available allocation limits, reserved working space, final allocation, and information about partitions on the target disk such as partition number, position, size, and standard partition type.
- Storage Troubleshooting Information: EFI system partition capacity and available space, available space on Windows staging volumes and within WSL during certain failures, and known system files that may prevent storage resizing, such as
pagefile.sys,hiberfil.sys, or$MFT. - Installer Usage and Performance: Installer screens displayed, time spent on screens, installer launches and closures, restart requests and returns, installation stages, operation durations, and progress information.
- Installation Outcomes and Errors: Whether installation succeeds, fails, is blocked, or requires a restart; failed operations; error categories and available numeric error codes; rollback results; and information identifying the Pond image being installed.
- Failure Diagnostics: When the installer encounters certain failures during the compatibility check, installation, or rollback, it may collect diagnostic text such as installer messages, command output, error details, package or build information, and cleanup or rollback messages. Regional format, display language, keyboard layout, and time zone identifiers may also appear in this text.
- Downloads: The installer downloads the base Linux image from Arch Linux’s public mirror network and the Pond system image from our release server, hosted on Cloudflare. Those servers receive your IP address as part of serving the download.
The installer does not collect hardware serial numbers, unique disk or partition identifiers, or MAC addresses.
Automated Diagnostic Redaction
Apart from failure diagnostics, automatic installer events contain structured technical data, such as the categories, version numbers, and measurements described above, and no free-form text. Free-form text is collected only in failure diagnostics. Before that text is queued or sent, the installer applies automated redaction rules on your device. These remove the Windows account name and computer name, and the Pond username, computer name, and password you enter, wherever they appear. They also use text-matching patterns to remove file and folder paths, email and web addresses, IP and MAC addresses, Windows account and device identifiers, serial numbers, volume labels, Wi-Fi network profiles and passwords, and other values that look like secrets. A small set of fixed system paths that help troubleshooting is kept. Our servers also reject diagnostic text that has not been redacted.
Because these rules rely on text matching, we cannot guarantee that they will detect and remove every possible piece of personal or sensitive information in diagnostic output.
Reports You Choose to Send
Some diagnostic details are sent only when you explicitly choose to share them. The storage blocker report described below is sent only if you choose “Send report.” It includes:
- the path of the file preventing storage allocation, with the Windows user folder name removed;
- the requested amount of storage;
- the amount of storage available; and
- the same attempt ID used for related installer telemetry.
File paths may still include other folder names or filenames. The file itself is not uploaded. The installer also has a “Copy diagnostic log” option. This copies the unredacted local log to your clipboard but does not send it to Butterfly. You decide whether to share it with us.
Information Used Locally During Installation
The installer uses certain information locally to configure Pond, including:
- the username, password, and computer name you choose for Pond;
- language, regional, keyboard, and time zone settings; and
- the name and password of the currently connected Wi-Fi network.
Passwords and Wi-Fi credentials are not included in installer analytics or telemetry. The installer removes your chosen username, computer name, and password from diagnostic text before it is sent. Language, regional format, keyboard layout, and time zone identifiers may appear in failure diagnostics.
Information From Other Sources
Almost all the information we hold comes directly from you or your device. We may also receive:
- Website Hosting Logs: Vercel makes standard website request logs available to us, including IP address and browser information.
- Website Analytics: Plausible provides aggregated website statistics that do not directly identify individual visitors.
- Email Information: EmailOctopus provides information about emails sent to the Pond waitlist, including opens, clicks, and unsubscribe requests.
We do not buy personal information or receive it from data brokers.
Pond After Installation
When Pond checks for or installs software, your device connects to our package repository, hosted on Cloudflare, and to public package sources operated by third parties, including Arch Linux’s mirror network, Flathub, and the Nix package cache. These servers receive your IP address as part of serving the download. Pond also synchronizes its clock with public time servers.
Pond’s package manager may periodically send us information about packages installed through it (including via pacman, Flatpak, or Nix), whether each installation succeeded, and, if it failed, the type of failure. This information does not include diagnostic logs or an account, device, or session identifier. We do not store the connecting IP address with these statistics.
We use this information to improve Pond’s package catalog and reliability. Locally built or custom packages are not reported. These statistics are sent only by Pond’s package manager. If that package manager is not installed, no package statistics are sent.
How We Use Your Information
We use personal information for the following purposes:
- Operating and Improving Pond: To provide, operate, maintain, secure, and improve Pond and our Services, and understand how they are used.
- Waitlist and Early Preview: To manage waitlist sign-ups, invitations, and Early Preview access.
- Installation and Compatibility: To assess hardware compatibility, measure installation performance, identify setup problems, and troubleshoot installation failures, crashes, errors, and rollback issues.
- Support and Communication: To respond to questions, feedback, bug reports, diagnostic reports, and support requests, and send Early Preview invitations and important security, service, or policy notices.
- Security and Legal Compliance: To prevent fraud, abuse, security threats, and unauthorized access, enforce our Terms of Use and policies, and meet our legal obligations.
- Marketing: To send product announcements or promotional emails where you have requested them or where otherwise permitted by law.
We may also use information for another purpose explained to you when it is collected.
You can unsubscribe from marketing emails at any time using the link in the message or by emailing hello@butterfly.so. Unsubscribing from marketing will not stop essential product, security, support, Early Preview, or policy communications.
Legal Bases for Processing
Privacy laws in some regions require us to explain our legal basis for collecting and using personal information. Depending on the information and why we use it, we may rely on:
- Contract performance: When information is necessary to provide Pond or another service you request.
- Legitimate interests: To collect installer telemetry, check compatibility, troubleshoot installation problems, improve Pond, collect anonymous package statistics, respond to support requests, and protect our systems, provided these interests do not override your privacy rights.
- Consent: Where the law requires your consent, such as for marketing emails, we rely on it. You can withdraw your consent at any time, as described in Section 2.
- Legal obligations: When we need to process information to comply with the law.
When We Share Your Information
We do not sell your personal information.
We may share personal information in the following situations:
Service Providers: We use third-party service providers to help us operate and support Pond and our Services, including providers for:
- website hosting through Vercel;
- installer telemetry, Pond downloads, and package-repository infrastructure through Cloudflare;
- website analytics through Plausible;
- waitlist and website contact-form storage through Notion; and
- waitlist and Early Preview emails through EmailOctopus.
These providers may process personal information on our behalf or as necessary to provide their services. Where appropriate, we require service providers to handle personal information in accordance with applicable privacy and security requirements.
Package Sources: When the installer downloads the base Linux image, and when Pond installs or updates software, your device connects to public package servers operated by third parties, including Arch Linux’s mirror network, Flathub, and the Nix package cache. These servers receive your IP address as part of serving the download and are not under our control.
Cloudflare and Installer Infrastructure: We currently use Cloudflare infrastructure to receive, process, and store technical information generated by the Pond installer. Cloudflare also hosts Pond’s system-image downloads and package repository. This infrastructure includes services such as Cloudflare Workers, Pipelines, and R2/Data Catalog.
When your device connects to this infrastructure, Cloudflare receives its IP address and related network information as part of providing the service. For installer telemetry, request logging is disabled, and we do not add the connecting IP address or location information derived from it to Pond’s installer analytics records.
Other technical and diagnostic information described in this policy may be processed or stored by Cloudflare.
Legal and Safety Reasons: We may disclose personal information where we reasonably believe it is necessary to:
- comply with applicable law, court orders, subpoenas, or other lawful government requests;
- investigate fraud, abuse, security incidents, or illegal activity;
- enforce our Terms of Use, policies, or other agreements;
- protect the rights, property, safety, or security of Butterfly, Pond, our users, or others; or
- establish, exercise, or defend legal claims.
Business Changes: Personal information may be disclosed or transferred as part of a merger, acquisition, financing, reorganization, sale of assets, bankruptcy, or similar business transaction involving Butterfly.
Where required by law, we will provide notice of material changes affecting how personal information will be handled.
With Your Permission: We may share personal information when you ask us to or otherwise give us permission.
Cookies and Website Analytics
Our website does not set cookies or store identifiers in your browser. We use Plausible, a cookieless analytics service, as described in Section 1. We do not sell personal information or use it for cross-context behavioral advertising. If this changes, we will update this policy and provide any notices or choices required by law.
Data Retention
We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including to:
- provide, operate, and maintain our Services;
- manage Early Preview access and participation;
- respond to support requests, feedback, and other communications;
- investigate technical, security, installation, and operational issues;
- evaluate compatibility, reliability, and performance;
- comply with legal, tax, accounting, or regulatory obligations;
- resolve disputes; and
- enforce our agreements and protect our legal rights.
How long we retain information depends on its type and sensitivity, why it was collected, applicable legal requirements, whether it is still needed for troubleshooting or security, and whether it can be deleted or anonymized.
Pond Installer Data
The Pond installer uses a randomly generated identifier for each installation attempt and may queue installer events locally if they cannot be transmitted immediately. The identifier may continue through restarts requested by the installer so that events from the same attempt can be associated. A fresh launch or a new attempt following a successful or failed installation receives a new identifier. Queued events remain in the installer’s local application data folder until they are sent or replaced by newer events and may be retried when the installer is opened again.
Installer telemetry and diagnostic records transmitted to our infrastructure may be used for compatibility analysis, troubleshooting, reliability improvements, and understanding hardware support needs. We retain these records only for as long as reasonably necessary for those purposes. Older records may be aggregated into non-identifying statistical information, after which the underlying individual event records are deleted or anonymized.
When personal information is no longer reasonably necessary for the purposes for which it was collected, we will take appropriate steps to delete or anonymize it, subject to applicable legal requirements. Some information may remain temporarily in secure backups or historical system copies until those copies are overwritten or deleted. We may also retain limited information where required by law or where reasonably necessary to protect our legal rights.
We may retain a record of an email opt-out request so that we can continue to respect your communication preferences.
How We Protect Your Information
We use reasonable security measures to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure. Technical and diagnostic information transmitted by the Pond installer is sent over HTTPS. As described above, the installer also applies automated redaction before certain diagnostic information is queued or sent.
No system is completely secure, and automated redaction may not identify every piece of personal information. You are responsible for keeping your device and passwords secure. If we become aware of a data breach involving personal information, we will investigate it and notify affected people or relevant authorities where required by law.
Where Your Information Is Processed
Butterfly Interaction, Inc. is based in the United States. Your information may be stored or processed in the United States or countries where our service providers, including Cloudflare, operate. Privacy laws in those countries may differ from the laws where you live. Where required by law, we will use appropriate safeguards for international transfers. For more information, contact us at hello@butterfly.so.
Your Privacy Rights
Depending on where you live, you have the right to access, correct, update, or delete the personal information we hold about you. You can also request a copy of your data or opt out of marketing communications at any time.
Depending on where you live, you may also have the right to object to certain processing, including processing based on our legitimate interests, and to lodge a complaint with your local data protection authority.
These rights may be subject to legal limitations or exceptions. For example, we may need to retain certain information to comply with legal obligations, protect security, resolve disputes, investigate fraud or abuse, or establish, exercise, or defend legal claims.
Installer telemetry and package statistics are not linked to your name, email address, or device, so we generally cannot identify, retrieve, or delete records for a specific person. If you send us a report that includes your attempt ID, we can look up the records for that attempt and will handle your request for them.
To exercise a privacy right, contact us at hello@butterfly.so. We may ask for basic information to verify your identity before processing your request, and we will never discriminate against you for exercising your privacy rights.
Children’s Privacy
Pond and our website are not directed to children under 13, or under a higher minimum age where applicable law sets one, and we do not knowingly collect personal information from them. If you believe a child under the applicable age has provided us with personal information, please contact us at hello@butterfly.so and we will delete it promptly.
Third-Party Services
We use third-party services to help operate Pond, our website, waitlist, emails, and community. These include Cloudflare for installer infrastructure, downloads, and the Pond package repository; Vercel for website hosting; Notion for waitlist and contact-form storage; Plausible for website analytics; EmailOctopus for waitlist and Early Preview emails; and Discord and GitHub for our community. Pond also connects to public package sources, including Arch Linux’s mirror network, Flathub, and the Nix package cache.
Some of these providers process information for us, while others operate independently under their own terms and privacy policies. Please review their policies before providing information directly to them.
More information about how we share information is provided in Section 4.
Changes to This Privacy Policy
If we change this policy, we will update this page and the “Last Updated” date.
If we make a material change to how we handle personal information, we may also provide notice through our website, email, or community channels.