Privacy Policy
rckt corp. ("we", "our", or "us") operates Codae and is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard information when you use the Codae web application at codae.app, with native Mac and iOS clients planned (collectively, the "Service").
1. Information We Collect
We collect only the minimum information necessary to provide the Service:
- Account information — your email address and subscription status, provided during sign-up.
- Usage data — anonymised, aggregated metrics such as feature usage counts. No personally identifiable information is included.
- Crash reports — opt-in diagnostic data to help us fix bugs. Crash reports do not include your credentials, workspace contents, or agent outputs.
- Payment data — billing is handled by Stripe. We never see or store your full credit card number.
2. Information We Do Not Collect
- We do not read, store, or analyse your connector or MCP API keys, tokens, or credentials on our application servers. Those secrets are encrypted and held in our server-side secrets vault (OpenBao) behind the Connectors API, and the Codae client never stores or has access to them directly. The only credentials kept on your device are a short-lived Codae session token and, if you connect one, your GitHub OAuth token, both held in platform-secure storage rather than as plain files on disk.
- We do not read, store, or analyse the contents of your agent sessions, prompts, or outputs.
- We do not sell, rent, or trade your personal information to third parties.
3. How We Use Your Information
- To provision and maintain your subscription.
- To send transactional emails (receipts, password resets, important service notices).
- To diagnose and fix crashes and performance issues.
- To comply with legal obligations.
4. Data Retention
Account information is retained for as long as your account is active. You may request deletion of your account and associated data at any time by contacting us. Anonymised aggregate metrics may be retained indefinitely.
5. Third-Party Services
We use the following third-party processors to operate the Service, each bound by their own privacy policies:
- Cloudflare — tunnel and CDN in front of our infrastructure (cloudflare.com/privacypolicy).
- Anthropic — AI model provider (anthropic.com/legal/privacy).
- OpenAI — AI model provider (openai.com/privacy).
- Cursor — coding agent provider (cursor.com/privacy).
- OpenCode — coding agent provider (opencode.ai).
- GitHub (Microsoft) — source code access and OAuth sign-in (github.com privacy statement).
- Stripe — payment processing (stripe.com/privacy).
- PostHog — product analytics. PostHog is a vendor we may use for product analytics; it is not currently integrated into the Service, and this Policy will be updated with details before any analytics data is sent to it.
Separately, if you choose to connect a third-party account — for example your own Google Drive or Notion account — through the Service's connectors, that provider acts on your instructions as a service you authorize, not as our processor. Your use of a connected account is governed by that provider's own terms and privacy policy, and you can disconnect it at any time from the Service's settings.
6. Security
We use industry-standard measures including TLS in transit and AES-256 at rest for any data we do hold. Connector and MCP credentials are encrypted at rest in our server-side vault and are transmitted only over TLS between our backend and the connected provider; the Codae client itself never stores or sees them. The session token and GitHub OAuth token kept on your device are held in platform-secure storage.
7. Children
The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13.
8. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes via email or an in-app notice. Continued use of the Service after the effective date constitutes acceptance of the updated policy.
9. Contact Us
Questions about this Privacy Policy? Email us at [email protected].