Privacy Policy

1. Entity Information

The data controller responsible for your personal data is:
Codor (European Union)

2. Data We Collect & How It Is Handled

• Account Data: Email address, GitHub profile handle, and authentication credentials provided via our extension.
• Usage Telemetry: Aggregated metrics on model tokens consumed and credit transactions. All diagnostic telemetry is sanitized and anonymized.
• Local-First Code Processing: All file reading, editing, diffing, and shell command executions run locally on your workstation inside VS Code. We never sync your full unindexed repository to our servers.
• Client-Side Secret Sanitization: Our open-source extension actively sanitizes prompts before transmission, automatically stripping API keys (OpenAI, Anthropic, Google, AWS, GitHub), JWTs, DB connection strings, and private certificates.
• Excluded Sensitive Files: Gitignore-managed files, .env files, private keys, and credential stores are natively excluded from indexing and prompt context.
• Codebase Vectors: When utilizing Semantic Search, relevant code chunks are vectorized and stored in EU-hosted vector databases bound strictly to your authenticated workspace ID.
• Zero Model Training: Your proprietary code snippets, diffs, and prompt queries are strictly used for inference and are NEVER used to train, retrain, or fine-tune public foundation models.

3. Data Security & Storage

We implement enterprise-grade security protocols. All communication between your editor and our API occurs over TLS 1.3 encrypted WebSockets. Session checkpoints are stored locally in your VS Code internal extension storage, never in cloud storage.

4. Right to Erasure & User Controls

In full accordance with GDPR Article 17, you hold the complete Right to Erasure. You can execute permanent deletion of all your usage logs, credit transactions, and workspace vectors in one click directly inside the Codor extension settings drawer ("Erase All Data") or by sending a request to [email protected].