Privacy
What Codegenix collects, how telemetry is scrubbed, and the choices you have.
Draft — this notice describes current practice in good faith and must be reviewed by legal counsel before general availability.
What we collect
Account data (email, workspace membership), the projects and prompts you create, and operational telemetry. We do not sell personal data.
Error tracking
When error tracking is enabled, events are sent to Sentry with sendDefaultPii disabled and NO session replay. A beforeSend scrubber strips request headers, cookies, query strings, bodies, and exception text through a shared secret/PII deny-list before any event leaves the process.
Product analytics
When analytics is enabled, PostHog runs with person profiles set to identified-only, autocapture and session recording disabled, and pageview capture off. We honor the browser Do-Not-Track / Global Privacy Control signal. The identify call carries only an opaque user UUID — never an email.
Tracing
OpenTelemetry spans, when an exporter is configured, carry only sizes, counts, durations, and exit codes — never prompts, file contents, or provider keys.
Third-party processors
Depending on the features in use: Supabase (database, auth), Upstash (rate limiting), the AI providers you route to, your chosen deploy provider, and — only when configured — Sentry, PostHog, and Resend. Provider API keys you supply are encrypted at rest.
Your choices
You can export or delete your projects at any time. To request account deletion or a data export, email privacy@codegenix.dev.