Privacy Policy

1. Summary

We collect as little as we can, we never sell your data, we don't use your code to train AI, and you can download or delete your data at any time. This policy explains what we collect and why. Contact: privacy@codestilt.com, CodeStilt, near Ghanta Ghar, Multan, Punjab, Pakistan, +92 333 6338703.

2. What we collect

Account: your name, email address, and profile picture if you sign in with Google or GitHub.
Linked computers: the computer name you choose, operating system, app version and when it was last online. We do not scan your computer.
Tasks: the task text, the plan, which files were changed, and the size of changes, so you can see history and undo.
File content for a task: the parts of files a task needs are sent through our servers to the AI model and are not stored after the task, except short-term copies kept for up to 7 days to let you undo and review, which you can delete sooner.
Billing: plan, payments and invoices. Card numbers are handled by our payment provider; we never see them.
Usage and diagnostics: credits used, errors and performance data, so we can fix problems. No advertising trackers.
Messages you send us: support and sales forms and emails.

3. What we never collect

Secret files (such as .env files, private keys and credential files) are skipped on your computer before anything is sent. Text that looks like a password or API key is removed. We don't record your screen or keystrokes.

4. Why we use it

To provide the Service: plans, tasks, undo, history and syncing between your devices.
To bill you and prevent fraud.
To keep the Service secure and fix problems.
To send important account emails. Marketing emails are only sent if you agree, and one switch turns them all off.

5. AI providers

We send task content to AI model providers (such as Anthropic, OpenAI and Google) only to perform your task. We use their business terms, under which they may not train their models on your content. If you bring your own API key, your content goes to that provider under your agreement with them.

Only service providers that help us run CodeStilt (hosting, email delivery, payments, AI models), each under contract to protect it. We share data if the law requires it, and we will tell you unless we are legally not allowed to. We never sell your data.

7. How long we keep it

Account and task history: while your account is open.
Short-term file copies for undo and review: up to 7 days.
Billing records: as long as tax law requires.
Security logs: up to 12 months.

When you delete your account, we delete your data within 30 days, apart from records we must keep by law.

8. Your choices and rights

In Settings you can download your data, delete tasks, remove computers, turn off marketing email and delete your account. You can also email privacy@codestilt.com to ask what we hold, to correct it, or to object to how we use it. We reply within 30 days.

9. Security

See our Security page for how we protect data, including encryption in transit and at rest, and access controls for our staff.

10. Where data is processed

Our servers and providers may be in other countries than yours. We use providers with strong security and contractual protections for international transfers.

11. Children

CodeStilt is not for children under 18, and we do not knowingly collect their data.

12. Cookies

We use only the cookies needed to keep you signed in and secure. We do not use advertising or tracking cookies.

13. Changes

We will email you before important changes to this policy take effect.