Privacy Policy

What we collect, what we never collect, and who else sees it.

Effective 18 November 2026

The short version

We store your email, your organisation, and a record of what you paid for. We count how many requests you make and which model served them, and the editor tells us which of its features you use and how its runs turn out, as fixed labels and counts.

We do not store your code, your prompts, or the model's replies. Not in a log, not in a database, not for training. That is enforced at the gateway rather than promised by the app, because software that promises its own privacy is promising nothing. The one exception is a run you choose to send us with "Send this run to the AstraCode team", which we keep for 30 days and never use for training.

What we collect when you have an account

Your email address, and your name if you give one.

Your organisation's name, its plan, and the history of plan changes: what changed, when, and who did it.

If you sign in with GitHub or Google, the provider's account id and the email it gives us. We never receive your password for those.

If you sign in by emailed code, a HASH of that code and when it was used. The code itself exists only in the email we sent.

Metadata about API keys you create: a label, the first few characters, when it was created and last used. The key itself is stored only as a hash and cannot be recovered by us or by anyone who reaches our database.

When you are signed in on astracode.io: which step of setting up your account you reached and whether you answered or skipped it, when you open your dashboard, when you approve signing the editor in, when your address is confirmed, and when you start or cancel a payment. Each is a label from a fixed list and the time.

If you answer one of our questions about why you stopped using AstraCode, on the page that opens when you uninstall it, by replying to an email, or in a conversation with us, what you told us, kept with your account.

If you refer people, or were referred

When somebody follows a referral link we record which link, the page that linked to it with its query string removed, an optional campaign label the link's owner chose, and a keyed hash of the visitor's IP address. The hash cannot be turned back into the address; it is kept so we can see many clicks coming from one place, which is how fake clicks look.

If you create an account after following one, we record who referred you. The person who referred you sees a masked version of your email address (the first letter and the domain), the date you joined, your plan, and whether you pay. They never see your name, your full address or anything you do in the editor.

Stripe gives us a fingerprint of the card that paid each invoice: a code that is the same for the same card and says nothing else about it. We use it only to notice an affiliate paying for accounts they claim to have referred.

Affiliates have an account of their own, separate from any customer account: an email address, a name if given, and sign-in codes stored only as hashes. If the same address also has a customer account, we note that the two belong to one person, only to stop anyone earning commission on themselves.

Affiliates: the country you are paid in, the email for Stripe's payout invitation or your eSewa or bank details if you are paid in Nepal, and the tax form you upload. The form is stored outside the website and only our staff can open it.

What we collect when you use the editor

For each request the editor, the command-line tool or an API key sends us: which account made it, which part of AstraCode it came from (chat, agent, completion, search), which model served it, how many tokens it used, what it cost us, whether it succeeded, and if not, why (for example a usage limit, or the model provider failing). We also record which program sent it, its version and your operating system, and the IP address it came from. We use the address only to spot a key being used from somewhere it should not be, and delete it after 90 days.

When an agent run ends, the editor tells us how it ended (finished, stopped by you, stopped at a limit, or failed), and if it failed, which kind of failure it was, from a fixed list. It also tells us how many steps it took, the names of the tools it used and how often each one failed, how many files it changed, whether your project's own check passed, how long it took, and what it cost. When you use inline suggestions, the editor tells us how many it showed you and how many you accepted.

When the editor shows you an error, it tells us which kind of error it was (for example a usage limit or a connection problem), never its text. When the editor updates itself, it tells us whether the update succeeded, which versions it went from and to, your operating system, and at which step it failed if it did.

The editor also tells us which of its features you use: which AstraCode command you run, which button or action you use in the AstraCode panel (for example sending a message and in which mode, stopping a run, or accepting or undoing a change), and which AstraCode setting you change, never what you set it to. It tells us when the editor starts and closes, when you sign in and out, whether it started with a folder open, and when it showed you a usage limit. Each report is a name from a fixed list and the time it happened.

Before you sign in, the editor sends the same reports under a random number made when it was installed, so we can see where people get stuck before they have an account. When you sign in, those reports are joined to your account.

When an agent run finishes, the editor also tells us whether you kept its changes or undid them, whether you then edited any of the files it changed yourself (never which), whether you asked again straight away, and its own check of the result as pass or fail with the kinds of problem it found, from a fixed list. If you rate a run with the thumbs up or down, it tells us your rating and the reason you picked from the list.

These are counts and fixed labels. None of them contains your code, your prompts, file names, paths, command lines, or the text of an error. You can turn all of these reports off with the setting "AstraCode: Agent: Report Outcomes", and the editor then sends none of them, including any it was holding.

If you press "Send this run to the AstraCode team", the editor first shows you exactly what it will send, and sends it only when you confirm: that one run's messages, the agent's replies and the changes it made, with anything that looks like a password or key removed. We keep it for 30 days so we can see what went wrong, only the founders can read it, you can delete it from your dashboard sooner, and it is never used to train a model.

When you connect AstraCode to another app

If you connect AstraCode to an app such as ChatGPT, we record that connection: which app, what you allowed it to do, when you connected it and when it was last used. You can see and disconnect it on the Integrations page of your dashboard, and disconnecting stops it at once.

When you start an agent run from that app, we record which repository it ran in and when; we do not store the task you gave it. The run's progress (its steps, the names of the tools it used, its report and the pull request it opened) is kept for seven days so you can follow it, as for runs started from the editor. The app itself sees what it sent us and what we answered, under its own terms.

Marketing and lifecycle email

Some of the email we send is about getting started with AstraCode, your plan, or coming back to it, and each of those has an unsubscribe link at the bottom. Those emails contain a tracking image and tracked links. Sign-in codes, password resets, receipts and other account and billing notices do not.

When the image in one of those emails loads, we record that it was opened, when, and how many times. When you follow a link in one, we record which link and when. With each of these we keep the first 200 characters of the user agent your mail program or browser sends, so we can tell an automated fetch, such as a privacy proxy or a security scanner, from a person reading. We do not record your IP address.

We use this to see which emails are useful, and whether somebody who followed a link created an account or moved to a paid plan within the following seven days.

If any email we send you cannot be delivered, we record the error the receiving server reported. If it says the address does not exist, we stop sending these emails to it, and keep that record so the address stays excluded.

The record of each individual open and click is deleted after 90 days. A summary is kept with our record of having sent the email: when it was first opened and first clicked, how many times each, the first link followed, and whether it bounced or led to an unsubscribe.

To stop it, use the unsubscribe link in any of these emails. You will get no more of them, so nothing more is recorded. Turning off images in your mail program also stops the open record.

What we deliberately do not collect

The contents of your files, your repository, or your workspace, except in a run you choose to send us (above).

Your prompts or the model's responses, with the same exception.

Anything an MCP server returns to the agent on your machine.

Your provider API key, when you bring your own. It is used for that one request and never stored.

Who else sees your data

Model providers. To answer a request, its content is sent to the provider serving that model. We instruct providers not to train on it. Their handling is governed by their own terms.

Stripe, for payments. Stripe holds your card details; we never see or store a card number. We hold Stripe's customer and subscription identifiers so we know what you are on.

Google Analytics, on the astracode.io website only. It sets cookies and records page views and approximate location. The editor does not use Google Analytics or any other analytics service: what it reports comes only to us, as described above.

Our email provider, to send sign-in codes, receipts and service notices.

GitHub, if your organisation connects it. The access token is encrypted before it is stored and never sent to any client.

Cookies

A session cookie, so you stay signed in. A CSRF cookie, so a form on another site cannot act as you. Both are strictly necessary and cannot be turned off without breaking sign-in.

A download cookie, set only when you start a download. It holds a random number and nothing about you. Its only purpose is to connect a download to an account if you create one afterwards on the same browser, so we can tell how many people who downloaded AstraCode went on to use it. It expires after 30 days, and if you never create an account it never refers to anyone.

A referral cookie, set only when you follow somebody's referral link. It holds the number of that click, signed so it cannot be altered, and nothing about you. It lets us credit the person who shared the link if you create an account within 60 days, and expires then.

Google Analytics cookies on the website. These are not necessary, and blocking them costs you nothing.

How long we keep it

Account data, for as long as the account exists.

Sign-in codes expire in minutes and are deleted after use.

A connection to another app, until you disconnect it; one left unused for 30 days stops working and has to be connected again. The record of a run started from another app, for as long as the account exists; its progress, for seven days.

Usage records, run outcomes, error and update reports and suggestion counts, for as long as the account exists, so we can bill and show you your history. The IP address on a request, 90 days. When an account is deleted, its usage records are kept without the email address, to account for what was spent.

The editor's feature reports and the follow-up on each run, 13 months, whether or not you signed in. A run you chose to send us, 30 days.

The record of each open and click in a marketing or lifecycle email, 90 days. The summary of each such email, and the record of any email to you that bounced, for as long as we keep the record that we emailed you.

Records of what you paid, for as long as tax and accounting law requires, which outlives the account itself.

Your rights

Ask us for a copy of what we hold about you. Ask us to correct it. Ask us to delete your account and the personal data in it.

Deletion does not remove records we must keep for tax purposes, and it does not reach data already sent to a model provider under their own retention.

Write to privacy@astracode.io and we will respond within 30 days.

Security

Passwords are hashed. Sign-in codes are hashed. API keys are hashed. Third-party integration tokens are encrypted at rest with a key that is not stored in the database.

Everything is served over HTTPS. Access to production data is limited to people who need it.

No system is perfectly secure, and we will not pretend otherwise. If a breach affects you, we will tell you.

Children

AstraCode is not for anyone under 16, and we do not knowingly collect data from them.

Changes

If we change what we collect or who sees it, the effective date above changes and we email account owners before it applies.

Getting in touch

Privacy questions go to privacy@astracode.io.