Privacy Policy

At a glance

What	codeme
Accounts · sign-in	no
Usage statistics · telemetry · analytics	no
Automatic crash reports	no
Automatic update checks	Yes — it asks with a version number, and whether to take the answer is your call
Uploading code or files to a server	no
Advertising · tracking cookies	no
Sharing personal data with third parties	no
Calls to repositories, issue trackers and databases you connected	yes — only when you turn it on
Times a token passes through our server	Only when you sign in to Bitbucket or Jira with a browser — encrypted, ten minutes at the outside, deleted the moment it is collected
Ratings and comments on the site	Yes — only what you typed in yourself
Download counts on the site	Yes — an anonymous count keyed on a hashed address

What is not collected

The codeme desktop app collects and transmits no personal data — no name, email, device identifier, IP address or usage pattern. There is no analytics SDK inside it, no crash reporter, and no "send anonymous usage statistics" option. That option is missing not because it defaults to off, but because there is nowhere for it to send anything.

What stays on your machine

For the app to work it has to remember state, and all of that state lives only on your disk.

The settings file — theme, language, sidebar layout, key scheme, and the addresses of the repositories and issue trackers you registered
The paths of the projects and worktrees you have open, and the recent list
Session state such as tabs, layout and window size
Saved database connections — host, port and user, plus where the password comes from (the name of an environment variable, a key in a dotenv file, a container)
The agent sessions' local records (whatever the agent CLI leaves on that machine)

Delete these files and that is the end of them. There is no copy anywhere.

Tokens and passwords

To use the My work panel you need a token for GitHub, Forgejo, Bitbucket or Jira once: make one yourself and paste it in, or sign in with a browser and the forge issues one. Either way, that token is handled like this.

It is kept in the OS credential store — the keychain, on macOS.
Signing in to several forges still makes one item, which is why the Keychain asks about access once rather than once per forge.
The settings file keeps only the address. The token value is never written to it.
No IPC command hands a token back to the window. It stays on the shell side, and the only way out is a request header.
The token is spent only against the repository or issue-tracker API you pointed at.
Disconnect in the panel and it is deleted from the credential store — along with the refresh token, where a browser sign-in left one.

Signing in to Bitbucket or Jira with a browser is the one time a token passes through codeme.team. Both of them require a client secret before they will issue a token, and a secret shipped inside a desktop app is not a secret — so the site makes the exchange instead. While it passes through: it is encrypted (the key is not in the database), it lives ten minutes at the outside, only the app that started the sign-in can collect it and only once, and it is deleted as it is collected. Nothing is written down beside it about whose account it is or which site it reaches. Refreshing an expired token takes the same route, and stores nothing at all. Choose to paste a token instead and this route is not used, and GitHub and Forgejo sign in through a browser without passing through us either.

Database passwords are never held at all. Connecting is handed to the client already installed on this machine. What is saved is where the password comes from — an environment variable, a dotenv key, a container's environment, or "typed for this run only" — and never the value itself.

What leaves this machine

These are the only times the app uses the network, and every one of them but the update check is something you switched on.

The repository and issue-tracker APIs you registered — to read tickets and pull requests. If you enter no token, the call is never made at all.
Signing in to Bitbucket or Jira, and refreshing those tokens — through codeme.team, and only if you chose the browser sign-in. What passes through and for how long is under “Tokens and passwords” above.
Reading AI usage — your agent's plan limit is not written down on this machine, so the app asks somewhere that knows it. If that fails it falls back to a local estimate, and says so.
git remote operations — fetch, pull and push go out when you ask for them, to whatever remote your git configuration points at.
A database you opened — the installed client makes the connection, and it goes to the address you wrote.

The container panel talks to Docker on this machine over a local socket and goes nowhere else. Beyond that, there is no network call on the app's critical path: with the internet gone, editing, the terminal, worktrees and commits all still work.

It does check for updates. Every 30 minutes while running, the app asks codeme.team whether there is a newer version. What goes with the question is the version you are on and which OS and CPU this is — nothing that points at you. Downloading and restarting both wait for you to press the button in the banner.

AI agents

This is the most important item here. The AI agent CLIs codeme runs are third-party software. The prompts you give an agent, and the code that agent reads, may be transmitted to that provider's servers. That transmission and its handling are decided entirely by that provider's policy; codeme neither takes part in that flow nor can see or stop it.

What the usage meter reads is the record that CLI left on this machine. It opens those session files to count tokens, and sends their contents nowhere.

When you work on sensitive code, read the privacy policy and data-retention policy of the agent provider you use for yourself. That codeme is "local-first" does not make that agent local.

This website

This site has no analytics script and no advertising or tracking cookies.
Nothing is stored in your browser. No cookie and no localStorage value — the site has no setting for you to choose, so there is nothing to remember.
It loads no external fonts and no external scripts, and the page's own content security policy enforces that.
The server this site is hosted on (a static hosting provider) may keep ordinary access logs. We do not analyse those logs or combine them with anything else.

Ratings, comments and download counts

The feedback page has a place to leave a rating and a comment, and there is a counter for how many people have taken the installer. Both are things several people share, so they are stored on a server — the only part of this document where a server is involved at all. The app takes no part in it.

What is stored

What you typed — a name, the text, a rating. There is no login, so no account, no email address and no real name is asked for. The name is one you make up on the spot.
A hash of the address you connected from — used only to stop flooding and to know whether you have already rated something. What is stored is 32 characters of a hash taken with a secret mixed in, and the IP address itself is not stored. That secret is not in the published source code.
Download counts — a total of which installer was taken on which day. The same hash and nothing else is used here, and the same person taking it several times in a day counts once.

How long it is kept

Address hashes, ninety days — the hash attached to a comment is removed after ninety days, and so are the per-day rows behind the download count. That deletion runs automatically, once a day.
The hash on a rating, as long as the rating — that hash is the judgement that a second visit by the same person is a change of mind rather than a second vote, so the only way to remove it is to remove the rating.
A published comment, until it is deleted — tell us which one through contact and it goes.

What is not done

What you leave is not used for advertising or profiling, and is not handed to anyone else.
No attempt is made to combine a hash with anything else in order to identify a person.
Nothing is still stored in your browser — leaving a rating creates no cookie and no localStorage value.

The name and the text you leave are public to anyone reading this site, and may be picked up by search engines. Please do not write anything you would mind being public.

Your rights

Under the Personal Information Protection Act you have the right to access, correct and delete your personal data, and to have its processing suspended. As regards the app we hold nothing of yours, so in practice there is nothing to make that request against — the settings and tokens left on your machine you can delete yourself, and the guide says how. A rating or comment left on the site is different: we do hold that, so tell us through contact and it goes.

Rights over information held by a repository, an issue tracker or an agent provider have to be exercised against that provider.

Children's personal data

This Service is aimed at developers and is not directed at children under 14. Since no personal data is collected, none is collected from children either.

Revisions

When this policy is revised, the revision date on this window is updated. A change that collects more than before is announced in the release notes as well.

Contact

For questions about the handling of personal data, tell the distributor through wherever you got the build. Anything you would rather not make public, such as a security vulnerability, can go the same route separately.