Privacy Policy
We collect only what we need to run Codex, we never sell your data or use it for advertising, there are no tracking or analytics cookies, and you can export or permanently delete everything yourself from Settings at any time. Research data you upload belongs to you: we process it only to provide the service.
1. Who is responsible for your data
The controller responsible for personal data processed through Codex (the "Service") is:
[FULL LEGAL NAME]NIF: [NIF]
[STREET, POSTCODE CITY, SPAIN]
Email: [privacy@your-domain]
We have not appointed a Data Protection Officer because the law does not require one for this Service. For any privacy question or request, write to [privacy@your-domain].
2. Two different roles: your account vs. your research data
- Account, billing and usage data. For data about you as a user of the Service, such as your email address, plan and settings, we are the controller. This policy explains how we handle it.
- Research content. Transcripts, documents, audio, images, survey responses, codes and memos that you upload or create may contain personal data about research participants and other people. For that content you, or your institution, are the controller and we act only as your processor, under our Data Processing Agreement. If you are a research participant, please contact the researcher who collected your data. We will help them answer your request.
3. What we collect, why, and on what legal basis
| Data | Purpose | Legal basis (GDPR art. 6(1)) |
|---|---|---|
| Email address, password (stored only as a salted hash), account creation date | Create and secure your account, sign you in, send password-reset and verification emails | (b) performance of our contract with you |
| Preferences: theme, onboarding status, notification choices | Remember how you want the Service to work | (b) contract |
| Record of the Terms and Privacy Policy versions you accepted, and of your marketing choice, with timestamps | Demonstrate what you agreed to and when | (c) legal obligation (GDPR art. 7(1)) and (f) legitimate interest in being able to prove it |
| Research content you upload or create | Store, display, search, analyse and share it as you instruct | Processed on your behalf as your processor (GDPR art. 28) |
| Collaboration: email address and permission level of people you invite, or of the person who invited you | Give collaborators access to shared projects | (b) contract and (f) legitimate interest in enabling team work |
| Plan, subscription status, Stripe customer ID and invoices. Card details go directly to Stripe and we never see them. | Charge for paid plans, issue invoices, prevent fraud | (b) contract and (c) legal obligation (tax and accounting law) |
| Content you send to an AI feature, plus an AI activity log per project (who ran it, model, time, the first 200 characters of the request and of the result, and references to the sources used) | Provide AI-assisted analysis, and keep an auditable provenance record for research integrity | (b) contract |
| Daily AI usage counter linked to your account ID | Enforce fair-use limits and control costs | (f) legitimate interest |
| IP address, held briefly for rate limiting on sign-in, sign-up, password reset and public links | Protect accounts against brute-force attacks and abuse | (f) legitimate interest in security |
| Technical error reports: page or API route, browser type, error message and stack trace. Email addresses are not included. | Find and fix bugs, keep the Service secure | (f) legitimate interest |
| Feedback you choose to send: message, category, page, browser and window size, and an optional screenshot and attachments you add yourself | Answer your feedback and improve the Service | (f) legitimate interest |
| Product news emails | Tell you about new features | (a) consent, which you can withdraw at any time in Settings → Notifications |
We do not use your data for advertising, we do not sell or rent it, and we do not build profiles of you. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects (GDPR art. 22). AI output in the Service is a suggestion for you to review, never a decision about you.
People who open a public share link
If a project owner shares a read-only public link, we record each attempt to open it so the owner can see whether the link is being used or misused. We store the time, the outcome (opened, password required, wrong password), your browser's user-agent string and a pseudonymised fingerprint of your IP address. The fingerprint is a keyed hash that cannot be turned back into your address. It is used only to recognise repeat visits to the same project. These records are deleted automatically after 90 days, or earlier if the project is deleted. Legal basis: (f) legitimate interest in protecting shared research data.
Importing from the web
When you import a web page, Reddit thread or YouTube transcript, our server fetches it. The website sees our server, not you. What we import becomes part of your research content.
4. AI features
AI features run only when you use them. The text, images or audio involved are sent through our own AI gateway to the model provider selected for that feature (OpenAI or Anthropic). We do not send your name, email address or account ID with these requests. Both providers process API data as our processors, do not use it to train their models, and may keep it for up to 30 days only to detect abuse, unless the law requires otherwise. If search embeddings are enabled, the project text being indexed is sent to the provider in the same way. Do not send AI features content you are not permitted to share with these providers.
5. Cookies and storage on your device
We use no analytics, advertising or tracking cookies and no third-party trackers. We therefore do not show a cookie banner: everything below is strictly necessary or stores a choice you made (Spanish LSSI-CE art. 22.2; ePrivacy Directive art. 5(3)).
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
parse_session | Cookie (HTTP-only) | Keeps you signed in | 30 days or until you sign out |
codex_onboarding_skipped | Cookie | Remembers that you skipped the introduction | 1 year |
| Session and account copy | Local storage | Keeps you signed in across reloads and offline | Until you sign out |
| Offline project cache, pending changes and uploads | IndexedDB, Origin Private File System | Lets you keep working offline and sync later | Until you sign out or delete your account |
| Display preferences (theme, zoom, tours seen) | Local storage | Remembers interface choices | Until you clear your browser data |
| Application code cache | Service worker cache | Loads the app faster. It never contains your data. | Until the next release |
Fonts, icons and document readers are served from our own servers. One exception: when you use OCR on an image or a scanned PDF, your browser downloads the OCR engine and its language data from the jsDelivr CDN, which then sees your IP address. Paid plans are checked out on Stripe's own pages, which are covered by Stripe's privacy policy.
6. Who we share data with
We share personal data only with the service providers below, who process it on our instructions under data processing agreements. We also share it when the law requires us to (for example, a court order), and with people you choose to share a project with.
| Provider | Purpose | Location | Safeguard |
|---|---|---|---|
| [EU HOSTING PROVIDER, e.g. Hetzner Online GmbH] | Hosting of the application, database, file storage, search index, cache, AI gateway and error monitoring | European Union | Data stays in the EU |
| OpenAI, L.L.C. / OpenAI Ireland Ltd | AI features: text analysis, transcription and embeddings for content you submit to an AI feature | United States | EU-U.S. Data Privacy Framework and Standard Contractual Clauses; API data is not used for model training |
| Anthropic PBC / Anthropic Ireland Ltd | AI features: text analysis for content you submit to an AI feature | United States | EU-U.S. Data Privacy Framework and Standard Contractual Clauses; API data is not used for model training |
| Stripe Payments Europe, Ltd. | Payment processing and invoicing for paid plans | Ireland (with transfers to Stripe, Inc., United States) | EU-U.S. Data Privacy Framework and Standard Contractual Clauses |
| Mailgun Technologies, Inc. (EU region) | Transactional email: email verification and password resets | European Union (EU region), with access from the United States | EU-U.S. Data Privacy Framework and Standard Contractual Clauses |
7. International transfers
Our own servers, database, file storage, search index and error monitoring are located in the European Union. Some of the providers above are based in, or may access data from, the United States. These transfers rely on the EU–U.S. Data Privacy Framework adequacy decision for certified providers, and on the European Commission's Standard Contractual Clauses (GDPR art. 46) as a fallback. You can ask us for a copy of the safeguards.
8. How long we keep data
- Account and research content: until you delete it or delete your account. Deletion is immediate in the live system.
- Backups: deleted data disappears from rolling backups within 30 days.
- Public share access records: 90 days.
- Feedback: 24 months, or until you delete your account.
- Server logs and error reports: up to 30 days.
- Rate-limiting data (IP addresses): between 1 and 15 minutes. Daily AI counters: about 26 hours.
- Invoices and payment records: as long as Spanish tax and commercial law requires, generally up to 6 years. These records stay with Stripe and in our accounting even after you delete your account.
- Consent records: for the life of your account. After that, only as long as we need them to defend a legal claim.
9. Your rights
Under the GDPR and the Spanish LOPDGDD you have the right to:
- Access your data and take it with you (portability). Use Settings → Account → Export my data to download everything in JSON.
- Erase your data. Use Settings → Danger zone → Delete account. This removes your profile, projects, files, snapshots, search index entries, feedback, AI logs and memberships in other people's projects, cancels your subscription and deletes your Stripe customer record.
- Rectify inaccurate data, for example to change your email address. Email us.
- Restrict or object to processing based on legitimate interests.
- Withdraw consent to product emails at any time in Settings → Notifications. Withdrawal does not affect earlier processing.
- Lodge a complaint with a supervisory authority. In Spain that is the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, Spain, https://www.aepd.es. You can also complain to the authority where you live or work.
To use any right that has no self-service option, email [privacy@your-domain] from your account's address. We answer within one month. We may extend this by two more months for complex requests, and we will tell you if we do.
10. Security
We protect data with encrypted connections (HTTPS), passwords stored only as salted hashes, per-project access control, private file storage that checks your permission on every request, rate limiting, minimal-privilege internal services and regular backups. If a personal data breach is likely to put you at risk, we will notify the AEPD within 72 hours and tell you without undue delay.
11. Children
The Service is not intended for anyone under 16, and we do not knowingly collect their data. If you believe a child has created an account, please contact us and we will delete it.
12. Changes to this policy
If we change this policy materially, we will update the version date above and ask you to review the new version the next time you sign in. Where the change requires your consent, we will ask for it.