Legal

Privacy Policy

Draft for legal review, not legal advice. Version 0.1, 6 November 2026.

Who we are

Michele Dallachiesa, Badgasteiner Str. 8, 81373 Munich, Germany, is the controller. Contact: privacy@codetraces.org.

What we collect

1. Account data: your email address, your devices (their names and when each was added and last used), the version of the terms you accepted and when, and your email preferences.
2. Traces: the session files that coding agents such as Claude Code and Codex write on your computer, uploaded by the codetraces tool. They contain your prompts and the agents' responses; tool calls and their output, commands, file paths, and code excerpts; and timestamps, model names, token counts, and costs. Secrets that the tool recognizes are replaced on your computer before upload; recognition is pattern-based and not perfect. Projects you exclude are never uploaded.
3. Reports that we generate from your traces.
4. Feedback you send us, with the diagnostics you choose to attach. Diagnostics hold versions and sync status, never trace content.
5. Connection data: Cloudflare processes your IP address and request details to deliver the service and to limit abuse. The service does not store request logs.
6. Cookies and local storage: one session cookie while you are signed in, for up to 14 days, and your theme choice, which stays in your browser and is never sent to us. We set no tracking or analytics cookies.

How we use it

• To provide the service (lawful basis: contract): store your traces, generate and email weekly reports, sign you in, protect the service from abuse, and answer your feedback.
• For aggregate analytics and recommendations (lawful basis: contract, as the consideration for the free service; <confirm with counsel>): we analyze traces across users to produce statistics, benchmarks, and recommendations that we share with users and may publish. These outputs contain no content from any individual user's traces and identify no one.
• For commercial use of de-identified data (lawful basis: <consent given when you join / contract; confirm with counsel>): we may create datasets and derived products from traces, and use, license, or sell them to third parties, including to train, fine-tune, or evaluate AI models. Before any dataset leaves us, it goes through a further de-identification process: account identifiers, emails, names, usernames, home directories, hostnames, IP addresses, URLs that carry credentials, and organization names are removed or replaced, and recipients must contractually agree not to re-identify anyone. We do not sell your account data, and we do not sell data that identifies you.
• Emails: service emails only (reports, quiet-week notes, sign-in links, and security notices), never marketing.

Where your data is stored and processed

We store your data in the European Union:

• Traces, the copies of them we keep for analysis, reports, and account data are stored in Cloudflare's EU jurisdiction.
• Weekly reports are built in Cloudflare's EU jurisdiction: the jobs that build them, and the workflows that schedule them, run and keep their working data there.

Some processing takes place outside the EU:

• Report findings: to write the findings of each report, we send your weekly metrics and excerpts of your traces to Anthropic's API. In these excerpts, home directories, login names, client project names, and IP addresses are replaced with placeholders. Anthropic does not offer EU-only processing for this API, so this data may be processed in the United States or elsewhere.
• Cloudflare's global network: web pages, sign-in, the requests of the codetraces tool, and the step that copies each upload for analysis run on Cloudflare's global network, usually at a location near you or near our storage. Uploads travel to EU storage over this network.
• Upload notifications: each upload creates a short notification with the file's name, size, and checksum. File names include your project directory names. These notifications pass through a Cloudflare queue that is not restricted to the EU, and are deleted once processed, after 14 days at most.
• Email: we send service emails through Cloudflare, and your email provider stores them once delivered. Feedback and replies reach our inbox at Google (Gmail), which may process them outside the EU.

International transfers: for the processing outside the EU listed above, we rely on the Standard Contractual Clauses in the data processing terms of Cloudflare and Anthropic, and on the EU–US Data Privacy Framework where the provider is certified. <Gmail: Google offers data processing terms only for Google Workspace; confirm the basis for our inbox.>

How we protect it

• Pseudonymization: storage knows you only by a random id; your email address lives only in the account database.
• Encryption: TLS in transit and encryption at rest. Reports are sealed with a separate key for each week.
• Access control: storage credentials are limited to each user's own traces, report jobs see one user at a time, and only we can access the data.

Processors

• Cloudflare, Inc.: hosting, storage, database, queues, email, and DNS.
• Anthropic, PBC: the AI model that writes the findings of each report. By default, Anthropic does not use API inputs and outputs to train its models, and deletes them within 30 days unless it must keep them longer to enforce its Usage Policy or to comply with the law; content its safety systems flag may be kept for up to 2 years. See Anthropic's pages on retention and model training.

Retention

• Account data, traces, the copies kept for analysis, and reports are kept until you delete your account, and are deleted when you do.
• Upload notifications are deleted once processed, after 14 days at most.
• Aggregate statistics, and de-identified datasets created before deletion, contain no personal data and may be kept.

Your rights

• Access, rectification, deletion (codetraces cloud leave, or Delete account in the archive), restriction, and objection.
• Portability: your reports are in the archive, and your traces stay on your computer.
• You can withdraw consent to future commercial use by deleting your account. <Counsel: decide whether to offer an opt-out that keeps the service.>
• You may complain to a supervisory authority.

Children

The service is not for anyone under 18.

Changes

We email you at least 30 days before a material change.