Privacy Policy
Last updated: 24 October 2026
The short version: your code, prompts, API keys and agent conversations never reach our servers in readable form. They stay on your own machines and travel end-to-end encrypted. We keep only what’s needed to sign you in and connect your devices, plus what you tell us when you reserve a server.
What we store
| Data | Why | How long |
|---|---|---|
| Your GitHub user ID and username | To sign you in and keep your machines and reservation under your account | Until you delete your account |
| Linked machines: the name you gave each one, when it was linked and last seen, whether it’s a PC or a cloud runner, and a cloud runner’s latest setup report (its stage and the last lines of its setup log) | To show your machine list and route connections to the right machine | Until you remove the machine or delete your account |
| snugcode Cloud reservation: plan, server size, region, billing preference, your note, optional email address, dates and status | To plan capacity and contact you before servers are ready | Until you cancel it or delete your account |
| Request logs (IP address, time, URL path, browser user agent) | Security, rate limiting and fixing errors | A few days (our host’s log retention) |
Sign-in uses GitHub with no extra permissions: we read your public profile once and don’t keep your GitHub access token. If you create a cloud runner, the Codespaces permission you grant goes straight to your browser and never into our storage.
What we can’t see
- Agent conversations, code, diffs, terminal output, files and your pairing PIN. Your phone and your machine agree on keys with a PIN-based key exchange (CPace) and encrypt everything end to end (XChaCha20-Poly1305). The relay forwards ciphertext it can’t read and doesn’t store it.
- Your AI provider keys and GitHub token for coding. They’re stored on your machine, sent from your phone to your machine only through the encrypted channel, and never sent back.
- Your prompts to AI models. They go directly from your machine to the provider you chose, under that provider’s privacy policy.
The technical details, including the limits of this model, are in our security documentation.
Cookies and tracking
We don’t use advertising or analytics trackers, and we don’t set tracking cookies. The website and app keep your sign-in, theme and, for the app, device keys in your browser’s local storage. Signing out removes the sign-in.
Who processes data for us
- Cloudflare hosts the website and relay (Workers and Durable Objects) on its global network.
- GitHub provides sign-in, and hosts cloud runners in your own Codespaces.
- If you leave an email address, reservation notifications may be relayed to our team’s chat tool.
We don’t sell personal data or share it for advertising.
Your choices and rights
- See your data: your account page shows your reservation and linked machines.
- Change or remove it: edit or cancel your reservation, remove machines, or remove your email there.
- Delete everything: “Delete account” on the account page removes your reservation and machines and signs out every device.
- Depending on where you live (for example under the GDPR or Indonesia’s Personal Data Protection Law), you may have further rights such as access, correction, objection and complaint to a regulator. Contact us to use them.
Security
Sign-in tokens are signed, expire after 30 days of non-use, and can be revoked from every device at once. Pages are served with a strict Content Security Policy. If you find a vulnerability, please report it privately as described in the security documentation.
Children
The Service isn’t meant for children below GitHub’s minimum age, and we don’t knowingly collect their data.
Changes and contact
We’ll update this page and the date above when this policy changes. Questions or requests: hello@snugcode.dev.