Privacy policy

1. Who we are

Codlyra provides an online AI development workspace at codlyra.com. Our company name is Codlyra, LLC. Current formation details appear in the company notice on this page. For privacy questions or to exercise your rights, use the Contact page and select “Privacy or data request.”

2. Information we collect

We collect information you provide and information necessary to operate and protect the service.

• Account information: your name, email address, password hash, account settings, and subscription status. Passwords are never stored in plain text.
• Project information: prompts, conversations, source code, file versions, model choices, shared-preview settings, and agent activity.
• Provider credentials: API keys that you choose to save. These are encrypted at rest and used only to make your requested provider calls.
• Billing information: payment provider references, transaction amounts, credit ledger entries, invoice references, and subscription dates. Card details are entered on Stripe-hosted pages and are not collected or stored by Codlyra.
• Support information: messages, contact details, and replies submitted through the contact form or Help page.
• Technical information: security and access logs such as IP addresses, request paths, timestamps, and error status codes. We do not run advertising pixels or behavioral analytics.

3. Why we use your information

We use your information to create and secure your account, store and generate project code, render previews, track usage, process payments, respond to support requests, and prevent abuse. We may also retain records necessary for tax, accounting, fraud prevention, or legal obligations.

Where applicable, our legal bases are performance of our agreement with you, legitimate interests in operating and protecting the service, compliance with legal obligations, and your consent where required. We do not sell your personal information or use it for targeted advertising.

4. AI providers and your content

When you start an agent run, relevant prompts, recent conversation, instructions, and project files are sent to the model provider selected for that run. Supported providers include OpenAI, Anthropic, Google, and OpenRouter. OpenRouter routes requests to the provider associated with your selected model.

This applies to both managed keys and your own API keys. The provider processes the request under its terms, privacy policy, and your account settings where applicable. Provider retention and model-training practices may differ. Codlyra does not use your projects to train its own models. Do not submit secrets or data that you are not authorized to share with the selected provider.

5. Other service providers and disclosure

We use infrastructure hosting services to operate the application and Cloudflare for DNS, traffic delivery, and security. Stripe processes payments when billing is enabled. Resend delivers transactional emails when email is configured. These providers receive only the information needed for their service.

We may disclose information when legally required, to protect rights and security, or as part of a corporate transaction with appropriate safeguards. Shared preview links allow anyone holding the link to view that preview. Disable sharing to revoke future access through that link.

6. Retention and deletion

Account and project data are retained while your account is active. You can delete projects, remove provider keys, export account data, or request account deletion. We keep up to 50 saved versions per project. Deleted data is removed from the live application; operational backups may retain earlier copies for up to 7 days.

Expired sessions and authentication tokens are periodically removed. Access logs are rotated and retained for up to 14 days. Support records may be retained for up to 24 months unless you request earlier deletion or longer retention is legally required. Billing and accounting records may be retained for up to 7 years, with account identifiers removed where possible.

An active paid subscription must be resolved before self-service account deletion. Contact us if you need immediate deletion or cannot access your account. We may verify identity before processing a request.

7. Your rights and choices

Depending on your location, you may have rights to access, correct, delete, or receive a copy of your data; restrict or object to certain processing; withdraw consent; and complain to your local supervisory authority. We do not discriminate against users for exercising these rights.

You can update your name, export your account, remove API keys, stop sharing, and manage projects in Settings and your workspace. Submit other requests through Contact. We aim to respond within applicable statutory time limits.

8. Security and international processing

We use HTTPS, password hashing, authenticated sessions, encrypted API-key storage, ownership checks, and isolated previews. No system is completely secure. Please use a unique password and provider spending limits.

Providers may process information outside your country, including in the United States. Where required, appropriate contractual or other lawful safeguards apply to international transfers. Contact us for more information about a specific processing request.

9. Cookies, age, and changes

We use essential session cookies and browser session storage for temporary workflow information. See the Cookie policy. The service is intended for people aged 18 or older, and we do not knowingly collect children’s data.

We may update this policy as the service changes. The effective date will be updated, and material changes will be communicated through the service or email when available.