Privacy policy

1. Who is responsible for your data

The one who decides how your data is used is:

2. What we store

• To sign you in: your email address and your password. The password is stored in a form that cannot be read back. If you sign in with GitHub, we store what GitHub tells us about your GitHub account, such as its name and email address.
• Your profile: your username and, if you give one, your display name.
• Your settings: the Claude Code settings and the statusline you store in CodeByPlan, and their earlier versions.
• Your devices: the computers on which you use the CodeByPlan app.
• Your GitHub accounts: which GitHub accounts you connected. Access tokens for GitHub are not stored with us. They stay on your device.
• Your memberships: the organizations and projects you belong to, your role in them, and invitations sent to you or by you.
• A record of changes: in an organization, who changed what and when.
• That you accepted the terms: the moment you ticked the box.

The companies that host the service also keep technical records for a short time, such as the IP address and time of a request, to run it and to keep it safe. When you are invited by email, the email service keeps a record of that email for a short time.

3. Why we use it

• To provide the service you signed up for: your account, profile, settings, devices, GitHub accounts and memberships. Without them CodeByPlan cannot do what you ask of it. The legal ground is the contract between you and us (Article 6(1)(b) of the GDPR).
• To keep the service safe and working: the technical records of the hosting and the record of changes in an organization. The legal ground is our legitimate interest in a secure service, and the interest of an organization in knowing who changed its settings (Article 6(1)(f)).
• To show that you accepted the terms: the moment you accepted them. The legal ground is our legitimate interest in being able to show it.
• To send you email: the emails that confirm your address or reset your password, and invitations someone sends you. We send no newsletters or advertising.

We do not sell your data and do not use it for advertising or profiling.

4. Cookies and tracking

This website sets cookies for one purpose: to keep you signed in. They are set when you sign in or sign up, and removed when you sign out.

There is no analytics, no advertising and no tracking on this website, and no cookies from other companies.

5. Who receives your data

We use these companies to run CodeByPlan:

• Supabase, for the database and for signing in.
• Vercel, for hosting this website.
• Resend, for sending email.
• GitHub, when you sign in with GitHub or connect a repo.

Members of an organization see the username and display name of the other members.

These companies process your data only on our instructions, under data processing agreements. They are based in the United States. Where they can reach your data from outside the European Economic Area, the transfer is covered by the safeguards the GDPR requires, such as the EU standard contractual clauses or the EU-U.S. Data Privacy Framework.

When you connect GitHub, what is stored in your repos is governed by your agreement with GitHub.

6. Where your data is kept

• The database and sign-in: Stockholm, Sweden.
• The website: Stockholm, Sweden. Its pages are delivered from servers near you.
• Email: Ireland.

7. How long we keep it

We keep your data while you have an account. When you delete your account on your account page, your profile, your own settings, your devices, your connected GitHub accounts and your memberships are deleted.

The record of changes of an organization stays as long as the organization exists, but no longer names you as the one who made a change. Settings you saved in an organization belong to the organization and stay with it. Backups of the database are overwritten within 30 days, and the technical records of the hosting within a similar time.

8. Your rights

You can change your username and display name, and delete your account, on your account page.

By law you may ask us for a copy of your data, to correct it, to delete it, to limit what we do with it, to receive it in a form a machine can read, and you may object to what we do on the ground of our legitimate interest. Write to privacy@codebyplan.com. We answer within one month.

You may also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee), or to the authority of the country where you live.

9. How we protect it

• The database shows each person only the rows they are allowed to see.
• The link of an invitation is stored in a form that cannot be read back.
• Connections to this website and to the service are encrypted.
• Only the people who run the service can reach the database and the hosting.

If your data is lost or reaches someone it should not, we tell the Data Protection Inspectorate within 72 hours, and we tell you without delay when it puts you at risk.

10. Changes to this policy

When we change this policy, the new version is published here with its date. When a change matters for how your data is used, we tell you by email before it takes effect.

11. Contact

Questions about your data: privacy@codebyplan.com