Privacy Policy

Version 2026-10-11. Last updated: October 11, 2026.

This Privacy Policy describes how Codon, a trade name (“Codon”, “we”, “us” or “our”), collects, uses, shares and keeps information in connection with the codonhq.com website, the control site at app.codonhq.com, Codon workspaces, the web client, the Mac app and the game client (together, the “Service”). Words defined in our Terms of Service mean the same here.

1. What we collect

Information you give us

Account. Your email address, a display name if you set one, and the record that you accepted the Terms. We give every account a speaker id derived from it.
Workspace content. The repositories, files and documents you or your agents bring into a workspace or create there, what you type, the plans and changes agents make, and the folders you lend from a Mac.
Voice. Audio from your microphone while it is open. What you say to the dispatcher or an agent is transcribed; the transcript is kept in the workspace. What you say on the open player channel is relayed to other members as audio and is not transcribed.
Voice samples. Only if you turn voice cloning on and confirm your consent: up to 120 seconds of your speech, the clone made from it, and the record of your consent.
Invitations. The email address of anyone you invite to a workspace.
Payments. Stripe collects your payment details. We receive and keep Stripe's identifiers for your customer record, subscriptions and payments, the amounts, and the payment status; we never receive your full card number.
Messages. What you send to hello@codonhq.com.

Information collected as you use the Service

Usage records. For every AI request: which workspace and member it was for, which provider and model, the tokens or characters used, the cost, and who paid.
Metrics and timing traces. Counts of what happens in a workspace (for example files and lines changed and tokens used) and the timings of each voice turn, used for the statistics members see and to find faults.
Room state. Where you are in a workspace's room, what you look at and point at, and which screens show what, shared live with the room's members.
Security records. Sign-in attempts (with the email address entered), your sessions, paired devices and Macs, an audit log of account and workspace changes (such as invitations, role changes and billing actions), and short-lived rate-limit records that hold an IP address or a one-way hash of an email address.
Network data. Our hosting and network providers process your IP address and request details to deliver the Service and protect it from abuse.

We do not use analytics, advertising or tracking cookies. The control site sets a session cookie so you stay signed in; Cloudflare Turnstile may set what it needs to check that a sign-in is not automated.

2. How we use it

To run the Service: sign you in, run your workspaces and agents, transcribe and route what you say, speak replies, show workspace content to its members, and keep offline copies in step.
To bill: measure usage, apply allowances, credits and sponsorship, and take payments.
To keep the Service safe: prevent fraud and abuse, enforce our Terms, investigate reports, and secure accounts.
To communicate with you: sign-in codes, invitations, and answers to your messages.
To fix and improve the Service, using the records described above.
To comply with the law.

We do not use your content to train AI models.

3. Who receives what

We use the following providers to operate the Service. Each receives only what its part of the Service needs, and processes it under its own terms and privacy policy.

Recipient	What it receives	Why
OpenAI	Audio of what you say to the dispatcher or agents, and its transcripts; text from workspace conversations, to make conversation embeddings; search queries for finding files; the context for clarifying questions	Speech-to-text, routing a request to the right agent, file search, clarifying questions
ElevenLabs	The text of replies to be spoken. If you turn on voice cloning: your voice samples (up to 120 seconds) and the clone made from them, kept until the clone is deleted. ElevenLabs may keep voice data for up to three years, and voice cloning is never zero-retention at ElevenLabs	Text-to-speech; your cloned voice
Anthropic	Agent work: your requests and transcripts, and the prompts, code, files, command output and other workspace content agents send to models	The AI models the dispatcher and the agents run on
Supabase	Accounts (email, display name, sign-in), workspaces and memberships, billing and usage records, the audit log	Authentication and the control database
Stripe	Your payment details, email address, and what you buy	Payments and subscriptions
Fly.io	Everything in a workspace, held on its machines and volumes; the control site and the AI gateway as they run	Hosting and storage
Cloudflare	DNS queries; offline-copy bundles and app downloads in R2 storage; mail sent to hello@codonhq.com (Email Routing); the signals Turnstile uses to check a sign-in; requests to codonhq.com	DNS, storage, mail routing, bot protection, website hosting
Resend	Your email address and the message	Sending sign-in codes and invitations
GitHub	What you configure: the repositories a workspace imports, and the commits agents push to a repository you connect	Imports and pushes you set up
Macs you or other members lend	The lent folders' files, and offline copies of the workspaces the Mac's owner belongs to	Lending folders; working offline
Apple	Nothing from us. When the Mac app works offline, it uses Apple's on-device speech recognition, which runs on your Mac	Offline speech-to-text

We may also disclose information if the law requires it, or if we believe in good faith that disclosure is necessary to protect our rights, your safety or the safety of others, to investigate fraud or abuse, or to respond to a government request. If the Service is sold or transferred, your information may be transferred as part of it, subject to this policy.

4. What other members see

A workspace is shared. Its members, according to their roles, see and hear its content: its files and repositories, the file graph, the screens, what is said to agents and their replies, transcripts, the player channel, and where each member is in the room and what they look at. Owners and administrators also see the workspace's usage and spending and who it was for. Your display name and speaker id are shown to the members of your workspaces.

5. How long we keep it

Workspace data (repositories, files, transcripts, conversations, plans, embeddings, room layout) is kept until the workspace is deleted.
Metrics and timing traces are kept for 30 days.
Usage records, the audit log and billing records (payments, credits, subscriptions, closed billing periods) are kept, because we need them for accounting, tax, disputes and security. After your account is deleted they are kept under a pseudonymous id that no longer leads to your email address.
Sign-in attempts and the email addresses on invitations are kept until your account is deleted (and invitations you send are deleted with it). Rate-limit records are kept only as long as rate limiting needs them.
Voice samples and clones are kept until you ask us to delete the clone, you leave the workspace it was made in, the workspace is deleted, or you delete your account; ElevenLabs' own retention is described in section 3.
Offline copies stay on your Mac. The Mac app deletes a workspace's offline copy when your access to it ends, the next time it checks in.
Mail to hello@codonhq.com is kept as long as needed to answer it and keep a record of the conversation.

6. Deleting your account

You can delete your account at any time with “Delete my account” in your account settings on the control site. If you own a workspace that other members still use, you must first hand it to another owner. Deletion cannot be undone. When you delete your account:

your membership, and any sponsorship you pay for, is cancelled immediately, without refund;
you are removed from every workspace, and the credentials of the Macs and devices you paired stop working; your Macs are told to delete their offline copies;
the workspaces that only you belong to are deleted, with their data;
your voice clones are deleted, in every workspace;
the invitations you sent are deleted;
your profile is cleared and your sign-in account is deleted.

What is kept: usage, audit and billing records under a pseudonymous id (section 5), and what you contributed to workspaces that other members still use, which stays theirs to keep or delete.

7. Your choices and rights

Your microphone is open only when you open it. Voice cloning is off unless you turn it on.
You choose which repositories, folders and Macs to connect, and whom to invite.
You can ask us to access, correct, export or delete your personal information by writing to hello@codonhq.com from your account's email address. We will answer in line with the law that applies to you.

8. No sale, no ads, no tracking

We do not sell or rent your personal information, share it for targeted advertising, or use advertising or cross-site tracking technology.

9. Security

We use reasonable technical and organizational measures to protect your information, including encrypted connections, authenticated access, isolated workspaces and per-agent sandboxes. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Children

The Service is intended solely for adults and is not directed to anyone under 18. Individuals under 18 may not use it. We do not knowingly collect personal information from anyone under 18; if we learn that we have, we will delete it. If you believe a person under 18 is using the Service, contact us at hello@codonhq.com.

11. Where your data is

The Service is intended for residents of the United States. Workspaces, the control site and the AI gateway run on servers in the United States. Some of our providers may store or process information in other countries under their own safeguards. If you use the Service from outside the United States, your information will be transferred to and processed in the United States.

12. Changes to this policy

We may update this policy. If we make a material change, we will tell you through the Service or by email before it takes effect. Your continued use of the Service after a change takes effect means you accept the revised policy.

13. Contact

Questions or requests about this policy go to hello@codonhq.com.