Privacy Policy

1. Information we collect

• Account information: first and last name (as you enter them at signup), email address, hashed password, account role and plan, verification status, the date and time you accepted our terms (including the version accepted), and per-project confirmations you give before publishing or deploying.
• Your content: prompts, chat messages, voice recordings you choose to send (for transcription), files, uploads, projects, code and other material you submit, and the AI output generated for you.
• Connected systems: information about the servers, devices, browser sessions and accounts you connect (for example server addresses, device names and pairing data). Server credentials you save are stored encrypted. We do not ask agents to type your passwords.
• CODREN Agent data (when you connect a computer): device name, operating system, Agent version, online status, pairing records and your consent record (date, time, version, IP). For each task: the steps the Agent ran, command output, file paths and file contents it read or changed, and screenshots or screen text it captured — only as needed for the task you asked for. These are sent to CODREN and, as part of the task, to our AI model providers. Screenshots are used to complete the task and are not used for advertising or to train models; task logs and screenshots are kept with the task history and deleted when you delete the chat or your account. A local audit log stays on your computer. We do not collect your passwords; revoking a computer stops all further access, and you can request deletion of Agent data at valondervishi13@gmail.com.
• Approximate location: when you create an account, we derive your approximate country and city from the IP address of the signup request, using an offline IP-geolocation database (IP geolocation by DB-IP, https://db-ip.com, CC BY 4.0). We do not derive or store your street address or precise location, and this lookup does not store an additional copy of your IP address.
• Billing totals and credit balances: the total amount you have paid us (through our payment processor) and your current and used credit totals, kept for account administration.
• Usage and technical data: IP address, browser and device type, log data, timestamps, feature usage, credit and usage records, error logs, and records of approvals you give for sensitive actions.
• Payment information: plan, transaction and subscription records from our payment processors (currently Stripe and PayPal). We do not receive or store your full card number.
• Communications: messages you send us, such as support, privacy or legal requests.
• Support tickets: the subject, category, messages and optional screenshot you send in Support, the replies, and basic account facts the support assistant reads to help you (plan, credit balance, recent task statuses). Support replies may be AI-generated by CODREN Support using our AI providers (processors) and are labeled "AI-generated"; refunds, billing, account and legal requests are handled by a person. Ticket data is kept while your account is active (or until you ask us to delete it) and is deleted with your account, except where we must keep records by law.

2. How we use information

• To provide, operate and maintain the Service, including running the AI tasks and agents you request.
• To authenticate you, secure the Service, prevent fraud and abuse, and enforce our Terms and Acceptable Use Policy.
• To process payments, apply plans, credits and usage limits.
• To communicate with you about your account, security, changes to our terms and support.
• To keep records needed for legal, accounting, dispute and evidence purposes (for example terms acceptance and approval logs).
• To troubleshoot and improve the reliability and quality of the Service. We do not use your content to train our own AI models.
• For account administration and aggregated service analytics (for example how many accounts sign up per country), using your name, email, approximate country/city, plan, billing totals and credit balances.

3. AI providers (processors)

To generate responses, code and actions, we send the relevant parts of your prompts, content and context to third-party AI service providers acting as our service providers/processors. We list them on request at valondervishi13@gmail.com. They process this data to provide the requested output under their API terms. We use these providers under business/API terms under which they do not use your data to train their models, but they may retain data for a limited period (typically up to 30 days) for abuse monitoring and legal compliance. Requests may also be screened by automated safety filters to prevent prohibited uses. We may add or change providers; this policy will be updated accordingly.

Connected services (Google, GitHub and others)

You can choose to connect third-party accounts in Settings › Connections. CODREN only accesses a connected account after you review CODREN's own consent screen and approve access on the provider's page, and only to do what you ask. Today you can connect Google Calendar, Google Drive and GitHub.

CODREN's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

• What we access. Google Calendar: your Google account email, your calendar list and events, and the ability to create and edit events (scopes calendar.readonly and calendar.events). Google Drive: your Google account email and only the files you pick in Google's file picker or that CODREN creates for you (scope drive.file) — not the rest of your Drive. GitHub: your GitHub username and the repositories at the level you choose (public only, or public and private), including the ability to create branches, commits and pull requests.
• How we use it. Only to provide the features you see and ask for in CODREN: answering questions about your schedule or files, creating or updating events, reading, searching and uploading Drive files, and reading repositories and creating branches, commits and pull requests. CODREN asks for your confirmation in the app before it creates or changes an event, sends invitations, uploads a file or pushes to GitHub.
• AI processing. To complete a request, the relevant results (for example the events or file text needed to answer you) are sent to our AI service providers acting as our service providers, solely to generate the response you asked for, with storage of the request at the provider turned off where the provider allows it. Your access tokens are never sent to any AI model.
• What we do not do. We do not sell data from connected accounts; we do not use or transfer it for advertising, retargeting or interest-based ads; we do not use it to determine creditworthiness or for lending; we do not transfer it to data brokers or information resellers; and we do not use it to train, fine-tune or improve generalized artificial-intelligence or machine-learning models (ours or anyone else's).
• Human access. No person at SPICEY SOCIAL AI LLC reads data from your connected accounts, except (a) with your explicit consent (for example when you ask support to look at a specific item), (b) when necessary for security purposes such as investigating abuse or a vulnerability, (c) to comply with applicable law, or (d) when the data is aggregated and anonymized and used for internal operations in compliance with applicable law.
• Storage and security. Access and refresh tokens are encrypted at rest (AES-256-GCM), are tied to your account, are never shown to other users or to the AI, and are never written to logs. We store only what the connection needs: the tokens, the connected account's email or username, the permissions granted, and when it was connected and last used. We do not keep copies of your calendar events, Drive files or repository contents; results of a request are kept in server memory only while the task runs (and at most about one hour after it ends), and the answer you receive appears in your chat history, which you control.
• Sharing. Data from connected accounts is shared only with the AI provider described above to fulfil your request, with the connected service itself when you ask CODREN to act there (for example creating an event), when required by law, or for security purposes. It is never shared with other customers.
• Disconnecting and deletion. You can disconnect any service at any time in Settings › Connections. CODREN then revokes its access at the provider where the provider supports it and deletes the stored tokens and account details immediately. (If you connected both Google Calendar and Google Drive, Google treats them as one grant: CODREN deletes the disconnected product's tokens at once and revokes Google's grant when the last Google product is disconnected.) You can also remove CODREN's access at any time at https://myaccount.google.com/connections or https://github.com/settings/applications. Deleting your CODREN account disconnects and revokes all connections.
• Questions about connected services: valondervishi13@gmail.com.

4. How we share information

We do not sell your personal information and we do not share it for cross-context behavioral advertising. We share personal information only:

• With service providers that help us run the Service (for example AI model providers, hosting and infrastructure providers, email delivery and payment processing), under obligations to use it only to provide services to us.
• With systems and third parties you direct us to interact with (for example websites the browser agent visits for you, or servers and devices you connect).
• When required by law, legal process or a government request, or to protect the rights, safety and property of you, us or others.
• In connection with a merger, acquisition, financing or sale of assets, subject to this policy.
• With your consent.
• Internally with the operator of the Service, SPICEY SOCIAL AI LLC, for account administration: the operator receives an email (sent through our email delivery provider) for each new account with the first and last name, email address, approximate country and city, signup time and the total number of accounts, with a PDF of that entry, and keeps a private client list (name, email, approximate country/city, signup date, plan, total amount paid, credits remaining and credits used) that only the operator can view or export. No browsing, search, content or usage-activity data is included.

5. Customer isolation and security

Each customer's projects, files, chats and saved credentials are logically isolated and access-controlled per account; one customer cannot access another customer's data through the Service. We use technical and organizational measures such as encryption in transit (HTTPS), encryption of saved server credentials, hashed passwords, access controls, rate limiting and audit logging. No system is completely secure, and we cannot guarantee absolute security. Please use a unique password and keep your own backups.

6. Retention

We keep personal information for as long as your account is active and as needed to provide the Service. When you delete your account or ask us to delete data, we delete or de-identify it within a reasonable period, except where we must keep certain records (for example payment, tax, fraud-prevention, terms-acceptance and approval logs, or data needed for legal claims) for as long as required or permitted by law. Backups are overwritten on a rolling schedule. Content of closed, terminated or long-inactive accounts may be deleted. When an account is deleted, it is removed from the operator's client list and from future client-list exports, and its stored per-client PDF is deleted; signup notification emails already sent to the operator are kept in the operator's mailbox only as long as needed for account administration and are deleted on request.

7. Your choices and rights

Depending on where you live (including under the California Consumer Privacy Act as amended (CCPA/CPRA), the New Jersey Data Privacy Act, other U.S. state laws, and the EU/UK GDPR), you may have the right to: know and access the personal information we hold about you; receive a copy in a portable format (export); correct inaccurate information; delete your information; restrict or object to certain processing; withdraw consent where processing is based on consent; and opt out of the sale or sharing of personal information or targeted advertising (we do not sell or share it for those purposes). You will not be discriminated against for exercising your rights.

You can delete your account and its data yourself at any time from Account → Delete account (on codren.ai and in the CODREN iOS app). To make a request (access, export, correction or deletion), email valondervishi13@gmail.com from your account email with the subject "Privacy Request". We will verify your identity and respond within the time required by law (generally 30–45 days). You may use an authorized agent where the law allows. If we deny your request, you may appeal by replying to our response; EU/UK residents may also complain to their data-protection authority.

For EU/UK users, our legal bases are: performance of our contract with you, our legitimate interests (security, fraud prevention, improving the Service, legal defense), compliance with legal obligations, and consent where we ask for it. Your information may be processed in the United States and other countries where we or our providers operate; where required, we rely on appropriate safeguards such as standard contractual clauses.

8. Cookies

We use strictly necessary cookies and similar storage to keep you signed in, protect your session and remember basic preferences (for example local drafts and settings stored in your browser). We do not use third-party advertising cookies. You can block cookies in your browser, but the Service will not work without the session cookie.

9. Children

The Service is for adults (18+ or the age of majority). We do not knowingly collect personal information from children. If you believe a child has provided us information, contact valondervishi13@gmail.com and we will delete it.

10. Data in apps you build

If you build, host or publish an app, website or backend with CODREN that collects personal data from your own end users, you are the controller (or "business") for that data and are responsible for giving your end users your own privacy notice, obtaining any required consents, honoring their privacy rights and complying with privacy and data-protection laws (such as the GDPR, UK GDPR and CCPA/CPRA). SPICEY SOCIAL AI LLC processes that data only on your behalf, to run the Service for you. Do not use the Service to process sensitive data (such as health, financial-account or children's data) unless you have reviewed and accepted the risks and your legal obligations.

11. Voice and media

When you use voice input, live talk, natural voice replies, voice cloning or dubbing, we process the recordings, audio, video and scripts you provide, and send the relevant parts to our AI providers, only to deliver the feature you requested. You must have the consent of every person whose voice or likeness you upload, clone or dub. Recordings and generated media are kept with your account until you delete them or your account, subject to Section 6.

12. AI Output Disclaimer

AI-generated output (including code, apps, text, images, voice and dubbing) may contain errors, bugs, security vulnerabilities or material that infringes third-party rights, and is not legal, medical, financial, security or other professional advice. Review, test and secure everything before you use, publish or deploy it. Section 3 of our Terms of Service and our Disclaimer contain the full terms.

13. Acceptable use

You may not use the Service to collect or process personal information unlawfully, to track, profile or surveil people without a lawful basis, to scrape personal data in violation of law or website terms, or for any other use prohibited by our Acceptable Use Policy. We may review, restrict or remove content and accounts that violate it, and may preserve and disclose information where required by law.

14. Changes and contact

We may update this policy. If changes are material, we will notify you in the app or by email; the "Last updated" date at the top shows the current version. CODREN is operated by SPICEY SOCIAL AI LLC. Questions or requests: SPICEY SOCIAL AI LLC, New Jersey, USA — valondervishi13@gmail.com.