Privacy & Compliance

Privacy Policy

Last updated: November 9, 2026 · This policy explains what data codexworker.com and its control plane collect, the rights you have under the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), and how to exercise them.

Data Controller

Who Is Responsible for Your Data

The data controller for this website and its control plane is Codexworker — an independent backend developer operating from the European Union. For any privacy matter, contact info@codexworker.com. There is no separate data protection officer; the controller responds to privacy requests personally.

Data Collection

What Data This Website and Its Control Plane Collect

Server log data — IP address, requested path, timestamp, response status, latency and, when you are signed in, your account ID, collected automatically for security and abuse prevention.

Account and control-plane data — email address, nickname, password hash, optional two-factor secret and recovery codes, language and timezone, notification preferences, API tokens, verification and password-reset tokens, project memberships, tasks, comments, task history and notifications.

Agent data — machine description, tool versions, hostname, operating system, architecture, CPU and memory, Docker container names, ports and state, model names, token counts, cost and runtime, plus session events containing generated text, reasoning and tool-call descriptions. This may include source code or other content from the machine running the agent.

Inventory and network data — device names, categories, serial numbers, MAC and IP addresses, locations, purchase and warranty details, notes, photos, attachments, history, connections and uploaded network captures.

Cookies and local storage — a session cookie named codexworker_session (30 days, HttpOnly, Secure in production, SameSite=Lax) identifies your login session; the session data (user ID, nickname, role, timezone, password epoch and CSRF token) is stored server-side. The theme preference is stored in your browser's localStorage. No analytics, advertising or cross-site tracking cookies are used.

Email — if you contact me by email, I process your address and the content of your message to respond. The service also sends transactional email to your account address: verification, password reset, task notifications, activity digests and operational alerts.

No analytics profiles, no advertising cookies, no cross-site tracking and no sale of personal information.

Legal Bases

Why the Data Is Processed (GDPR Article 6)

Server logs are processed on the basis of legitimate interest (Art. 6(1)(f) GDPR) — keeping the service available and secure. Account, project, task, inventory and agent features are provided under the contract or pre-contractual steps (Art. 6(1)(b) GDPR); where a feature is optional, processing rests on your request or legitimate interest. Transactional email is processed to perform the contract; operational alerts and activity digests rely on legitimate interest. The session cookie and CSRF token are strictly necessary technical storage; the theme preference is stored only because you chose it. No optional analytics, advertising or tracking storage is used, so no consent banner is required.

GDPR

Your Rights Under the EU General Data Protection Regulation

If you are in the EU or EEA, you have the following rights regarding your personal data (GDPR Articles 12–23). Requests are answered free of charge, normally within 30 days.

Access (Art. 15) — confirmation whether your data is processed and a copy of it.

Rectification (Art. 16) — correction of inaccurate personal data.

Erasure (Art. 17) — deletion of your data when there is no overriding reason to keep it.

Restriction (Art. 18) — processing paused while a dispute is resolved.

Data portability (Art. 20) — your data in a structured, machine-readable format.

Objection (Art. 21) — objection to processing based on legitimate interest.

Complaint (Art. 77) — lodge a complaint with your national supervisory authority; in Slovakia that is the Úrad na ochranu osobných údajov (dataprotection.gov.sk).

CCPA

Your Rights Under the California Consumer Privacy Act

If you are a California resident, the CCPA grants you the following rights. This website does not sell or share personal information as defined by the CCPA, and it does not discriminate against you for exercising these rights.

Right to know — what personal information is collected, used and disclosed.

Right to delete — request deletion of your personal information.

Right to correct — fix inaccurate personal information (as amended by the CPRA).

Right to opt out of sale or sharing — not applicable here, because no personal information is sold or shared for advertising.

Right to non-discrimination — equal service and pricing regardless of exercising your rights.

Exercising Rights

How to Make a Request

Send an email to info@codexworker.com with the subject line “Privacy Request”. Describe what you want (access, deletion, correction, etc.) and include enough detail to identify you. Identity is verified only by matching the details in the correspondence — no ID documents are required. You receive a substantive response within 30 days (GDPR) or 45 days (CCPA). No account is needed, and an authorized agent may submit on your behalf with written permission.

Retention

How Long Data Is Kept

Server logs are kept for a maximum of 90 days and then automatically removed. Agent session events and runtime snapshots are pruned after 30 days. Account data is kept while the account exists; deleting an account removes its profile, tokens, memberships, agent telemetry and personal project, while tasks in shared projects may remain with the creator reference removed. Project, task, inventory and network data are kept while the project exists. Email correspondence is kept while the matter is active and for 3 years afterwards for record-keeping, unless you request deletion sooner or a contract requires longer retention.

Sharing & Transfers

Who Sees Your Data

Data is processed by the controller and by hosting and email-delivery providers acting as data processors under Article 28 GDPR. Hosting servers are located in the EU. No data is sold, rented or shared with advertisers. The site loads no third-party analytics, advertising or tracking scripts; all fonts are served from its own servers. Data may be disclosed only where required by law.

Changes

Updates to This Policy

This policy may be updated to reflect changes in the website or the law. The “Last updated” date at the top always shows the current version; material changes are announced on this page.

Contact

Privacy question or request?

Whether you want a copy of your data, its deletion, or just clarification — send a short email and you get a personal answer.

Contact About Privacy