Privacy Policy
Last updated: 2026-05-26. Version 2.
This policy describes what data Codecanic collects, why, where it goes, and how long we keep it. Codecanic is operated by CyberWave Technologies LLC (Sacramento, CA, USA), which is the data controller for the personal data described below. For any request — access, deletion, correction, complaint — email info@cyberwaveglobal.com. We respond within 30 days as required by GDPR Article 12(3).
1. What we collect and why
| Data | Purpose | Lawful basis (GDPR Art. 6) | Retention |
|---|---|---|---|
| Email, name, password hash (scrypt + salt) | Account creation, authentication, security | Contract (Art. 6(1)(b)) | Until you delete your account (immediate, permanent) |
| Organizations and roles | Workspace ownership and access control | Contract | Until you delete account or leave the organization |
| OAuth access tokens (GitHub, Vercel, GitLab, Bitbucket) and manual tokens (Railway, Xcode) | Run scans and propose repairs on your authorization | Contract | Until you disconnect the provider, leave the org, or delete account; deletion is immediate and cascades |
| Scan reports and repair queue entries | Show you findings, let you approve fixes | Contract | Until you delete account or remove report |
Signed session cookie codecanic_session (HttpOnly, Secure, SameSite=Strict) | Identify your authenticated browser | Contract — strictly necessary | 14 days from issue, refreshed on activity |
| Acceptance timestamps for Terms + Privacy Policy | Demonstrate informed consent | Legal obligation (Art. 6(1)(c)) | Life of the account + 6 years |
| Marketing opt-in flag | Honor your email preference (we do not currently send any marketing emails) | Consent (Art. 6(1)(a)) | Until you delete account or opt out |
| HTTP request logs (IP, path, status, timestamp, user agent) | Abuse detection, debugging, security audit | Legitimate interest (Art. 6(1)(f)) | 30 days then rotated |
| Failed-login counters (IP + email) | Rate-limit credential stuffing | Legitimate interest | 15 minutes after last failure |
2. Cookies and similar technologies
| Cookie | Set by | Purpose | Lifetime |
|---|---|---|---|
codecanic_session | Codecanic (1st party) | Authentication — strictly necessary, set only after sign-in | 14 days |
codecanic-cookie-consent (localStorage) | Codecanic | Remember your consent choice on the cookie banner | Until you clear browser storage |
codecanic-state (localStorage) | Codecanic | Cache your dashboard layout, connector status, audit trail | Until you sign out, delete the account, or clear browser storage |
codecanic-anthropic-key / codecanic-openai-key (localStorage) | Codecanic | Your own AI provider API key(s) for AI-powered repairs — stored only in this browser, never on our servers; sent with a repair request to the provider you connected | Until you click Disconnect in the AI Keys panel or clear browser storage |
Google AdSense cookies (__gads, __gpi, IDE, others) | Google (3rd party) | Ad delivery, frequency capping, fraud detection, optionally personalization. Only set after you accept on the cookie banner. | Up to 13 months (Google policy) |
If you select Essential only on the cookie banner the AdSense script is not loaded at all — no Google cookies are set, no requests are made to Google ad servers, and the sponsor slots remain blank.
3. Advertising
The Codecanic web service is open to every team at no cost and supported by ads served by Google AdSense (publisher ca-pub-8731629548430880). (The iOS/macOS apps offer an optional subscription processed by Apple; we never receive your payment details.) When you accept ad cookies, Google may receive your approximate location, device, IP-derived signals, and AdSense cookie identifiers to deliver and measure personalized or non-personalized ads. Manage your Google ad preferences at adssettings.google.com. Google's privacy policy: policies.google.com/privacy.
EEA / UK / Swiss users: when consent is required, Google's IAB TCF v2.2 prompt may also appear before personalized ads are served. You can withdraw consent at any time by clicking Manage cookies in your account card.
4. Subprocessors (third parties that process data on our behalf)
| Subprocessor | Role | Region |
|---|---|---|
| Vercel Inc. | Static frontend hosting (codecanic.app) and edge proxy for /api/* | USA |
| Railway Corp. | API hosting and persistent data store | USA (US West region) |
| Google LLC (AdSense) | Sponsor ad delivery — only after you opt in | USA |
| GitHub, GitLab, Bitbucket, Vercel, Railway, Apple Developer (when you connect them) | OAuth identity and the read scopes you grant for each scan | USA / EEA depending on provider |
5. International data transfers
Codecanic is hosted in the United States. If you access the service from the EEA, UK, or Switzerland, your personal data is transferred to the US. We rely on the European Commission Standard Contractual Clauses (Module 2, Controller-to-Processor) with each subprocessor named above, and on each subprocessor's published Data Processing Addendum. Copies are available on request to info@cyberwaveglobal.com.
6. Your rights
- Access and portability (Art. 15 + 20): click Download my data in your account card. Format: JSON. Tokens are redacted to
***redacted***for safety; if you need the original tokens, fetch them yourself from the provider before exporting. - Erasure (Art. 17): click Delete account. Your user record, sessions, sole-owned organizations, and every connector credential are removed immediately and permanently. There are no soft-delete backups; nothing is retained after the action completes.
- Rectification (Art. 16): email info@cyberwaveglobal.com with corrections.
- Restriction / objection (Art. 18 + 21): email us. For processing based on legitimate interest you can object at any time.
- Consent withdrawal: click Manage cookies in your account card to switch ad consent off, or unsubscribe from any future marketing email we send.
- Lodge a complaint: you can complain to your local supervisory authority. In the EU, find yours at edpb.europa.eu. In the UK, the ICO (ico.org.uk).
7. California (CCPA / CPRA) notice
If you are a California resident:
- Categories collected: identifiers (email, IP), commercial info (organization), internet activity (request logs), inferences (none).
- "Sale" of personal information: we do not sell personal information.
- "Sharing" for cross-context behavioral advertising: when you accept ad cookies, we share advertising identifiers with Google AdSense. You can opt out at any time by selecting Essential only on the cookie banner or by clicking Manage cookies. We treat that signal as your Do Not Sell or Share My Personal Information request.
- Sensitive PII: we do not collect sensitive personal information as defined by CCPA.
- Right to limit use: not applicable because we do not use sensitive PII.
- Authorised agent: you may designate one in writing.
8. Security
- TLS 1.2+ enforced via HSTS preload on every connection.
- Passwords: scrypt (CPU-hard) with per-user 16-byte random salt. Plaintext passwords never stored.
- Provider access tokens: AES-256-GCM encrypted at rest with a key derived from a 64-character server secret via scrypt KDF.
- Sessions: HMAC-SHA256 signed cookie,
HttpOnly,Secure,SameSite=Strict, max 5 concurrent per user. - Anti-CSRF: every state-changing request requires a same-origin Origin header.
- Anti-brute-force: 15-minute lockout after 5 failed login attempts per IP+email.
- Password policy: minimum 15 characters with uppercase, lowercase, digit, and symbol (DISA STIG aligned).
- Strict Content-Security-Policy with per-request script nonce. X-Frame-Options DENY. No iframes embed Codecanic.
Breach notification: if we discover a personal data breach we will notify the relevant supervisory authority within 72 hours (GDPR Art. 33). If the breach is likely to result in high risk to your rights or freedoms we will notify affected users without undue delay (Art. 34).
9. Children
Codecanic is not directed to children under 16. We require explicit age confirmation at signup. If we learn that an account belongs to a child under 16 we will delete it and remove all associated data. To report such an account, email info@cyberwaveglobal.com.
10. Automated decision-making & AI
Scan findings and most proposed repairs are produced by deterministic rules and pattern matchers. For code findings without a deterministic fix, you may optionally trigger an AI-generated repair. When you do, Codecanic sends the affected file and the finding to an AI provider (Anthropic, and OpenAI if you enable it) using an API key you supply. Your AI key is held only in your browser and forwarded with that single request; it is never stored on our servers, and the file content is sent only to the provider you connected, only when you start a repair. We do not use machine-learning models to profile you or make automated decisions producing legal effects, and every proposed repair is opened as a pull request for your review — nothing is merged automatically. If this changes we will update this policy and notify you.
11. Accessibility
Codecanic aims to meet WCAG 2.1 AA where practical. The dashboard supports keyboard navigation, screen-reader-compatible ARIA labels on interactive controls, sufficient color contrast, and respects prefers-reduced-motion for animations. We have not yet completed a formal accessibility audit. Report accessibility barriers to info@cyberwaveglobal.com; we will acknowledge within 5 business days.
12. Changes
If we make material changes to this policy we will display a banner on first sign-in after the change and update the "Last updated" date above. Continued use after the effective date constitutes acceptance.
13. Contact
Privacy / data requests: info@cyberwaveglobal.com.
Accessibility: info@cyberwaveglobal.com.
Security disclosure: info@cyberwaveglobal.com.
Trust + safety: info@cyberwaveglobal.com.