Privacy Policy

Effective 20 September 2026

1. Scope of this Privacy Policy

Coduck Inc. (“Coduck”, “we”, “our” or “us”) respects your privacy. This Privacy Policy describes the categories of information we collect through the Coduck website at coduck.dev (the “Site”) and through the Coduck command-line tool (the “Software”), how we use and disclose that information, and the rights available to you.

This Policy does not apply to the practices of third parties we do not control, including the artificial intelligence providers, source control platforms and issue tracking systems described in Section 6. Your use of those services is governed by their own privacy policies.

Where the EU or UK General Data Protection Regulation applies, Coduck Inc. is the controller of the personal information described in Section 2.

2. The Information We Collect

2.1 Information you provide to us

If you submit the beta interest form on the Site, we collect the email address you enter and the date of submission. If you contact us by email, we collect your email address and the contents of your message. These are the only circumstances in which you provide personal information to us.

2.2 Information collected automatically when you visit the Site

Our hosting provider records standard server log information when your browser requests a page, including your IP address, the requested URL, the date and time of the request, your browser user-agent string and referring page. This information is generated by the operation of the internet and is used to deliver the Site and to protect it from abuse.

The Site does not use cookies, local storage, session storage, web beacons, pixels, device fingerprinting, analytics software or advertising technology. We do not build profiles of visitors and we do not attempt to identify you from server logs.

2.3 Information processed by the Software

The Software is a program that executes on your own computer. It is not a hosted service, it has no user account, and it does not authenticate to any system operated by Coduck. Coduck operates no server that the Software connects to.

Coduck does not receive, and does not have the ability to access, any content the Software processes on your computer. This includes your source code, diffs, commit history, branch or repository names, file paths, the contents of issues or requirements pages the Software retrieves, the findings a review produces, and the fact that a review was run at all. The Software contains no analytics, telemetry, usage reporting or crash reporting, and it transmits no data to us of any kind.

In the course of operating locally, the Software reads from your computer:

• files within the repository you direct it to review, and that repository’s git metadata;
• its configuration files, .coduck/config.yaml and .coduck/config.local.yaml; and
• documents you have expressly identified in that configuration.

The Software writes to your computer:

• a .coduck/ directory within the repository, containing configuration and per-run working files, from which older runs are deleted automatically; and
• where you elect to connect an issue tracking system under Section 6.2, OAuth access and refresh tokens in ~/.coduck/credentials/, written with file permissions restricting access to your user account.

This material remains on your computer and under your control. You may delete it at any time.

3. How We Use Your Information

We use the limited information identified in Section 2.1 to:

• contact you regarding access to the Coduck beta programme;
• send you information about the Software, including material changes to it or to this Policy;
• respond to your enquiries and provide support; and
• comply with law and enforce our Terms of Service.

We use server log information described in Section 2.2 to operate and secure the Site and to understand aggregate traffic volume. We do not use it for advertising or profiling.

We do not use your information to train artificial intelligence or machine learning models. We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

4. Legal Bases for Processing

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

• Consent (Article 6(1)(a)) for the beta interest list. You may withdraw consent at any time, which will not affect the lawfulness of processing before withdrawal.
• Legitimate interests (Article 6(1)(f)) for operating and securing the Site and for responding to enquiries you send us, where those interests are not overridden by your rights.
• Legal obligation (Article 6(1)(c)) where we are required to retain or disclose information by law.

5. How We Disclose and Share Your Information

We do not sell, rent or trade personal information. We disclose the information described in Section 2.1 only:

• To service providers who process it on our behalf and under contract, namely the form and hosting providers identified in Section 6.1;
• For legal reasons, where we reasonably believe disclosure is required by law, regulation, legal process or governmental request, or is necessary to protect the rights, property or safety of Coduck, our users or the public; and
• In a business transfer, in connection with a merger, acquisition, financing or sale of assets, in which case we will require the recipient to honour this Policy or give you notice and an opportunity to have your information deleted.

Because the Software transmits nothing to us, there is no information arising from your use of the Software available for us to disclose to anyone.

6. Third-Party Services

6.1 Providers we engage to operate the Site

• Cloudflare, Inc. hosts the Site on Cloudflare Pages and processes the server log information described in Section 2.2.
• Formspree, Inc. receives and stores the email address you submit through the beta interest form.
• Google LLC serves the typefaces used by the Site from fonts.googleapis.com and fonts.gstatic.com. Your browser requests those files directly from Google, which discloses your IP address to Google. We receive no information from Google as a result.

6.2 Services you may direct the Software to use

The following are not our service providers. They are services you already hold an account with, which the Software accesses on your instruction and using your own credentials.

• Artificial intelligence providers. The Software includes no model of its own. It performs a review by invoking a coding agent already installed and authenticated on your computer, currently Claude Code or Codex. Running a review therefore transmits portions of your repository to Anthropic, PBC or OpenAI, L.L.C. respectively, under the agreement and privacy policy in force between you and that provider. Coduck is not a party to that transmission, cannot observe it, and exercises no control over the recipient’s handling of that data. You should consult that provider’s privacy policy to understand how your code is treated.
• Issue tracking and documentation systems. If you elect to connect Notion or Atlassian, authentication occurs directly between you and that provider through its own consent screen. The Software registers as a public OAuth client at the time of connection and requests no scopes; the access granted is bounded by what your account can already reach and, for Notion, by the pages you expressly share. Resulting tokens are stored only on your computer as described in Section 2.3 and are never transmitted to us. Retrieved pages are held in memory for the duration of a review. The Software performs read operations only; it does not create, modify, transition or comment on any record.
• Source control platforms. Reviewing a pull request uses the git credentials already present on your computer to fetch references. No access token is issued to us and no application is installed into your organisation.

You may revoke any connection at any time by running coduck auth notion --forget or coduck auth atlassian --forget, which deletes the stored token from your computer, and by removing Coduck from your account settings with that provider.

6.3 Links

The Site contains links to third-party websites. We are not responsible for their content or privacy practices.

7. Data Retention

We retain email addresses collected under Section 2.1 until the beta programme concludes or until you ask us to delete them, whichever occurs first. Correspondence is retained for as long as necessary to resolve the matter and to comply with our legal obligations. Server log information is retained by our hosting provider for a limited period in accordance with its standard practice.

8. Security

We maintain administrative and technical safeguards appropriate to the limited personal information we hold, including restricting access to those with a need for it. The architecture of the Software contributes materially to security: because your source code, your issue content and your access tokens are never transmitted to us, they cannot be exposed by a compromise of our systems.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If you believe you have identified a vulnerability in the Software or the Site, please write to privacy@coduck.dev.

9. Your Rights and Choices

To exercise any right described below, email privacy@coduck.dev. We will verify your request by reference to the email address concerned, will respond within the time the applicable law requires, and will not charge you or require you to create an account.

If you are in the European Economic Area, the United Kingdom or Switzerland, you have the right to request access to your personal information, its rectification or erasure, restriction of or objection to processing, and data portability, and to withdraw consent. You also have the right to lodge a complaint with your supervisory authority.

If you are a California resident, the California Consumer Privacy Act gives you the right to know the categories and specific pieces of personal information we have collected, the sources of that information, the purposes for collecting it and the categories of third parties to whom it is disclosed; to request deletion; to request correction; and not to receive discriminatory treatment for exercising these rights. In the preceding twelve months we collected the identifiers described in Section 2.1 and the internet activity information described in Section 2.2, for the purposes stated in Section 3, and disclosed them only to the service providers listed in Section 6.1. We have not sold personal information and have not shared personal information for cross-context behavioural advertising. We do not collect sensitive personal information as defined by that Act.

If you are a resident of Texas, Virginia, Colorado, Connecticut, Utah or another state with comprehensive privacy legislation, you have equivalent rights of access, correction, deletion and portability, and the statements above regarding sale and targeted advertising apply equally. Where an appeal right exists, you may appeal a refusal by replying to our response.

Do Not Track

The Site does not track visitors across third-party websites and therefore does not respond differently to Do Not Track signals.

10. Location of Processing and International Transfers

Coduck Inc. is located in the United States and the information described in Section 2.1 is stored there. If you are located outside the United States and submit that information, you consent to its transfer to and processing in the United States, which may not provide the same level of data protection as your jurisdiction. Because the Software transmits no information to us, no other data of yours is transferred to us.

11. Children’s Privacy

The Site and the Software are intended for professional use by adults and are not directed to children. We do not knowingly collect personal information from anyone under the age of 16. If you believe a child has provided us with personal information, contact us and we will delete it.

12. Changes to This Policy

We may update this Policy from time to time. We will revise the effective date at the top of this page. If we make a material change that reduces the protection of your information, in particular if the Software were ever to transmit information to us, we will provide prominent notice on the Site and, where we hold your email address, by email, before the change takes effect.

13. How to Contact Us

Coduck Inc.
Austin, Texas, United States
privacy@coduck.dev