Privacy Policy

1. Who this policy covers

This Privacy Policy describes how Codager, a project, task, and credentials manager operated by Xunoia, collects, uses, and protects information — including the optional WhatsApp AI assistant layer that lets a linked user check tasks, create things, and get updates by texting the bot. It applies to the Codager web application and to the WhatsApp Business number associated with it.

2. What we collect

We collect the following categories of information:

• Account information — your email address and display name. Codager uses passwordless, email one-time-code login, so we do not store a password for your account.
• Organization and project data you create — organizations, projects, tasks, resources, meetings, uploaded documents, comments, and project activity logs.
• Encrypted credentials — passwords, TOTP 2FA seeds, and .env file contents you store in a project. These are encrypted at rest on our servers. Some projects can instead use an optional zero-knowledge vault mode, where secrets are encrypted in your browser before they ever leave it — in that mode, our servers only ever hold ciphertext they cannot decrypt.
• Your WhatsApp phone number — only once you explicitly link it to your Codager account through the linking flow in the app. We do not collect a phone number unless you choose to connect WhatsApp.
• WhatsApp message content — the text of messages you send to the assistant, and, if you send a voice note, the audio file and its transcript.
• AI action audit logs — a record of what the assistant was asked to do, which action it selected, whether it was permitted, and the outcome, for every WhatsApp interaction that goes through the assistant.
• Google Calendar tokens — only if you choose to connect Google Calendar, in which case we store OAuth access and refresh tokens (encrypted at rest) so meetings can sync.

3. How we use it

• To operate Codager — projects, tasks, meetings, documents, comments, and credential storage.
• To power the WhatsApp assistant's actions. The assistant can only take actions your account is already permitted to take inside Codager — it does not have broader access than you do, and every action it takes is written to an audit log.
• To send login codes and other account-related email.
• To debug issues, monitor reliability, and improve the assistant, using the AI audit logs described above.

4. Third-party subprocessors

We use the following third-party services to run Codager. Each receives only the data it needs to perform its role. This list reflects our understanding of the system as of the date above; it is not exhaustive and is not a binding legal representation without further review.

• MongoDB Atlas — Hosts our primary database — accounts, organizations, projects, tasks, and encrypted secret ciphertext.
• Vercel — Hosts and runs the Codager application itself.
• Cloudflare R2 — Stores WhatsApp voice-note audio files (kept separately from the database, subject to the retention window described below).
• Anthropic (Claude) — Processes WhatsApp message text to interpret requests and generate the assistant's replies and actions.
• Google (Gemini) — Acts as a fallback AI provider for the WhatsApp assistant if the primary provider is unavailable; also provides the Google Calendar API if you connect your calendar.
• Sarvam AI and Deepgram — Transcribe WhatsApp voice notes to text.
• Meta / WhatsApp Business Platform — Transports messages between you and Codager over WhatsApp.
• Resend — Delivers transactional email, including one-time login codes.
• Inngest — Runs background jobs (e.g. voice-note cleanup) and, in doing so, handles message content and AI action data in transit.

5. Data retention

• WhatsApp voice-note audio and transcripts are deleted after a limited retention window (currently 30 days from receipt), after which a scheduled job removes both the stored audio and the transcript. This window is currently a placeholder engineering default, not a finalized policy commitment — it is subject to change as we settle on a real retention decision.
• Other account, organization, project, and conversation data is retained for as long as your account or the relevant project exists.
• Encrypted secrets cannot be recovered if the relevant encryption key is lost. This includes our server-side encryption key for standard credential storage, and, for projects using the zero-knowledge vault, your own vault passphrase — in the vault case, we have no way to recover your data if you lose it, by design.

6. Data security

• Secrets stored outside the zero-knowledge vault (account passwords, TOTP seeds, .env contents, Google OAuth tokens) are encrypted at rest using AES-256-GCM.
• Projects can optionally use an end-to-end encrypted vault, where secrets are encrypted and decrypted in your browser and our servers never see the plaintext.
• Access to project data is scoped to the project's owner and invited members; the WhatsApp assistant is bound by the same permissions.
• Every AI-driven action taken through the WhatsApp assistant is logged for audit purposes.

7. Your rights and data deletion

For information on how to request deletion of your account or your data, see our Data Deletion page.

8. Children's privacy

Codager is a workplace tool and is not directed at children. We do not knowingly collect information from children.

9. Changes to this policy

If this policy changes, we'll update the “Last updated” date at the top of this page. Continued use of Codager after a change means you accept the updated policy.

10. Contact

Questions about this policy can be sent to privacy@xunoia.com — a placeholder address the operator of this app should confirm or replace before relying on this page in production.