Privacy Policy

Celiador is built privacy-first, and we state our data practices plainly — no two-mode toggle where the honest default is the one you have to find and turn on. This page summarizes how we handle your information; the full policy will be published before general availability.

We never train on your code

Unconditionally. There is no setting that changes this and no tier where it flips. We do not use your source code, prompts, or editor actions to train models — ours or anyone’s.

Your code stays local

Celiador runs the coding agent on your own machine against your local workspace. Your repository is not uploaded, and we do not build or store a server-side index or embeddings of your codebase. Only the specific context an agent request needs is sent for that request.

How AI requests work

You never hold a model key, and your editor never talks to the model provider directly. Requests are proxied through the Celiador daemon, which holds a shared key and forwards your messages to the AI provider for that single request. We don’t retain those requests to train on them. When you run an agent in the cloud instead of locally, it executes in an isolated per-run workspace that is reclaimed after the run.

What we store

Account: the minimum to run your account — an identifier and email, used to authenticate you and to send only the product updates you opt into.

Chat history: so your conversations are available across your devices, we store your agent chat history on our server, tied to your account. You can delete individual chats, or delete your whole account to remove everything.

Usage: we meter per-account agent usage against your plan’s limits. Those numbers are shown back to you, in full, inside the app — the same figures we enforce.

Product telemetry

The editor can send a small amount of anonymous usage data so we know which features are used and which crash. It goes to TelemetryDeck, a privacy-first analytics service hosted in the EU. What is sent: the event name (for example “a run was started from the phone”), the app version, your operating system version and CPU architecture, and a one-way hash of a random machine identifier. What is never sent: your code, file names, paths, prompts, chat content, error messages, stack traces, workspace or repository names, your email, or anything that identifies you. Crash reports carry only the error’s type and a count.

The editor asks on first launch, and the standard telemetry.telemetryLevelsetting turns it down or off at any time (“off” stops every signal). The iPhone app reports into the same TelemetryDeck app with the same rules: a handful of its own events (a run started from the phone, a steering command by kind, a pull request opened, a sign-in), the app and iOS versions, the device model, and a one-way hash of Apple’s per-app vendor identifier. Its “Share anonymous usage data” switch in Account turns it off.

Deleting your data

Deleting your account is self-service and permanent. It removes your account, profile, stored chat history, push registrations, and any cloud-run workspaces — not just a flag that hides them.

No model key on your machine

The editor and the iPhone app never hold a model-provider key. Every model request goes through our server, which holds the key, meters your usage against the published limits, and forwards the request to Anthropic under their API terms. Bringing your own key is not offered today; if that changes, this page will say so before it ships.

This is placeholder text and not legal advice. Replace with your reviewed policy before going live.