Legal

Imprint, Privacy Policy, Terms & Conditions, Cookie Policy, and Open Source Licenses for codelux.ai

Last updated: 4 October 2026

1. Introduction & Data Controller

This Privacy Policy explains how codelux.ai collects, uses, and protects your personal data when you use the Website and the Codelux App.

The data controller is the sole proprietor trading as Codelux (codelux.ai). The controller’s identifying particulars — registered name, registered address, country of establishment and VAT number — are set out in section 16. Service Details at the foot of this tab, and are displayed there on request. Any communication concerning this Policy, including a request to exercise the rights listed in section 14, should be addressed to [email protected]; we respond within 2 business days.

When your organization is the controller. Some features are used by an organization for its own people: the Team plan and its Manager (Sections 9 and 12), single sign-on and SCIM user provisioning (Section 11), and the outside tools that a team administrator connects (Section 13). For the personal data of its users processed through those features, the organization that holds the plan (the “customer”) is the controller and decides why and how that data is used; where that data passes through our servers, we process it on the customer’s behalf as its processor (Section 9, “Data processing agreement”). If you use Codelux through your employer or another organization, questions about that processing should be addressed to that organization first; we will assist it.

Processing is carried out in accordance with Regulation (EU) 2016/679 (GDPR) and D.Lgs. 196/2003 as amended. The competent supervisory authority is the Garante per la Protezione dei Dati Personali.

2. Data We Collect

Account Data

When you register: name, email address, and password (stored as a bcrypt hash — never in plain text).

Sign-In Providers

If you choose to sign in with Google, GitHub or Slack, we receive from that provider your email address (kept only if the provider confirms it is verified), your name as held by the provider, and the provider’s stable identifier of your account with it. See Section 10.

Organization Sign-In and Provisioning

If your organization sets up single sign-on (OpenID Connect or SAML) or SCIM user provisioning, we receive from its identity provider the email address, name and identifier it asserts for you and, through SCIM, the attributes it sends (your email address as user name, display name, given and family name, the organization’s own identifier for you, and whether you are active). We also keep the organization’s sign-in configuration, its email domains, its organization admins and an audit log of changes. See Section 11.

Usage & License Data

Session activity, license heartbeat data (one-way hash of hardware ID and binary hash for device enforcement), and build requests. No source code or project content is collected by or transmitted to our servers. The memories, notes, event timeline and file locks the App keeps for your projects, and the Claude Code plugin, work on your own machine (see Section 4); on Team projects, memories and timeline events are shared with your teammates only in encrypted form (see Section 9).

Project List

Your account keeps the list of your projects on our servers, so that your plan can be applied to it and the same list is available in the App and in the Console (codelux.ai/console). For each project we store the project name you chose, the local folder path of the project on your machine (for example /home/you/projects/shop — a path, which may contain your operating-system user name, never the files in it), an internal identifier, whether the project is enabled, and which project is currently active. On the free plan we also record, for each of your machines (identified by the one-way hardware hash described above) and App installation, the folder of the project activated on that machine and how many times it was changed that day. The project name and folder path are sent to our servers whenever you add, rename, move (change the folder of) or remove a project, from the App or from the Console. When the owner of a team renames a shared team project from their App, the new name replaces the project name stored for that team (see “Team Plan Data” below).

Payment Data

Billing is processed by Stripe. We store only a billing reference code — no card numbers, bank details, or financial data are retained on our servers.

Technical Data

IP address, browser type, and page visit timestamps — used solely for security monitoring and abuse prevention. Requests reach us through the Cloudflare network (see Section 7), which also derives the country of your connection (a two-letter country code) from your IP address; that country code is the only geographic information we record.

Team Plan Data

If you create or join a team (Team plan), we additionally process the metadata needed to run it: the team name and a stable team identifier; the membership list (the email address of each member, their role — owner, admin or member — their status — invited, active or removed — and the timestamps of invitation, acceptance and removal); the identifiers and display names of the projects the team shares; the hardware identifier of each machine on which a member uses a shared project and the local folder path that member declared for that project on that machine (so the App can find it again); the optional list of email domains to which the team’s invitations are restricted; the X25519 public key each installation registers so that a teammate can send it the team key in a sealed envelope; a log of invitation emails (address, sender, result, IP address, time); and a version number of the team key. We never receive, store or forward the team key itself, nor any project content: the shared memories, notes, journal, facts, code maps, timeline events, tasks, standup reports, Manager settings and chat that team members exchange (see also Section 12) reach our servers only as encrypted events — ciphertext we cannot read, together with the metadata needed to deliver and replay them (which team and project, which member authored it, when it was received, its size, the key version it was encrypted with, and a sequence number). See Section 9.

3. How We Use Your Data

Providing and managing your software license
Keeping your project list (project names and local folder paths) available in the App and the Console, and applying your plan to it
Authenticating your identity and enforcing single-device licensing
Letting you sign in with Google, GitHub or Slack, and linking those sign-in methods to your account at your request
Providing the single sign-on, SCIM provisioning and deprovisioning and organization-admin features that your organization configures, on its behalf
Sending service notifications (license expiry, security alerts)
Improving the software and detecting abuse
Complying with legal and fiscal obligations

We never sell, rent, or share your personal data with third parties for marketing purposes.

4. Data Kept on Your Machine — Memories, Timeline, File Locks and the Claude Code Plugin

Much of what the App does happens only on your computer, and the data it produces stays there. We do not receive it, except — for Team projects only — in the encrypted form described in Section 9.

Memories, notes and the event timeline

The App keeps, in a local database in the project’s .codelux folder or in the App’s data folder on your machine: the memories written by the AI agent you use (free-form structured text that the agent decides to record — for example what it did, decisions, facts linked to files and lines, next steps, code maps); the notes written by you or by the agent; and an event timeline recording who did what and when — memories and notes created, updated, closed or deleted (including the previous content of what was deleted), file edits made through the App or reported by the plugin, file locks taken, released or refused, git commits and branches, messages between agents, and projects added, renamed, moved or removed. Each event carries the name of the person, AI agent or App component that caused it. What an agent writes into a memory is decided by that agent and by you: do not let it record secrets or personal data you do not want kept with your project.

File semaphore between agents

When several AI agents work on the same project, the App lets one agent at a time write a given file (a lock per file, with an expiry). On a single machine the lock exists only inside the App on that machine. On a Team project the lock is also announced to your teammates through the realtime service, as described in Section 9 (the file path relative to the project, never the file contents).

The Claude Code plugin

If you install the Codelux plugin for Claude Code (or the equivalent hook scripts for other AI agents), it adds hooks — small scripts that the agent runs on your machine — at the start of each session, with each prompt you send, before and after each of the agent’s own file edits, and when the agent stops. These scripts talk only to the App running on your own computer (127.0.0.1): they fetch the relevant project memory for the agent’s context, take and release the file lock around each edit, and remind the agent to save a memory at the end. Your prompts are matched against the project memory locally and are not sent to us. The memory the hooks add to the agent’s context is then processed by the agent and by its AI provider (for example Anthropic, for Claude Code) like everything else in that context, under your own account and that provider’s terms; Codelux is not a party to that data flow.

The plugin also writes and keeps up to date a short block of project memory in the project’s AGENTS.md file (creating the file if it does not exist) and, if the project already has a CLAUDE.md file, in that file too. The block sits between the markers  and ; text outside the markers is never modified. These files are part of your project: if you commit and publish them, their content travels with your repository to wherever you publish it — that is your choice, not a transfer to us. See Article 2.5 of the Terms, which also explains how to disable the plugin.

AI usage and cost

The App can read the usage records that your AI coding agents already write on your computer — today the session transcripts of Claude Code, the session logs of Codex CLI and the chat files of Gemini CLI — to show you how much you use them and what that use is worth. From those files it takes only numbers and identifiers: token counts by type (input, output, cache), the model name, times, the session identifier, the project folder the agent was working in and the notices of a usage limit reached. It never keeps the content of your prompts, of the agent’s answers, of your code or of the agent’s tool calls: each record in those files is parsed for its numbers and discarded. It does not use your login to any AI provider and does not call any provider service to read your plan or your limits.

From these numbers the App keeps, on your machine: a record per session and day for 90 days, then only daily totals per tool, model, project and task (a task is matched through the memories on the project timeline); the plans you record for each tool with their monthly price; and a table of the providers’ list prices, used to show token volumes as an “API-equivalent” value — a measure of volume, not of the money you paid. A daily row on the project timeline records the day’s totals. Collection is on by default for your own view; you can turn it off, and delete everything collected, from the App at any time. Cursor and GitHub Copilot keep no usage on your computer: for them the App only knows the plan you or your administrator record. For Team projects, Section 12 explains who else sees your daily totals.

None of the data described in this section is sent to Codelux’s servers. It stays on your machine, under your control, and you can delete it at any time by removing the project’s Codelux data folder or the block in your files. For Team projects, Section 9 explains what is shared with your teammates and in what form, and Section 12 which AI usage totals reach the team’s owner and admins.

5. Anonymous Page-Flow Analytics

To understand which content on the Website is reached organically (e.g. from search engines) and how it performs — independent of the optional analytics described in the Cookie Policy — we record, for each request to a public content page, the path requested, an ephemeral session key derived from your IP address and browser type using a keyed hash that changes every day, the two-letter country code that our CDN (Cloudflare) derives from your IP address at the network edge, the domain name only of the website that linked to the page (for example “google.com” — never the full address of the linking page), or the campaign label of the link when there is no such website, and a coarse device class (“desktop”, “mobile” or “automated”) derived at the moment of the request from the headers your browser sends. The IP address and the browser identification string themselves are never stored with the record.

This key is never stored on your device (no cookie, no localStorage) and cannot be linked to the same key from a previous or later day, to your account, or to the analytics data described in the Cookie Policy. It exists only to tell two requests likely made moments apart by the same visitor apart from two unrelated requests, so that we can measure how long a page was viewed before the next request, and to count automated traffic (crawlers, scanners) separately from people. Raw records are kept for 14 days and then deleted automatically; only the resulting aggregate insight is used.

Legal basis: Legitimate interest (GDPR Art. 6(1)(f)) — basic, non-identifying audience measurement. Because nothing is stored on your device, this processing is not subject to the cookie-consent mechanism described in the Cookie Policy; it applies regardless of your cookie choices, on public content pages only (not on your account, checkout or Console pages).

6. Legal Basis (GDPR Art. 6)

Contract performance (Art. 6(1)(b)) — to deliver your license, authentication (including sign-in with a provider you choose), downloads and your project list
Legitimate interest (Art. 6(1)(f)) — for security monitoring (including the record of sign-ins and of changes to sign-in methods), fraud prevention, and anonymous audience-flow analytics (Section 5)
Processing on behalf of your organization (Art. 28) — for single sign-on, SCIM provisioning, organization admins and the Team plan data of an organization’s users, we act as processor and the legal basis is the organization’s own, as controller (Sections 9, 11 and 12)
Legal obligation (Art. 6(1)(c)) — for tax records and compliance (D.Lgs. 196/2003)
Consent (Art. 6(1)(a)) — for optional analytics and marketing communications (where applicable)

7. Third-Party Data Processors

Stripe (Payment Processing)

Stripe Inc. processes payment transactions. Data is transferred to the USA under Stripe's Standard Contractual Clauses (SCCs) approved by the European Commission. See Stripe Privacy Policy.

Dynadot (Email Hosting & Transactional Email)

Dynadot Inc. (USA) hosts our mailbox and delivers our transactional emails via SMTP — registration confirmations, one-time login codes (OTP), receipts and support correspondence. For this purpose your email address and the message content are processed by Dynadot as a data processor. This involves a transfer of personal data to the USA, safeguarded by the Standard Contractual Clauses approved by the European Commission. See Dynadot Privacy Policy.

Cloudflare (DNS, CDN & Reverse Proxy)

The Website is served through the network of Cloudflare, Inc. (USA), which provides DNS resolution, TLS termination, caching and protection against abusive traffic. Every request to the Website passes through Cloudflare's edge servers, which process your IP address, request headers and connection metadata for this purpose and pass on to us the country of your connection (see Sections 2 and 5). Cloudflare acts as a data processor under its Data Processing Addendum; transfers outside the EU are covered by the Standard Contractual Clauses and by Cloudflare's certification under the EU-US Data Privacy Framework. See Cloudflare Privacy Policy.

Kamatera (Hosting / Infrastructure Provider)

Our website and database run on a virtual private server supplied by Kamatera, Inc., acting as a data processor bound by a data processing agreement. Should we migrate infrastructure, the successor provider is bound by an equivalent agreement; an up-to-date list of processors is available on request at [email protected].

AI Providers

Codelux does not send your data to any AI provider. The AI agent you use alongside the App (for example Claude Code) and the provider behind it are chosen by you and process your data under your own account and their own terms; they are not our processors (see Section 4).

Sign-In Providers You Choose (Google, GitHub, Slack)

When you use one of these sign-in buttons, your browser is sent to the provider’s own page and you sign in there, under the provider’s terms and privacy policy; the provider then sends us the data described in Section 10. For your account with them these providers act as independent controllers; they are not our processors. We send them only what the sign-in protocol requires: our application’s identifiers, the address to return to and one-time security values.

Your Organization’s Identity Provider

An identity provider that your organization configures for single sign-on or SCIM (for example Okta, Microsoft Entra ID, Google Workspace, Auth0 or Keycloak) is chosen and contracted by your organization and works for it; it is not our processor (Section 11).

Tools Connected by a Team Administrator

Slack, work trackers and code hosts that a team owner or admin connects to the Manager are called from that administrator’s own App, with credentials that never reach our servers. They are the customer’s own service providers, not our sub-processors (Section 13).

Google Fonts (Administration Area Only)

The public pages of our website do not load any resources from Google's servers: fonts are declared locally with system-font fallbacks, and no request is made to fonts.googleapis.com when you browse the site. Only the internal administration area — accessible solely to the site administrator — loads the Inter font from Google Fonts; when that page loads, the administrator's IP address is transmitted to Google LLC (USA) as part of a standard HTTP request. This constitutes a transfer of personal data to a third country, covered by Google's SCCs and the EU-US Data Privacy Framework. See Google Privacy Policy. Ordinary visitors and account holders are not affected by this transfer.

8. Data Retention

Account data: retained while the account is active. Requesting deletion disables the account (see below) rather than erasing the record
Project list (project names, local folder paths, enabled/active flags): while the account is active; a project leaves the list, with its name and path, when you remove it. The free-plan record of the project activated on each machine is deleted when the account is deleted
Session, heartbeat and device online/offline logs: 30 days
Analytics page-visit pings: 90 days
Anonymous page-flow analytics (ephemeral session key): 14 days
Security & account activity events (registration, login and the sign-in method used, 2FA changes, sign-in methods linked or unlinked, plan changes): 12 months
Linked sign-in identities (provider, the provider’s identifier for you, email address, dates linked and last used): until you unlink them or your account is deleted
Sign-in requests in progress (random state and one-time security values, and the identity returned by the provider until your browser collects it): at most 10 minutes; deleted as soon as they are used
Organization single sign-on configuration, email domains and SCIM user records: for as long as the organization keeps them configured, and deleted together with the owner’s account; a domain is deleted when the owner removes it. When the organization deletes a user through SCIM, that user’s names and email address are erased at once; only a keyed one-way hash of the address, the organization’s identifier for the user and the dates are kept, for 30 days, so that the address stays blocked from signing in during that time (unless the organization provisions it again), and the record is then deleted
Organization admins: until the owner removes them, the admin steps down, or either account is deleted
Organization audit log (changes to single sign-on, domains, SCIM and organization admins, with the network the change came from — the IP address with its last part removed, IPv4 /24 and IPv6 /48, or the full address if the owner or an organization admin turns that on for security): 12 months by default; the owner or an organization admin can choose between 3 and 24 months. Older entries are deleted automatically, and the whole log is deleted together with the owner’s account
Team metadata (memberships, shared project identifiers, per-machine folder paths, machine public keys, key version): for as long as the team exists; a member’s per-machine paths and public keys are deleted when they leave or are removed, and everything about a team is deleted when the team is closed or its owner’s account is deleted
Encrypted team events (ciphertext + delivery metadata): for as long as the team exists; deleted when the team is closed. Realtime presence and file-lock metadata: while the session is open, at most 24 hours
Team invitation log: 12 months
Team email-domain rule: for as long as the team exists, or until the owner or an admin clears it
Billing records: 10 years (Italian fiscal law, D.P.R. 633/72)
Support emails: 2 years

After account deletion: we retain your email address and the one-way hash of your machine binding for abuse prevention — to detect repeated trial abuse, license circumvention, and fraudulent re-registration (legal basis: legitimate interest, GDPR Art. 6(1)(f); this data is not used for any other purpose). Concretely, the account record is kept in a disabled state: your name, password and two-factor settings are erased and every session is revoked, and your linked sign-in identities and organization-admin roles are deleted — and, if you own an organization, its single sign-on configuration and secrets, email domains, SCIM token and user records, organization admins, audit log and the sign-in identities linked to its identity provider are deleted too — while the email address, the licence history (including whether and when a free trial was used) and any billing records stay attached to that record. If you later register again with the same email address, that same account is reactivated with the details you provide — the free trial is not granted a second time, and previous invoices remain available in it. A disabled account can be removed permanently, on request or at our discretion, only once it holds no billing records that are still within the 10-year fiscal retention period. In addition, billing records are kept for the 10-year fiscal period stated above, and security & account activity events already recorded remain until their 12-month retention period expires, after which they are purged automatically.

9. Team Plan — Shared Projects and the Team Key

The Team plan lets several accounts work on the same projects. It is built so that your code, your shared notes and your shared memories never become readable by us. This section explains what that means in practice.

The team key is yours, not ours

When a team is created, the App of the person creating it generates a random encryption key on that machine. That key is shown to the team owner as a recovery phrase and is handed to the other members by the team itself (in person, over a channel of your choice, or machine-to-machine in a sealed envelope that our servers relay but cannot open). The key never reaches our servers. We only record its version number, so that the App knows which key a given event was encrypted with.

Keep the key safe and never lose it: if it is lost, the team’s shared data can no longer be read — not by you, not by us. We have no copy, no escrow and no way to recover it. Every active member holds a copy, so one member who still has it is enough; if nobody has it, the encrypted events stored on our servers are permanently unreadable. Rotating the key (for example after removing a member) is done by the owner’s App and produces a new version; earlier versions stay on the members’ machines so older events remain readable to them.

What our servers store

For each team we keep only: the encrypted events (ciphertext) and the metadata needed to deliver and replay them — team, project, author, time received, size, key version, sequence number — plus the membership, project and per-machine data listed in Section 2 (“Team Plan Data”). The memories written by AI agents and the timeline events described in Section 4 travel the same way as notes and code maps: on a Team project they are sealed on the author’s machine with the team key and reach our servers only as encrypted events, with the same metadata and nothing more (author, time received, size, key version, sequence number). File-lock and presence information used to prevent two people or agents editing the same file at once is processed in clear (it contains a file path relative to the project, never file contents) and is not retained beyond the session. We do not know whether an event is a note, a memory, a timeline entry or a chat message, what it says, or which file it refers to. The display name of a shared project is stored in clear; when the owner renames the project from their App, the new name replaces the old one on our servers. The tasks, standup reports and Manager settings described in Section 12 travel in the same encrypted form. The optional list of email domains to which a team’s invitations are restricted is stored in clear, because our servers enforce it when an invitation is sent.

Direct messages and groups inside a team

The team chat offers direct messages between two members and groups created by the owner or an admin. These are separate channels, not private conversations: every message is encrypted with the same team key that every member holds, and every member’s App receives every event. A direct message is therefore hidden from other members only by the App’s interface, and the team owner or any member could read it from their own machine. Do not use them for anything you would not say in the team channel. The App shows this notice on every direct-message and group conversation.

Retention and deletion

Team data is kept for as long as the team exists (see Section 8 for the exact periods). When a member leaves or is removed, their per-machine folder paths and machine public keys are deleted at once. When a team is closed by its owner, or the owner’s account is deleted, every encrypted event and all team metadata are deleted from our servers; whatever each member already has on their own machine stays there and remains theirs.

Responsibilities

The team owner is the person who buys the plan and decides who is in the team, with which role, and which projects are shared. Members join with their own personal account and can leave at any time from the App or the Console. Each member is responsible for keeping the team key safe on their machines and for not sharing it outside the team.

Data processing agreement

Where you use the Team plan as an organisation and the shared data includes personal data of third parties for which you are the controller, we act as a processor for the encrypted events and the team metadata described above and, where your organization uses them, for the single sign-on, SCIM and organization-admin data described in Section 11. A data processing agreement under GDPR Art. 28 is available on request at [email protected].

Deleting a team — what goes and what stays

The team owner can delete a team at any time from the Console. When they do, everything this team has on our servers is erased immediately, on request and without waiting for any retention period: the encrypted events, the delivery cursors, the presence and lock records, the log of team-key requests, the per-machine folder paths and the pending invitations. The erasure of the encrypted events is carried out by the realtime service within seconds of the request.

The copies on the machines stay. Deleting a team does not reach into anyone’s computer: the shared memories, notes, journal, timeline and chat that were already synchronised remain in the local databases of every member, together with the team key, and remain readable to them. We have no way to remove them and we do not attempt to.

One record survives the deletion: a history entry in the owner’s Console holding the team name, its identifier, the date it was closed and the version number of its key. It exists so the owner can reopen the team later, and it is kept until the owner deletes it. Deleting the history entry requires the owner’s account password and removes every remaining row about that team from our servers; it cannot be undone and the team cannot be reopened afterwards. Here too, the local copies are untouched.

10. Signing In with Google, GitHub or Slack

Besides your email address and password, you can sign in to the Website, the Console and the App’s browser sign-in page with an account you already have at Google, GitHub or Slack. Using a provider is optional; a provider’s button is shown only while that provider is available.

What we receive from the provider

You sign in on the provider’s own page, never on ours, and we never see your password there. The provider then returns to us, and we keep:

your email address, only if the provider confirms that it is verified — for GitHub, your verified primary address;
your name as held by the provider;
the provider’s stable identifier of your account with it (the “subject”).

We ask only for the basic permissions needed for this (“openid email profile”; for GitHub, read access to your profile and your email addresses). Any access token issued by the provider is used only during that sign-in, to read those details, and is not stored. We do not read or publish anything else in your account at the provider.

What we do with it

We store the link between your Codelux account and the provider account — provider, identifier, email address, the date it was linked and the date it was last used — so that the provider can sign you in next time. If no Codelux account uses that verified address, you can create one from the provider sign-in: you still accept the Terms, the provider’s name becomes your account name, and the account has no password until you set one. If an account with that address already exists, it is linked only after you enter the one-time code we email to that address, or when you start the link yourself from the Console while signed in. At sign-in, the provider’s authentication takes the place of our email code. Sign-ins with a provider, and every link or unlink, are recorded among the security events of Section 8.

The purpose is solely to authenticate you and keep your account secure. Legal basis: performance of the contract (GDPR Art. 6(1)(b)), because you ask us to let you sign in this way; the security record is based on our legitimate interest in protecting accounts (Art. 6(1)(f)).

How to unlink a provider

In Console → Account → Sign-in methods (codelux.ai/console) you can see every linked provider and unlink any of them at any time; the link record is then deleted from our servers. So that you are never locked out, the last remaining way to sign in cannot be unlinked: set a password or link another provider first. Unlinking does not change anything at the provider; you can also withdraw Codelux’s access from your account settings there. Deleting your Codelux account deletes all of its linked identities.

A sign-in with a provider uses the short-lived clx_sib cookie described in the Cookie Policy.

11. Organization Sign-In — Single Sign-On (OIDC, SAML) and SCIM Provisioning

The owner of a Team or Enterprise plan and the organization admins the owner appoints can set up, from the Console: sign-in through the organization’s own identity provider (single sign-on with OpenID Connect or SAML 2.0), its verified email domains, and automatic user provisioning and deprovisioning through SCIM 2.0; only the owner appoints and removes organization admins. In this section, the “organization” is that owner’s account and the customer it represents.

The organization is the controller

For the identity data of its users, the customer organization is the controller: it decides who has an identity, which attributes its identity provider sends us, whether single sign-on is required, and when a user is deactivated. We process that data on its behalf and on its instructions, as its processor, only to sign those users in, to keep their access to the organization’s teams in line with its identity provider, and to secure the service (see Section 9, “Data processing agreement”). Users who sign in through their organization should address questions about that data to the organization; we will assist it.

What we store

Configuration entered by the owner or an organization admin: the protocol; for OpenID Connect, the identity provider’s address (issuer) and the client identifier and client secret registered with it — the secret is stored encrypted; for SAML, the identity provider’s entity identifier, sign-in address, signing certificate and, if given, metadata address; the on/off and “require single sign-on” switches; and the time and result of the last connection test.
Email domains claimed by the organization, with their verification value and status. A domain is used only once it is verified, through a DNS TXT record or because it is the domain of the owner’s own confirmed address; the domain of a public email service cannot be claimed.
Sign-ins through the organization’s identity provider: the same link record as in Section 10 (the identity provider’s identifier for the user, their email address, dates), and the name it asserts when a new account is created. Only addresses within the organization’s verified domains are accepted.
SCIM user records sent by the identity provider: email address (as user name), display name, given and family name, the provider’s own identifier for the user, active or deactivated, and dates. A SCIM record is not an account and adds nobody to any team: joining a team remains the admins’ decision.
The SCIM access token: shown once, to the owner or organization admin who generates it, and stored only as a one-way hash, with its last four characters and the dates it was created and last used; the owner or an organization admin can replace or revoke it at any time.
Organization admins appointed by the owner (who, and since when). They act as admins on all the owner’s teams and can also set up the organization’s single sign-on, email domains and SCIM, but cannot change roles, close or delete teams, change billing, or appoint other organization admins.
An organization audit log of changes to these settings, to the domains, to organization admins and of SCIM actions: who, what, on which address or domain, when, and from which network — the IP address with its last part removed (IPv4 /24, IPv6 /48); the full address only if the owner or an organization admin turns that on for security. It is kept 12 months by default, or between 3 and 24 months as the owner or an organization admin chooses (Section 8).

Automatic deprovisioning

When the organization’s identity provider deactivates or deletes a user through SCIM, that person is, at once and automatically: removed from every team the organization owns, exactly as if an admin had removed them (their per-machine folder paths for those teams are deleted); a rotation of the team key is requested from the owner’s App for each team they were an active member of; every web session and every App sign-in of their account is revoked; and every further sign-in with that address, by any method, is refused until the organization reactivates it. When the organization deletes the user (rather than deactivating them), their names and email address are erased from our records at once and only a keyed one-way hash of the address is kept, for 30 days, to keep refusing those sign-ins (Section 8). Reactivation restores the ability to sign in only — team memberships are not restored. The organization’s owner cannot be deprovisioned through SCIM. Deprovisioning does not reach data already on the person’s own machines (see Section 9).

Required single sign-on

If the organization turns on “require single sign-on”, addresses in its verified domains can sign in only through its identity provider; password and provider sign-ins are refused for them. The owner’s own account keeps every method, as emergency access.

Legal basis: the organization’s own, as controller; our processing is governed by the data processing agreement (Section 9). SAML sign-in is handled on our server with the open source libraries listed in the Open Source tab.

12. Team Manager — Tasks, Standup Reports and Exports

On Team projects, the App gives the team owner and admins a Manager: a list of tasks, a board and a timeline chart (Gantt), daily standup reports per member, the list of the project’s members, and downloads of a member’s work and of the team’s audit package. All of this is produced and kept by the App on the users’ own machines; between teammates it travels only as encrypted team events (Section 9). We cannot read tasks, reports or exports and do not receive them in any other form.

What the Manager processes

Tasks: key, title, description, assignee (email address), start and due dates, status, planned, proposed and confirmed completion percentages, checklist, labels, author and dates, with the history of their changes; for a task imported from a connected tool, its reference and link there (Section 13).
Standup reports: one per member per day, generated when an owner or admin asks for them, from the project timeline only — memories and checkpoints recorded by the member’s AI agents, to-dos closed, file edits, file locks and tasks moved. A report lists what was done, what is next, blockers, the agents used and the tasks touched, with a proposed completion percentage that the owner or admin may confirm. Chat messages are never used. Reports are built by fixed rules, without any AI.
Members: role, status and email address of each member, the AI agents seen on the timeline and the time of their last activity.
Per-member export (owner and admins only): a file with what one member produced on the project, as held by the requester’s machine — timeline events, memories, notes, checkpoints, code maps, locks and that member’s standup reports. No chat. Each such export is itself recorded on the timeline.
Team audit export (owner and admins only): members, projects and, for each project, the full timeline, memories, notes, code maps, checkpoints and lock history, as held by the requester’s machine. No chat message and no chat group is included. Each download is recorded on the timeline and is visible to the teammates.
AI usage and cost: for each member, the daily totals of their AI agents’ usage on the team’s projects — tokens by type, tool, model, task, number of sessions and replies, usage-limit notices and their value at the providers’ list prices — together with the plan the owner or an admin records for each member and tool (name and monthly price) and a monthly budget per project. The totals are computed on the member’s own machine from the records described in Section 4 and sent by it; no prompt, answer or code is part of them. They are included in the per-member and team audit exports.
Timeline export (any user): the timeline of a project as a JSON or CSV file, from the requester’s own machine.

Who sees what

The owner and admins see every member’s tasks and standup reports. A member sees their own tasks, the team’s plan read-only, and their own standup reports — never another member’s. Unlike direct messages (Section 9), this separation is enforced by encryption: each report is encrypted for the devices of the owner, the admins, the organization admins and the member it concerns, and no other member can decrypt it. A newly appointed admin can read the reports generated before the appointment only once another admin shares them again. A member’s daily AI usage totals are separated the same way: encrypted for the devices of the owner, the admins, the organization admins and the member, and unreadable by the other members; each member sees their own usage in the App, with a notice of who else sees it, and can turn the collection off or delete what was collected, which also withdraws the copies shared with the team. Reports generated with earlier versions of the App were encrypted with the team key that every member holds; the App of the other members discards them on arrival.

The customer is the employer and the controller

The Manager is a tool that the customer — the organization holding the Team or Enterprise plan — uses about its own people. For the tasks, reports and exports concerning its members, the customer is the controller and, where members are its workers, their employer; it decides whether and how to use them. We do not determine those purposes and have no access to that content. The customer is responsible for:

informing its members, before use, that the activity of their AI agents on shared projects is recorded on the timeline and may be summarised in standup reports, measured as AI usage and cost and exported, and of the purposes and retention it applies (GDPR Arts. 13 and 14);
complying with the law on the monitoring of workers that applies to it — in Italy, Article 4 of Law No. 300/1970 (Statuto dei Lavoratori) and the agreements, authorisations and information it requires, together with GDPR Article 88 and the national rules adopted under it — and with any works-council or collective-agreement requirement;
using this information to follow the progress of work, and never as the sole basis for evaluating people: reports are built from what AI agents recorded and can be incomplete or wrong, and any decision about a person must rest on a human assessment to which that person can respond.

The Manager shows work progress. It is not designed or offered as a tool for assessing the performance or conduct of individuals. See Article 2.16 of the Terms.

13. Connected Tools and Slack — Chosen by Your Administrator

A team owner or admin can connect the Manager to outside services: a Slack channel, through an incoming webhook, which receives confirmed standup lines, completed tasks and, if chosen, refused file locks; and work trackers and code hosts — the App lists Jira Cloud, Linear, Asana, Azure DevOps Boards and GitHub Projects/Issues, each usable only once the App makes that connection available. Signing in with Slack (Section 10) is separate and does not connect a channel.

How the data travels

Every connection runs from the administrator’s own App, with the webhook address or access token that the administrator enters. That secret is stored encrypted on the administrator’s machine; it is never sent to Codelux’s servers and never shared with the other members. Our servers never receive these tokens, nor the data exchanged with those services.
What goes out: to Slack, the text of the messages above, which can include members’ names or email addresses, task keys and titles, completion percentages and, for a refused lock, the file path and who held it; to a work tracker, only when the administrator clicks “Confirm” or “Send”, a comment with the confirmed standup lines and percentages and, where the tool supports it, a status change. Never source code, never the content of memories.
What comes in: from a work tracker, its issues as tasks (key, title, description, assignee email, dates, status, checklist, link).

Whose providers they are

These services are chosen, contracted and configured by the customer. For this data they are the customer’s own providers, not our sub-processors, and their handling of the data is governed by the customer’s agreement with them. The customer decides what is sent, and is responsible for having a lawful basis to send it and for informing its members. Clearing the webhook address or token in the App stops the flow from that moment; what was already sent stays with the third party.

14. Your Rights (GDPR Art. 15–22)

You have the right to:

Access (Art. 15) — obtain a copy of your personal data in machine-readable format (JSON export available on request)
Rectification (Art. 16) — correct inaccurate or incomplete data
Erasure (Art. 17) — request deletion ("right to be forgotten") — subject to legal retention obligations
Restriction (Art. 18) — limit how we process your data in certain circumstances
Portability (Art. 20) — receive your data in a structured, machine-readable format
Objection (Art. 21) — object to processing based on legitimate interest
Withdraw consent — at any time, without affecting the lawfulness of prior processing

To exercise any right, email [email protected] with subject "GDPR Request". We respond within 30 days as required by law.

Where your data is processed on behalf of your organization (Sections 9, 11, 12 and 13), the organization is the controller: you may exercise your rights with it, and we will assist it in answering. You may also write to us, and we will forward your request to the organization where it is the one that decides.

You may also lodge a complaint with the Italian supervisory authority:
Garante per la Protezione dei Dati Personali — garanteprivacy.it

15. Codelux Hub (Version 4.0) — Applies Only Once the Hub Is Available

Not yet in effect. This section describes the Codelux hub planned for version 4.0. It applies only from the day the hub is made available to your organization, and only if your organization uses it. Until then, Sections 1–14 describe the service in full.

With version 4.0, the team service that today runs on our servers (Section 9) becomes a program, the Codelux hub, which an organization with the corresponding plan can use in one of two ways.

Internal hub on the customer’s own server

The customer installs and runs the hub on a server it controls. The customer is then both the controller and the host of the team data the hub keeps — events, memories, timeline, tasks, reports, repository data, and the configuration and credentials of the tools connected to it — and decides how it is stored, who can access it, how it is backed up and how long it is kept. That data does not reach us. We receive from the hub only licence and health data: the licence and organization it is registered to, the seats in use, the hub’s version and its operating status. Account, sign-in and billing data remain with us as described in this Policy.

Hosted hub run by Codelux

If the customer uses the hub that we host, team events are stored on our servers encrypted, as described in Section 9: we hold only ciphertext and its delivery metadata, never the team key, and the tokens of connected tools stay in the administrator’s App (Section 13). This encrypted archive is kept for the whole subscription plus 30 days after it ends, and is then deleted. Closing or deleting a team earlier still erases its data at once (Section 9).

Privacy questions? Email [email protected] — we respond within 2 business days.

A) Website (codelux.ai)

B) Codelux App (the Software)

C) Codelux Hub (version 4.0, not yet in effect)

A) Website (codelux.ai)

1.1 Acceptance of Website Terms

By accessing or browsing codelux.ai (the "Website"), you agree to be bound by this Section A. If you do not agree, do not use the Website. These Terms constitute a legally binding agreement between you and the operator of codelux.ai ("Codelux", "we", "us"), a sole proprietor whose service-provider and data-controller identifying particulars are set out in section 16 ("Service Details") at the foot of the Privacy tab, and are displayed there on request.

Section B of these Terms governs the Codelux desktop application and licensed software (the "App") and applies in addition to this Section A once you download, install, or use the App.

1.2 Description of Website Services

The Website provides: (i) marketing and product information; (ii) the account Console (codelux.ai/console) for license and billing management; (iii) authentication for downloading the App, including sign-in with an external provider you choose and, where your organization has set them up, single sign-on and SCIM user provisioning (Article 2.15); and (iv) documentation and support resources. The Website does not itself index, store, or process your source code — see Articles 2.5 and 2.12 and the Privacy Policy for how the App handles your data.

1.3 Permitted Use of the Website

You may use the Website only for lawful purposes and in accordance with these Terms. You must not:

Use the Website for any illegal activity or in violation of any applicable law or regulation;
Attempt to gain unauthorized access to any account, server, or data on the Website;
Engage in automated scraping, crawling, or flooding of the Website or its APIs beyond normal usage;
Introduce malware, or interfere with the security, integrity, or performance of the Website.

1.4 User Accounts & Registration

You must provide accurate registration information and keep your credentials confidential. You are responsible for all activity that occurs under your account. Sharing your account credentials with third parties is strictly prohibited and may result in suspension or termination of your account.

If you sign in with Google, GitHub or Slack, you are also responsible for the security of that provider account, which is governed by the provider’s own terms; you can unlink it from the Console as described in the Privacy Policy (Section 10). If your email address belongs to an organization that manages sign-in for its domain, that organization may require you to sign in through its identity provider and may deactivate your access (Article 2.15).

1.5 Website Intellectual Property

All Website content — text, graphics, logos, and branding of codelux.ai — is the exclusive property of Codelux or its licensors. No license to this intellectual property is granted beyond the right to view and use the Website as described herein.

1.6 Website Availability & Changes

We do not guarantee uninterrupted or error-free availability of the Website and may modify, suspend, or discontinue any part of it at any time. We may update the content and structure of the Website without prior notice, except where prior notice is required by Article 2.11 for changes to the substantive Terms. Permanent discontinuation of the online services on which the App depends is governed by Article 2.13, including its notice and refund commitments.

B) Codelux App (the Software)

2.1 License Grant & Tiers

Subject to your compliance with these Terms and payment of applicable fees, Codelux grants you a limited, non-exclusive, non-transferable, revocable license to install and use the Codelux desktop agent (the "App") under one of the following tiers. Every tier includes the full engine and the project-memory features — memories, notes, the event timeline, the file semaphore between agents and the plugin described in Article 2.5; these features are not sold as a separate add-on. The tiers differ only in how many of your projects may be active at the same time.

Free

Free of charge, for one registered user on one device at a time, with one project. Changing the project folder is limited as shown in the App. Includes the full engine and the project-memory features; updates are included, support is best effort.

Multi

Licensed for use by one registered user, on one device at a time, with any number of projects active simultaneously. Includes the full engine, the project-memory features, updates and support.

Team

Licensed per seat: each seat is one registered user, on one device at a time, with any number of projects. Adds projects shared with the other members of the team: memories, notes, code maps, timeline events and chat shared end-to-end encrypted, and the file semaphore across machines (Article 2.14). The team owner manages members and shared projects; the owner and admins also have the Manager (Article 2.16).

Enterprise

Custom terms agreed in writing with Codelux; where they differ, the written agreement prevails over these Terms.

Licenses are personal and non-transferable. Sharing your binary, credentials, or device token with third parties is strictly prohibited and will result in immediate license revocation without refund.

2.2 Right of Withdrawal (Consumers — EU Directive 2011/83/EU)

If you are purchasing as a consumer (an individual not acting for professional or business purposes), you have the right to withdraw from the purchase contract within 14 days of the date of purchase, without giving any reason.

Waiver of withdrawal right for immediate digital content:
By requesting immediate access to the Codelux download after purchase (i.e. clicking "Download" before the 14-day period expires), you expressly acknowledge that you have requested the immediate performance of the service and that you lose your right of withdrawal once the download begins, in accordance with Art. 59(1)(l) of EU Directive 2011/83/EU as implemented by D.Lgs. 21/2014 (Art. 59 Codice del Consumo).

If you do not download the software within 14 days of purchase, you may exercise your right of withdrawal by emailing [email protected] with subject "WITHDRAWAL — [your order reference]". Refunds are processed within 14 days via the original payment method.

Business customers (B2B) do not have the statutory right of withdrawal.

2.3 Billing, Renewals & Cancellation

Licenses are sold as annual subscriptions, renewed automatically unless cancelled. Payment is processed via Stripe. The renewal charge is applied to the payment method on file at the price displayed at time of purchase.

How to cancel auto-renewal

Log in to codelux.ai
Go to Console → Billing → Plans → Manage card and renewal and turn the renewal off
Or email [email protected] at least 7 days before the renewal date

Upon cancellation, your license remains active until the current period ends. No refunds are issued for unused time within a billing period, unless required by applicable consumer law.

2.4 Restrictions & Anti-Tampering

You must not, and must not permit any third party to:

Reverse engineer, decompile, or disassemble the binary, except to the extent such restriction is expressly prohibited by applicable mandatory law;
Redistribute, resell, or sublicense the software or your license;
Use the App for illegal activities, or to build a competing product;
Attempt to circumvent, disable, or tamper with license enforcement, device binding, or usage-limitation mechanisms;
Engage in automated scraping or flooding of our APIs beyond normal usage;
Share your account credentials, binary, or device token with third parties.

Consequences of tampering or circumvention: any attempt to reverse-engineer, decompile, bypass, or otherwise tamper with license enforcement or device-binding mechanisms immediately voids your license without refund and constitutes a material breach of these Terms. You agree to indemnify Codelux for any resulting loss, in accordance with Article 2.9.

2.5 Local Agent Integration — Claude Code Plugin, Hooks and Repository Files

What the plugin does

The App can be used together with an AI coding agent that you choose and run yourself (for example Claude Code). For Claude Code, Codelux offers an optional plugin (and equivalent hook scripts for other agents) that installs hooks: commands that the agent runs on your machine at the start of each session, with each prompt, before and after each of the agent’s own file edits, and when it stops. The hooks communicate only with the App running on your own computer (127.0.0.1). They add relevant project memory to the agent’s context, take and release the file lock around the agent’s edits — and may therefore make the agent wait, or refuse an edit, while another agent holds that file — and remind the agent to save a memory at the end of its work.

Changes to your repository files

The plugin writes and updates a block of project memory in the AGENTS.md file at the root of your project, creating that file if it does not exist, and, if a CLAUDE.md file already exists there, in that file as well. The block is delimited by the markers  and  and is rewritten as the project memory changes; the plugin never modifies text outside those markers. By installing the plugin you accept that these files are modified on your machine. You remain responsible for your repository: for reviewing these files before you commit or publish them, for the content that the AI agent wrote into the project memory and that appears in the block, and for keeping secrets and confidential information out of it.

How to disable it

The plugin is optional and the App works without it. You can stop it at any time by uninstalling or disabling the plugin in your AI agent, or by removing the Codelux hooks from the agent’s configuration. Removing the plugin does not delete a block already written: you can delete the block, markers included, or the AGENTS.md file if the plugin created it.

Your AI agent is a separate product

The AI agent you run, and the AI provider behind it, are not part of the App and are not provided by Codelux; they act on your instructions and under your own agreement with their provider, including on the project memory the hooks place in their context. You are responsible for the agent’s actions on your files and systems, for the permissions you grant it, and for ensuring that your use of AI systems complies with the laws applicable to you (including, where relevant, Regulation (EU) 2024/1689, the “EU AI Act”). The file lock and the project memory are aids to coordination: they do not guarantee that an agent will not make an unwanted change, and they do not replace your own review.

Data handling

The hooks, the memories, the event timeline and the file locks operate locally on your machine, as described in Article 2.12 and in the Privacy Policy (Section 4). On Team projects, memories and timeline events are shared with your teammates only in encrypted form, as described in Article 2.14. Nothing in this Article limits or contradicts the Privacy Policy.

2.6 Software Intellectual Property

All source code, binaries, documentation, and branding of the App are the exclusive property of Codelux. No license to our intellectual property is granted beyond the right to use the App as described herein.

Your own source code indexed or modified by the App remains your property at all times. It is not stored or analyzed on our servers, and it is not transmitted to them. The same applies to the memories, notes, event timeline, tasks and standup reports the App keeps for your projects and to the block written in your project files under Article 2.5.

The App incorporates open source components. Their licenses are listed in the tab.

2.7 Warranty Disclaimer

The App and the Website are provided "as is" and "as available", without warranties of any kind, whether express or implied, including — to the fullest extent permitted by applicable law — implied warranties of merchantability, fitness for a particular purpose, and non-infringement. We do not warrant that the App will be uninterrupted, error-free, or that any AI-generated output or AI-executed action will be accurate, complete, or fit for your purposes.

Nothing in this Article excludes or limits any warranty that cannot lawfully be excluded, including statutory guarantees available to consumers under mandatory applicable law.

2.8 Limitation of Liability

To the maximum extent permitted by applicable law, Codelux shall not be liable for:

Indirect, incidental, special, consequential, or punitive damages;
Loss of data, profits, revenue, or business opportunities;
Damages arising from third-party AI providers or models that you connect to or use through the App (e.g. Claude, OpenAI, or other AI services), which are subject to those providers' own terms;
Any command executed, file modified, or other action taken by an AI agent that you run alongside the App, and the consequences of committing, publishing or relying on the project-memory block written in your project files, as described in Article 2.5;
Service interruptions due to force majeure, infrastructure failures, or third-party dependencies.

Where liability cannot be excluded, our maximum aggregate liability arising out of or in connection with these Terms shall not exceed the total amount paid by you to Codelux in the 12 months preceding the event giving rise to the claim.

Non-excludable liability. Nothing in these Terms excludes or limits liability for death or personal injury caused by our negligence, for fraud or fraudulent misrepresentation, for wilful misconduct, or for any other liability that cannot be excluded or limited under mandatory applicable law — including the statutory rights of consumers, which remain unaffected. This carve-out is what allows the remaining limitations in this Article to be given effect.

2.9 Indemnification

You agree to indemnify, defend, and hold harmless Codelux from and against any claims, liabilities, damages, losses, and expenses, including reasonable legal fees, arising out of or in any way connected with: (i) your misuse of the App or the Website; (ii) your tampering with, reverse engineering of, or circumvention of license enforcement or device-binding mechanisms as described in Article 2.4; (iii) any command executed or file change made by an AI agent that you run alongside the App, or any content you commit or publish from the project files described in Article 2.5; (iv) your use, as a team owner, admin or organization, of the Manager’s tasks, standup reports and exports concerning other people, of single sign-on and SCIM, and of the third-party tools you connect, including any failure to inform the people concerned or to comply with employment and worker-monitoring law (Articles 2.15, 2.16 and 2.17); or (v) your violation of these Terms or of any applicable law. This indemnification obligation does not apply to the extent a claim arises from Codelux's own negligence, fraud, or wilful misconduct, or from liability that cannot lawfully be excluded, consistent with Article 2.8.

2.10 Governing Law & Jurisdiction

Business customers (B2B)

These Terms are governed by Italian law. Any disputes shall be subject to the exclusive jurisdiction of the Court of Treviso, Italy.

Consumer customers (B2C)

If you are a consumer, you benefit from the mandatory consumer protection provisions of the law of the country where you are habitually resident. Nothing in these Terms affects your statutory rights. Jurisdiction for consumer disputes follows the mandatory rules of EU Regulation 1215/2012 (Brussels I bis), which may give you the right to bring proceedings in your country of residence.

For consumer disputes, we encourage use of the EU ODR platform: ec.europa.eu/consumers/odr

2.11 Changes to These Terms

Codelux may update these Terms from time to time. When we make a material change to the legal terms, we will notify you through both the App and the Console.

Because your use of the software is conditioned on your agreement to the current Terms, a material change will require you to accept the updated Terms again — through the same consent and approval step used on first use — before you can continue to use the App and the Console. Until you accept the updated Terms, the App's commands (whether issued via MCP, the CLI, or the HTTP/REST API) and interaction with the user interface are suspended; the passive local indexing and data-collection functions described in Article 2.12 may continue, as they do not require acceptance.

If you do not wish to accept the updated Terms, you may withdraw or decline your acceptance at any time via App → Account → (disable acceptance) or Console → Account → Legal & data → Withdraw consent. Declining stops the App and the Console from being used until the then-current Terms are accepted, but it does not by itself cancel your paid licence; your billing and cancellation rights continue to be governed by Article 2.3, and your consumer right of withdrawal under Article 2.2 and your statutory rights under Article 2.10 are unaffected.

Non-material changes — such as clarifications, formatting, or corrections that do not reduce your rights or increase your obligations — may be made without requiring re-acceptance, and take effect when published. This Article operates consistently with the activation-consent provisions of Article 2.12.

2.12 Local Operation, Data Residency & Activation Consent

While running, the App performs passive functions of indexing and local data collection that reside entirely on your own computer. Such indexing and collected data are stored and processed locally on your machine and are not transmitted to, or accessible by, Codelux's systems; the only outbound traffic generated by this passive operation is the license-verification heartbeat described in the Privacy Policy (Section "Usage & License Data"). Nothing in this Article limits or contradicts that Privacy Policy, and it should be read together with the plugin and data-handling provisions of Article 2.5.

On execution, the App's operation consists of this local-only indexing and collection on your device: no source code or project content leaves your machine as a result of this passive activity. The same applies to the memories, notes, event timeline and file locks the App keeps for your projects and to the hooks of the plugin described in Article 2.5: they run and are stored on your machine, and on Team projects memories and timeline events are shared with your teammates only in encrypted form under Article 2.14. The App itself does not send your project content to any AI provider; what an AI agent that you run reads from your project and sends to its own provider is governed by your agreement with that provider, as described in Article 2.5. Adding, renaming, moving or removing a project sends the project’s name and local folder path to Codelux’s servers, which keep your project list, as described in the Privacy Policy (Section 2, “Project List”); the contents of the folder are never sent.

Activation of the App under these Terms is subject to acceptance. On first use, the App and the Console will present a notice or message requiring you to accept these Terms before the App is activated.

The passive local indexing and data collection described above may run without such acceptance. However, the App's commands — whether issued via MCP, the CLI, or the HTTP/REST API — and any interaction with the user interface become available only once these Terms have been accepted, and, following any material change to these Terms, only once the updated Terms have been accepted again, consistent with Article 2.11.

2.13 Service Availability, Continuity & Discontinuation

The Online Services

The App works together with online services operated by Codelux: license validation and heartbeat, the account and billing Console (codelux.ai/console), App downloads and updates, the project list, sign-in with external providers, single sign-on and SCIM provisioning, and the realtime service used by the Team plan (together, the "Online Services"). The Online Services are provided for the duration of your subscription period, as part of your license under Article 2.1 and your billing terms under Article 2.3.

Dependency on the Online Services

To enforce licensing, the App periodically validates your license against our servers. The App tolerates temporary loss of connectivity through an offline grace window (currently up to 24 hours from the last successful validation). We are transparent about the consequence: if the App cannot reach the Online Services beyond the grace window — including because the Online Services have been suspended or permanently discontinued — the App's licensed functions stop working until validation succeeds again. The passive local data described below is not deleted by this.

Modification, suspension and discontinuation

We may modify or suspend parts of the Online Services for maintenance, security, or legal reasons, restoring availability as soon as reasonably practicable. We may also decide to permanently discontinue the Online Services or the service as a whole. If we permanently discontinue the Online Services, we commit to the following:

Reasonable advance notice: at least 60 days before the discontinuation date, announced on the Website and sent to the email address associated with your account;
No further charges: auto-renewal is stopped for all subscriptions and no further amounts are charged;
Pro-rata refund: for any paid subscription period that extends beyond the discontinuation date, we refund the pro-rata portion of the fee corresponding to the paid period you can no longer use, via the original payment method; and
Reduced server dependency where feasible: we will use commercially reasonable efforts — this is a best-effort commitment, not a guarantee — to release a final App update that reduces or removes the App's dependency on the Online Services, to the extent technically feasible and lawful.

What remains yours

Discontinuation concerns the Online Services. The App binary installed on your machine, your source code, your local index, the memories, notes and event timeline of your projects, and all other data the App stores locally remain on your device and remain yours, consistent with Article 2.6 and Article 2.12. We never take possession of them and their availability on your machine is not affected by the shutdown of our servers, even where the App's licensed functions can no longer be activated.

Liability for discontinuation

To the maximum extent permitted by applicable law, and provided we have complied with the notice and refund commitments of this Article, Codelux shall not be liable for indirect, incidental, or consequential damages arising from the modification, suspension, or permanent discontinuation of the Online Services, consistent with Article 2.8. Nothing in this Article excludes or limits the liability described in the "Non-excludable liability" provision of Article 2.8 — including liability for fraud, wilful misconduct, or gross negligence — and nothing in it affects your statutory rights as a consumer, your right of withdrawal under Article 2.2, or your cancellation rights under Article 2.3.

2.14 Team Plan — Shared Projects, Members and the Team Key

Scope

This Article applies when you purchase the Team plan or join a team created by another customer. The Team plan is a per-seat, yearly subscription of the team owner under Article 2.3; the number of seats limits how many distinct accounts (the owner included) may be members of the teams that owner creates. Members join with their own personal account and, on the team’s shared projects, are covered by the owner’s license rather than their own plan; on their own projects their own plan applies.

The team key

Shared team data (memories, notes, journal, facts, code maps, timeline events, chat) is encrypted on your machines with a key that the App generates on the owner’s machine and that the team distributes among its members. Codelux never receives the team key and cannot recover it. You acknowledge and accept that if the key is lost by every member of the team, the shared data stored on our servers becomes permanently unreadable, and that Codelux has no means to restore it. Keeping the key safe, distributing it only to members, and rotating it when a member leaves are the responsibility of the team owner and its members. The recovery phrase shown by the App is that key: treat it as a secret.

What Codelux stores and does not store

Our servers store the encrypted events and the delivery metadata, the team membership, the identifiers and names of shared projects (a rename made by the owner from their App replaces the name stored on our servers), the folder path each member declared for a shared project on each of their machines, the public keys of members’ installations and the version number of the key, as described in the Privacy Policy (Sections 2 and 9). Source code and project files are never uploaded; they stay on each member’s machine.

Roles and responsibilities

The team owner administers the team: invitations, roles, shared projects, key rotation and closure. Owners and admins must only invite people entitled to see the team’s shared data. The owner or an admin may restrict invitations to one or more email domains; invitations to other addresses are then refused. Organization admins appointed by the owner act as admins on all the owner’s teams, within the limits of Article 2.15. A member may leave a team at any time; the owner may remove a member at any time. Removal or leaving ends the member’s access to future events immediately; data already on that member’s machine remains there and it is the team’s responsibility to rotate the key if that matters.

Direct messages and groups

Direct messages and group conversations in the team chat are encrypted with the team key shared by all members and are delivered to every member’s App; they are separated only by the App’s interface and are not confidential towards the other members or the owner. You accept that they must not be relied upon for private communication.

Closure and end of the plan

The owner may close a team at any time; closure deletes the team’s encrypted events and metadata from our servers and ends every member’s access. If the owner’s Team subscription ends or the number of members exceeds the seats purchased, the team’s shared projects stop being authorised for its members until the subscription is renewed or seats are added; the data on our servers is retained for the periods stated in the Privacy Policy and nothing on the members’ machines is affected.

Realtime service

Collaboration features rely on the realtime service described in Article 2.13 (an Online Service). Locking and presence work only while it is reachable; when it is not, the App refuses to write to shared projects rather than risk a conflict. Availability, suspension and discontinuation of the realtime service follow Article 2.13.

Deleting and reopening a team

The owner may delete a team at any time. Deletion ends every member’s access at once and erases all of the team’s data from our servers immediately, as described in the Privacy Policy. Before a team can be deleted, the owner’s own installation of the App must have downloaded the team’s shared history: until it has, the deletion is refused, because the data would otherwise be lost for the owner as well. The copies held on the members’ machines are not deleted and remain readable to them; you accept that Codelux neither can nor will remove them.

A deleted team leaves a history entry in the owner’s Console, kept until the owner removes it. From that entry the owner may reopen the team, with the same identifier and the same key version, provided they hold an active Team plan with enough seats; the former members are invited again and must accept. The shared history is republished from the owner’s own machine, so whatever the owner’s installation no longer held is not restored. The owner may instead erase the history entry permanently, which requires their account password, removes every remaining record of the team from our servers and cannot be undone.

2.15 Organization Accounts — Single Sign-On, SCIM and Organization Admins

Scope

This Article applies when the owner of a Team or Enterprise plan (the “organization”), or an organization admin appointed by the owner, sets up single sign-on (OpenID Connect or SAML 2.0) or SCIM provisioning from the Console, when the owner appoints organization admins, and to the users whose sign-in the organization manages. What an organization admin configures is configured on behalf of the organization.

The organization’s responsibilities

The organization is responsible for its identity provider and its configuration, including what its organization admins set up; for claiming only email domains it controls (verified through a DNS record or through the owner’s own confirmed address); for keeping the client secret and the SCIM token confidential and replacing or revoking them if they may have been disclosed; and for the accuracy of what its identity provider sends. For its users’ identity data the organization is the controller and Codelux its processor, as described in the Privacy Policy (Section 11); a data processing agreement is available on request.

Deprovisioning

A user deactivated or deleted through SCIM is automatically removed from every team the organization owns, signed out of every web session and App, and refused at every further sign-in until reactivated; a team-key rotation is requested for each team concerned and is carried out by the team owner’s App. Reactivation does not restore team memberships. The organization accepts that deprovisioning does not reach data already on the user’s own machines. The organization’s owner cannot be deprovisioned through SCIM.

Required single sign-on

When the organization requires single sign-on for its verified domains, users with those addresses can sign in only through its identity provider. The owner’s own account keeps every sign-in method as emergency access, and the owner is responsible for keeping it secure. While the identity provider is unreachable or misconfigured, those users cannot sign in; Codelux is not liable for that unavailability, consistent with Article 2.8.

Organization admins

The owner may appoint registered users as organization admins. They act as admins on all the owner’s teams — invitations, removals, key-rotation requests, the Manager and audit exports — and may set up the organization’s single sign-on, verified email domains and SCIM as the owner can, but cannot change roles, close or delete teams, change billing, or appoint other organization admins. The owner is responsible for the people they appoint and can remove them at any time; an organization admin may step down at any time.

2.16 Manager — Tasks, Standup Reports, Exports and the Information of Workers

What the Manager does

On Team projects, the owner and admins can plan tasks, generate daily standup reports per member from the project timeline — never from chat — confirm completion percentages, see each member’s daily AI usage totals and their cost with the plans and budget they record, and export a member’s work or the team’s audit package, chat excluded, as described in the Privacy Policy (Section 12). These features run in the App on the users’ machines; Codelux cannot read their content.

The customer’s responsibilities as employer and controller

The customer — the holder of the Team or Enterprise plan — is the controller of the personal data of its members processed through the Manager and, where members are its workers, acts as their employer. Before using the Manager on people, the customer must inform them of what is recorded, reported and exported and why, and must comply with the law on the monitoring of workers that applies to it — including, in Italy, Article 4 of Law No. 300 of 20 May 1970 (Statuto dei Lavoratori) with the agreement or authorisation it may require, and Article 88 of the GDPR with the national rules adopted under it — as well as any works-council, collective-agreement or equivalent requirement in its country. Codelux does not give legal advice on these obligations and does not check that they are met.

Work progress, not evaluation of people

Standup reports and completion percentages describe the progress of work as recorded by AI agents and by the timeline, and can be incomplete or inaccurate. AI usage figures measure the volume and cost of the members’ tools, not the quantity or quality of their work. The customer undertakes not to use them as the sole basis for evaluating, disciplining, rewarding or otherwise deciding about a person, and to let the person concerned see and comment on the information used. Every member can see their own tasks and their own standup reports in the App.

The customer is responsible for its use of the Manager’s output and indemnifies Codelux under Article 2.9.

2.17 Connected Third-Party Tools and Slack

The owner or an admin may connect the Manager to Slack through an incoming webhook and, as the App makes them available, to work trackers and code hosts (Jira Cloud, Linear, Asana, Azure DevOps Boards, GitHub Projects/Issues). Connections run from the administrator’s own App with the webhook address or token that the administrator provides; that secret is stored encrypted on the administrator’s machine and is never sent to Codelux’s servers. Codelux does not receive, store or forward these tokens or the data exchanged.

These services are chosen and contracted by the customer and are the customer’s own providers, not Codelux’s sub-processors; their availability, terms and handling of data are governed by the customer’s agreement with them. The customer decides what is sent, is responsible for having the right to send it and for informing the people concerned, and accepts that Codelux cannot recall data already sent. Codelux is not liable for the third parties’ services, consistent with Article 2.8.

C) Codelux Hub (version 4.0, not yet in effect)

3.1 Internal and Hosted Hub — Applies Only Once Available

Not yet in effect. This Section C applies only from the day the Codelux hub (version 4.0) is made available to the customer, and only if the customer uses it. Until then, Sections A and B govern the service in full.

Internal hub

When the customer runs the hub on its own server, the customer is the host and the controller of all the data kept by the hub, and is responsible for that server’s security, availability, backups, updates and retention, and for the credentials of the tools connected to it. The hub sends Codelux only licence and health data (licence, organization, seats in use, version, operating status), as described in the Privacy Policy (Section 15).

Hosted hub

When the customer uses the hub hosted by Codelux, team data is stored encrypted as under Article 2.14 and is kept for the duration of the subscription plus 30 days after it ends, and then deleted; the customer is responsible for exporting what it needs before then. The tokens of connected tools stay in the administrator’s App (Article 2.17).

Precedence

For a customer who uses the hub, this Article prevails where it differs from Articles 2.13 and 2.14.

⚖

Questions about these Terms? Contact us at [email protected]

1. What Are Cookies & Local Storage?

Cookies are small text files stored on your device when you visit a website. We primarily use localStorage (a browser storage mechanism) rather than traditional HTTP cookies — this means your data stays on your device and is not automatically sent with every request.

2. Storage We Use

Strictly Necessary

Required for the site to function. Cannot be disabled without breaking core functionality.

Name	Purpose	Storage	Duration
`clx_token`	JWT authentication token	localStorage	30 days
`clx_user`	Cached user profile	localStorage	30 days
`clx_cookie_prefs`	Record of your consent choices — this is what remembers the selection you make in the cookie banner	localStorage	Persistent
`clx_maint`	Technical maintenance-unlock cookie, set only for an administrator who enters the maintenance password while the site is in maintenance mode	HTTP cookie (httponly)	7 days
`clx_sib`	Sign-in binding: a random value that ties a sign-in with Google, GitHub, Slack or your organization’s single sign-on to the browser that started it, so that nobody else can complete or take over that sign-in. Set only when you start such a sign-in; it contains no personal data	HTTP cookie (httponly, SameSite=Lax)	2 hours
`clx-admin-theme`	The light or dark theme you chose with the theme switch, shared by the Website and the Console so that one choice holds on both. Written only when you click the switch; it is never sent to our servers and identifies nobody. An earlier version of the Website kept the same choice as `clx_theme`, which is still read if present and no longer written	localStorage	Until you change it or clear the site data

Legal basis: Contract performance and legitimate interest (GDPR Art. 6(1)(b)(f)) — required to provide the authenticated service. The consent record itself is strictly necessary to honour your choice.

Preferences

Remember the language you explicitly choose. This key is stored only when you actively choose a language (selecting a language); it is exempt from consent as strictly necessary to honour your explicit choice (ePrivacy exemption for storage strictly necessary to provide a service you explicitly requested). You can delete it at any time by clearing site data. It does not track you across sites. The light/dark theme is listed under Strictly Necessary above.

Legal basis: not subject to consent — strictly necessary to provide the preference you explicitly requested (ePrivacy Art. 5(3) exemption; GDPR Art. 6(1)(b)).

Functional

There is currently no functional storage subject to consent: all preference keys fall under the exemption described above. The "functional" toggle in the cookie banner remains available for any future functional storage, which would be listed here before being introduced.

Analytics

We count page visits and attribute marketing campaigns to understand how visitors find and use the site. No third-party analytics tools (Google Analytics, etc.) are used — all data remains on our own servers. These identifiers are set and the visit ping is sent only if you have given analytics consent; without it, nothing is stored and no ping is sent.

Name	Purpose	Storage	Duration
`clx_sid`	Persistent visitor identifier used to count page visits and attribute marketing campaigns	localStorage	Persistent (until consent is revoked or storage is cleared)
`clx_attr`	Campaign-origin parameters (e.g. which link or campaign brought you here); saved to your account at registration only if analytics consent was active	localStorage	Persistent (until consent is revoked or storage is cleared)

Legal basis: Consent (GDPR Art. 6(1)(a)), revocable at any time. Revoking analytics consent stops the visit ping and deletes clx_sid and clx_attr from your browser. No cross-site tracking is performed.

3. Third-Party Services

Google Fonts (Administration Area Only)

The public pages of this website do not load fonts or any other resources from Google's servers — no connection to fonts.googleapis.com is made while you browse the site, and Google sets no cookies here. Only the internal administration area, accessible solely to the site administrator, loads the Inter font from fonts.googleapis.com; that request transmits the administrator's IP address to Google's servers in the USA, covered by Google's Standard Contractual Clauses. See Google Privacy Policy.

Cloudflare

The Website is delivered through Cloudflare's network (see the Privacy Policy, Section 7). Cloudflare may set strictly necessary cookies (such as __cf_bm or cf_clearance) solely to tell legitimate visitors from automated abuse when a security check is triggered; they hold no profile, are not used for analytics and are not subject to the consent choices above. See Cloudflare Privacy Policy.

Sign-In Providers

Our pages load nothing from Google, GitHub, Slack or any identity provider. Only if you choose to sign in with one of them is your browser sent to that provider’s own page, where the provider may set its own cookies under its own policy; Codelux has no access to them. See the Privacy Policy, Sections 10 and 11.

Stripe

Payment pages use Stripe, which sets its own cookies for fraud prevention and payment processing. These cookies are only active on checkout pages. See Stripe Privacy Policy.

4. How to Manage or Delete Storage

Since we use localStorage (not traditional cookies), your browser's cookie settings may not fully apply. To clear all stored data:

Chrome / Edge: F12 → Application → Local Storage → codelux.ai → right-click → Delete
Firefox: F12 → Storage → Local Storage → codelux.ai → Delete All
Safari: Develop → Show Web Inspector → Storage → Local Storage → codelux.ai

Clearing local storage will log you out of your account. You do not need to clear storage manually to stop analytics: revoking analytics consent (see Section 6) stops the visit ping and deletes clx_sid and clx_attr automatically.

5. Changes to This Policy

We may update this Cookie Policy as the service evolves. The date at the top of this page reflects the latest revision. Each revision carries a version number: when a change is material, you will be asked to review and renew your consent through the same consent mechanism used on your first visit — continued use of the site is not treated as acceptance. Until you renew consent, only strictly necessary storage is used.

6. Manage Your Preferences

You can review and change your cookie choices at any time. Your current status is shown below.

Revoking consent removes all optional storage and resets your preferences — the cookie banner will reappear on the next page load.

Questions about cookies or local storage? Email [email protected]

Open Source Components

The Codelux agent binary incorporates the following open source libraries. Their licenses are reproduced below in compliance with the terms of each license. Our servers additionally use open source components — two libraries for SAML single sign-on on the codelux.ai website server, and the libraries of the realtime service that relays Team events — listed under “Server Components”; they run only on our servers and are not part of the App.

The Codelux agent itself is proprietary software. Only the third-party dependencies listed here are open source.

Dependency Summary

Package	Version	License	Source
fsnotify/fsnotify	v1.10.1	BSD 3-Clause	github.com/fsnotify/fsnotify
nats-io/nats.go	v1.37.0	Apache 2.0	github.com/nats-io/nats.go
sergi/go-diff	v1.4.0	MIT	github.com/sergi/go-diff
odvcencio/gotreesitter	v0.19.1	MIT	github.com/odvcencio/gotreesitter
go.etcd.io/bbolt	v1.4.3	MIT	go.etcd.io/bbolt
golang.org/x/crypto	v0.52.0	BSD 3-Clause	golang.org/x/crypto
golang.org/x/sys	v0.45.0	BSD 3-Clause	golang.org/x/sys
klauspost/compress	v1.17.2 (indirect)	Apache 2.0 / BSD	github.com/klauspost/compress
nats-io/nkeys	v0.4.7 (indirect)	Apache 2.0	github.com/nats-io/nkeys
nats-io/nuid	v1.0.1 (indirect)	Apache 2.0	github.com/nats-io/nuid

Server Components

Used on our servers only and not distributed with the App. The first two serve SAML 2.0 single sign-on on the codelux.ai website server (Privacy Policy, Section 11) and are copied unmodified from their release archives; the others are the direct dependencies of the realtime service that relays encrypted Team events (Privacy Policy, Section 9), which also uses the modules they depend on, as pinned in that service’s module file, all under the Apache 2.0, BSD-style or MIT licenses.

Package	Version	License	Source
onelogin/php-saml	4.3.2	MIT	github.com/SAML-Toolkits/php-saml
robrichards/xmlseclibs	3.1.5	BSD 3-Clause	github.com/robrichards/xmlseclibs
nats-io/nats-server	v2.14.2	Apache 2.0	github.com/nats-io/nats-server
nats-io/nats.go	v1.52.0	Apache 2.0	github.com/nats-io/nats.go
modernc.org/sqlite	v1.28.0	BSD 3-Clause	modernc.org/sqlite

MIT License (bbolt, gotreesitter, sergi/go-diff, onelogin/php-saml)

MIT License

Copyright (c) respective copyright holders (see source repositories)

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.

BSD 3-Clause License (fsnotify, golang.org/x/crypto, golang.org/x/sys, parts of klauspost/compress, robrichards/xmlseclibs, modernc.org/sqlite)

BSD 3-Clause License

Copyright (c) respective copyright holders (see source repositories)
All rights reserved.

Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:

1. Redistributions of source code must retain the above copyright notice,
   this list of conditions and the following disclaimer.

2. Redistributions in binary form must reproduce the above copyright notice,
   this list of conditions and the following disclaimer in the documentation
   and/or other materials provided with the distribution.

3. Neither the name of the copyright holder nor the names of its contributors
   may be used to endorse or promote products derived from this software
   without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
POSSIBILITY OF SUCH DAMAGE.

Apache License 2.0 (nats.go, nats-server, nkeys, nuid, klauspost/compress)

These components are licensed under the Apache License, Version 2.0 (klauspost/compress additionally includes portions under BSD-style licenses, reproduced in its source repository). You may not use these files except in compliance with the License. You may obtain a copy of the License at:

https://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Found a license compliance issue? Please contact [email protected] and we will address it promptly.