Privacy Policy

1. Scope

This policy applies to the UltraCodey desktop application, the ultracodey.com website, and your UltraCodey account. It does not apply to third-party services you connect to UltraCodey (such as AI providers), which have their own privacy policies.

2. Information we collect

Information you provide

• Account details - your email address, display name, and a password. We store passwords only as salted, hashed values; we never store or see your plaintext password. If you sign in with Google, we receive basic profile information from Google to create and identify your account.
• Requests and messages - beta-access requests (email, optional name and note) and any messages you send us for support or appeals.

Information collected automatically (account-related)

• Security & device records - when you sign in, we record sign-in events and the devices used, including timestamps, IP-derived approximate location (city, region, country, latitude, and longitude), IP address, and basic client information (such as browser or app). This is shown back to you for your own security visibility.
• Progression & usage - your XP, level, achievements, and total time spent in the app, which sync to your account so your profile is consistent across devices.
• App and version metadata - basic technical details needed to operate sync, such as the app version and a per-device identifier.

Account sync and optional connected features

• Account sync - selected memory titles and content (including project associations), skill metadata, automation definitions, permission rules, non-secret app settings, progression, and sync timestamps. AI-provider keys, notification API keys, and webhook URLs are excluded.
• Companion - when enabled, pairing metadata and a bounded recent feed of the run events, status, logs, and diffs sent by your desktop app so a paired device can display and control the run.
• Email relay - when enabled, mailbox configuration and recent inbound email content, including sender name/address, subject, body, message identifier, and timestamps, so UltraCodey can receive and reply to authorized senders.
• Shares and voice relay - content you explicitly share, and temporary voice media you explicitly relay to a connected service or recipient. Share links expire and voice media is short-lived.

Sources of information

We collect information from you, from the desktop app or website when you use account features, and from service providers that help with sign-in, hosting, security, or email delivery. We do not buy personal information from data brokers.

3. What stays on your device

The following are processed locally on your machine and are not sent to or stored by Pegasus Vision account systems:

• Your source code, files, and project data;
• Your ordinary full chats, prompts, and the agent's working context, except content you explicitly send through an optional share, companion, email-relay, or voice-relay feature;
• Local-only project backups, generated files, and unsynced skills;
• Your AI provider API keys and any sign-in tokens for AI services.

When account sync is enabled, the account-sync categories listed in Section 2 are sent to Pegasus Vision account systems so they can be restored on another signed-in device. You can turn cloud sync off from the app's Account privacy controls; security, entitlement, and billing checks still operate while sync is off.

When you use AI features, requests are sent directly from your device to the AI providers you choose, using your own credentials. Those requests may include prompts, file snippets, or other context needed for the work you authorize. The requests do not pass through us, and the providers handle that data under their own privacy policies.

4. How we use information

• To create and operate your account and, when enabled, sync the disclosed account data across devices;
• To provide companion, sharing, voice-relay, and email-relay features you choose to enable;
• To provide security features and show you your devices, sessions, and sign-in history;
• To respond to support requests, appeals, and beta-access requests, and to send you account and service messages;
• To operate, maintain, protect, and improve the Service, including preventing fraud and abuse;
• To comply with legal obligations and enforce our terms.

We do not use your information for third-party advertising, and we do not sell personal information.

5. Legal bases (where applicable)

If you are in a region with data-protection laws such as the EU/EEA or the UK, we process your information on these bases: to perform our contract with you (providing the account and Service); our legitimate interests (security, abuse prevention, and improving the Service); your consent where required; and compliance with legal obligations.

6. Cookies & local storage

The website uses your browser's local storage to keep you signed in and to remember a per-browser identifier so the browser appears in your Devices list. We do not use third-party advertising or cross-site tracking cookies. Essential storage is required for sign-in to work; you can clear it from your browser at any time, which signs you out on that browser.

7. How we share information

We share personal information only in these limited circumstances:

• Service providers we rely on to run the Service - for example, cloud hosting and infrastructure, email delivery, Google for optional sign-in, and Stripe for Pro billing - who process information on our behalf under appropriate obligations;
• Legal & safety - when required by law, to respond to lawful requests, or to protect the rights, safety, and security of our users, the public, or us;
• Business transfers - in connection with a merger, acquisition, financing, or sale of assets, subject to this policy.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

8. Data retention

We keep account information for as long as your account is active and as needed to provide the Service. Beta-access requests, support messages, account messages, relay content, and security records are kept for the periods needed to operate the Service, prevent abuse, maintain records, and comply with law. When you delete your account, we delete or anonymize personal information associated with it within a reasonable period, except where we must retain it to comply with legal obligations, resolve disputes, prevent fraud or abuse, or enforce our agreements.

Tamper-evident administrative audit records may retain the administrator and affected-account identifiers needed to document security, billing, and account actions. We restrict access to these records and retain them only for legitimate security, legal, fraud-prevention, and dispute-resolution purposes.

9. Security

We use technical and organizational measures to protect your information, including encryption in transit, salted password hashing, and optional two-factor authentication. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. You can strengthen your account by enabling two-factor authentication and using a strong, unique password.

10. Your rights & choices

Depending on where you live, you may have rights to access, correct, update, delete, or export your personal information, to object to or restrict certain processing, and to withdraw consent. You can edit your display name in the app or web portal, manage sessions and security from your dashboard, and request access or deletion by emailing privacy@ultracodey.com from your account email. We will respond as required by applicable law. You will not be discriminated against for exercising these rights.

Your U.S. state privacy rights

Depending on your state (for example, California under the CCPA/CPRA), you may have the right to know the categories and specific pieces of personal information we collect, the sources and purposes, and the categories disclosed to service providers; to request access, correction, and deletion; and to be free from discrimination for exercising these rights. The categories we collect are described in Information we collect - identifiers such as your email, account and profile information, internet or electronic-network activity connected to sign-in and security records, approximate geolocation derived from IP address, and usage records such as XP, achievements, and time in app. We use these categories for the purposes in How we use information and retain them as described in Data retention. We do not use or disclose sensitive personal information to infer characteristics about you.

Do not sell or share

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under U.S. state privacy laws. Where applicable, we honor opt-out preference signals such as Global Privacy Control (GPC). You may exercise these rights - including through an authorized agent - by emailing privacy@ultracodey.com, and we will verify your request as required by law.

11. International transfers

We and our service providers may process information in countries other than where you live, including the United States. Where we transfer personal information from the EEA, the UK, or Switzerland to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable). By using the Service, you understand your information may be processed in these locations.

12. Children

The Service is not directed to children, and you must meet the minimum age in our Terms of Service to use it. We do not knowingly collect personal information from children under 13, or from anyone below the age required to use the Service. If you believe a child has provided us information, contact us and we will take appropriate steps to delete it.

13. Changes

We may update this Privacy Policy from time to time. We will revise the "Last updated" date above and, for material changes, take reasonable steps to notify you. Your continued use of the Service after changes take effect means you accept the updated policy.

14. Contact

For privacy questions or requests, email privacy@ultracodey.com. We are the controller of the personal information described in this policy.