Privacy Policy

Last updated: 07/23/2026

Effective July 23, 2026.

Overview

Freebuff, Inc. (“Company”, “we”, “our”, or “us”) operates Codebuff and Freebuff CLI, Freebuff Web, Freebuff Cloud, Freebuff Chat, and Freebuff Desktop. This Privacy Policy explains how we collect, use, retain, and disclose information when you use our websites, applications, software, and other products and services (collectively, “Service”). Our Terms of Service govern your use of Service.

Information We Collect

Depending on how you use Service, we may collect:

  • Account and contact information, such as your name, email address, profile information, and identifiers from authentication providers.
  • Prompts, messages, code, files, repository data, images, feedback, support communications and attachments, information about third parties, and other content you submit, connect, create, or modify through Service (“Prompt and Project Data”).
  • Workspace and organization information, such as organization, workspace, administrator, role, and team-membership details.
  • Usage and device information, such as your IP address, country, approximate location derived from IP, browser or application version, device type, operating system, features used, interaction timestamps, installation or session identifiers, crash information, and diagnostic logs.
  • Information from authentication, repository, AI, and other services you connect, according to the permissions you grant.
  • Advertising and attribution information, such as campaign, referral, click, pixel, and conversion identifiers.
  • Inferences such as advertising interests, usage classifications, and fraud, abuse, or security scores.
  • Transaction and billing information if we offer a paid product or service, such as purchase history, billing address, the last four card digits, and processor transaction identifiers. Full payment card details are handled by our payment processors rather than stored by us.

We collect this information directly from you, automatically from your use of Service, from services you connect, and from service providers. We may also receive information from business customers, teammates, referral partners, and public sources.

Prompts, Code, Files, and AI Providers

We process Prompt and Project Data to provide the features you request. Depending on the product, model, and account you use, that data may be processed by Company systems and by AI model providers. Providers may change over time. When you connect and use your own third-party account, that provider's terms and privacy practices may also apply.

Personalized Advertising

We may use Prompt and Project Data to personalize advertising shown within Service, including by deriving general interest categories.

We may use Company systems and service providers acting on our behalf to analyze prompts and messages and to select, deliver, prevent fraud in, and measure advertising. These providers may not use that information for their own independent purposes except as permitted by law and our agreements with them. Code or other content pasted into a prompt or message is part of that message and may also be processed. We do not provide separately uploaded files or connected repository contents to advertising providers. We do not use Prompt and Project Data to target advertising based on sensitive characteristics such as race or ethnicity, religious or philosophical beliefs, health, sex life or sexual orientation, union membership, precise geolocation, or financial account information. Advertising and measurement providers may also receive limited identifiers and events needed for these purposes.

Where required by applicable law, we provide choices concerning targeted advertising, sale or sharing of personal information, and related profiling. We honor legally recognized opt-out preference signals where required. In jurisdictions where these choices are not legally required, certain advertising processing may be necessary to use the free Service.

AI Training

We do not use Prompt and Project Data to train our or third-party AI models unless, before you use the applicable model or feature, we clearly state that the data may be used for AI training. A label or notice such as May use data for AI training means that Prompt and Project Data submitted through that model or feature may be retained and used by Company or the applicable third-party provider for AI training, development, evaluation, testing, fine-tuning, quality improvement, safety research, and related model or product improvement. A general notice that data is collected or stored does not by itself permit these uses.

How We Use Information

We use information to:

  • provide, maintain, personalize, and support Service;
  • process prompts and generate requested output;
  • save projects or conversation history when you request it;
  • select and measure advertising as described in this Privacy Policy;
  • develop, test, evaluate, improve, and analyze Service;
  • detect, investigate, and prevent fraud, abuse, security incidents, and violations of our Terms;
  • communicate with you about Service and provide support;
  • comply with law and protect our rights and users; and
  • carry out another purpose we explain when collecting the information, with any consent required by law.

We will not use personal information for a materially different purpose without appropriate notice and any consent required by law.

Cookies, Local Storage, and Telemetry

Web portions of Service use cookies, local storage, and similar technologies for authentication, preferences, security, analytics, advertising, and attribution. Our products also send bounded usage, performance, and diagnostic events to analytics and observability providers.

Advertising and conversion events may include hashed account, campaign, click, pixel, and conversion identifiers; IP address; user agent; source URL; and an event indicating that a prompt was accepted. The prompt's contents are not included in these routine conversion events. Attribution information may be retained in first-party browser storage.

You can control cookies through your browser and any consent controls we make available. Some portions of Service may not work correctly if you block necessary storage. Because there is no common standard for “Do Not Track,” our websites do not currently respond to that signal.

How We Disclose Information

We may disclose information to:

  • Model providers that process prompts and related context to provide requested AI features.
  • Hosting, storage, sandbox, database, security, support, analytics, and observability providers.
  • Authentication and connected-service providers when you use or connect those services.
  • Advertising and measurement service providers acting on our behalf, including providers that process prompts and messages for the purposes described above.
  • Payment processors if you purchase a paid product or service.
  • Government authorities or other parties when required by law or reasonably necessary to protect rights, safety, and security.
  • A buyer, successor, or other relevant party in connection with a merger, financing, acquisition, reorganization, or sale of assets, subject to appropriate confidentiality protections.

We do not sell personal information for money. Certain disclosures to advertising or measurement partners may be considered a “sale,” “sharing,” or targeted advertising under some privacy laws even when no money changes hands. Rights and choices required by applicable law apply to those disclosures.

Retention

We retain information for as long as reasonably necessary for the purposes described in this Privacy Policy, including providing, maintaining, developing, improving, evaluating, securing, and supporting Service; advertising; enforcing our Terms; complying with law; and resolving disputes.

Depending on the data and context, information may be deleted, deidentified, aggregated, or retained longer when reasonably needed for legitimate business, security, legal, dispute-resolution, evaluation, or clearly disclosed AI-training purposes. Data submitted through a model or feature labeled for AI training may be retained for the permitted development and improvement uses above and may not be removable after it is deidentified or incorporated into a model.

Saved projects and conversation history generally remain until you delete them or close your account, subject to the exceptions above. Deleted information may remain in backups, and deidentified or aggregated data, derived interests, permitted training or evaluation data, and content others retain through a sharing or publishing feature may remain after deletion. Where required, we instruct service providers to delete information as well.

Legal Bases and International Transfers

Where applicable law requires a legal basis, we process personal information as necessary to perform our contract with you, comply with legal obligations, and pursue legitimate interests such as securing and improving Service, preventing abuse, and supporting our business. We rely on consent where required, including for certain advertising, cookies, connected services, or training uses associated with models or features identified for AI training. You may withdraw consent without affecting processing that occurred before withdrawal.

We are based in the United States, and we and our providers may process information in the United States and other countries. Where required, we use recognized safeguards for international transfers, such as adequacy decisions or contractual protections.

Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Please do not include passwords, private keys, access tokens, or other secrets in prompts or files unless a feature expressly requires them.

Your Choices and Privacy Rights

You may ask to access, correct, delete, or receive a copy of your personal information, or object to or restrict certain processing, by emailing support@codebuff.com. You may also opt out of marketing emails through the unsubscribe link and exercise any additional privacy rights available under applicable law. We may verify your identity before completing a request and may retain information when an exception under applicable law applies.

United States State Privacy Rights

Depending on where you live and whether the applicable law covers Company, you may have rights to know or access personal information, correct inaccuracies, delete information, obtain a portable copy, opt out of sale, sharing, or targeted advertising, limit certain uses of sensitive personal information, use an authorized agent, and appeal a denied request. We will not discriminate against you for exercising a privacy right. Submit a request or appeal by emailing support@codebuff.com.

European and United Kingdom Privacy Rights

If European or United Kingdom data-protection law applies, you may have rights to access, rectify, erase, restrict, or port your personal information and to object to processing. You may object at any time to processing for direct marketing, including related profiling. You may also lodge a complaint with your local data protection authority.

Children

Service is not intended for anyone under 18, and we do not knowingly collect personal information from anyone under 18. If you believe a minor has provided personal information, contact us so we can take appropriate steps to delete it.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated policy and revise the date at the top. We will provide advance notice when required by law or when a change materially affects your rights. An updated policy takes effect on its stated effective date.

Contact Us

If you have questions or want to exercise a privacy right, email us at support@codebuff.com.