Privacy Policy

1Who we are

Cordane is a product operated by Sitedity SRL, a company registered in Romania (“Cordane,” “we,” “us”). For the personal data described here, Sitedity SRL is the data controller.

Questions, requests, or privacy concerns: contact@cordane.ai.

2Your code runs on machines you own

Cordane runs your AI coding agents, dev servers, and repositories on workers you own. We never host a worker, and your repositories are cloned and built only there. Agent API keys and credentials you set up on a worker (for example your Claude, Codex or GitHub login) stay on that worker.

When you self-host the hub, nothing below reaches us at all — the hub is yours too. When we host the hub (managed cloud), it handles some of your data on its way to you, and stores some of it so the board works:

• Passes through, not stored: the terminal and app traffic you open in your browser is relayed by the hub between the browser and your worker (terminal scrollback is kept on the worker, not the hub), and so are files you download from or upload to a worker.
• Stored on the hub: what you put on the board (tickets, plans, comments, review feedback, attachments), the output of agent runs and hooks (which can include code and logs), and the diffs it shows you, kept briefly in memory.
• Stored encrypted: project environment variables and the tokens of integrations you configure (for example Sentry, Jira or a voice-dictation API key). They are encrypted at rest and sent to your workers when a ticket needs them.

If you don’t want any of that on our infrastructure, self-host the hub — it is the same product.

3What we collect

Managed-cloud waitlist

When you use the waitlist form, we collect the email address you submit, and which page or referral you arrived from. We use it only to tell you when a managed-cloud slot opens. We do not sell it, and we don’t add you to a newsletter.

Self-hosting

If you self-host Cordane there is no account and no signup, and the free Community tier needs no license key. Your workers never contact our servers: the Cordane worker connects only to your own hub. Your hub contacts our servers (cordane.ai) in exactly these cases:

• Update check — every hub, on by default. At startup, every 6 hours, and when someone opens or returns to the hub in a browser (at most once a minute), the hub asks for the newest published release. The request names only the release channel (for example stable). It does not include your hub’s version, hostname, license key, users, or any usage data. Turn it off with CORDANE_UPDATE_CHECK=off.
• License check-in — only if you set a license key. A hub with CORDANE_LICENSE_KEY set sends that key and the hub machine’s hostname (used to bind the license to your install) at startup, once a day, and when an action reaches a plan limit (at most once every 10 seconds). A Community hub with no key never makes this call. To stop it, remove the key; the hub then runs the Community tier.

A hub we host for you on managed cloud makes the same calls, plus one: when an admin clicks Update hub now, the hub asks our servers to update it, authenticated with its license key. Like any request to our servers, these calls appear in the basic technical logs described below, including the IP address they came from. On a self-hosted hub, features you set up yourself — GitHub sign-in, Sentry or Jira connections, voice dictation through OpenAI or ElevenLabs — connect directly to those providers with your own credentials and never pass through our servers.

Account data (when you use the product)

Cordane signs you in with GitHub. When you authenticate, we receive the basic profile GitHub provides — such as your GitHub username, name, email, and avatar — to create and identify your account. We do not receive your GitHub password.

Billing data

If and when you pay for Cordane, payments are handled by our payment processor acting as merchant of record. We receive confirmation of your subscription and limited billing details (such as plan and status); we do not receive or store your full card number.

Technical data

Like any web service, our servers keep basic logs — IP address, browser/user-agent, requested URLs, and timestamps — for security, abuse prevention, and diagnosing problems.

4Cookies & tracking

This website (cordane.ai) uses Cloudflare Web Analytics to count page views. It is cookieless and does not fingerprint or track individual visitors: it records aggregate page views, referrers, country, browser and device type, and page-load timing, and it sets no cookies. We use it only to see which pages are read. There is no advertising and no third-party tracking. Some pages show a feature video: the poster image is served from this site, and nothing loads from YouTube until you press play, at which point the privacy-enhanced youtube-nocookie.com player is used and YouTube’s own privacy policy applies to the playback. The site stores a single theme preference (light/dark) in your browser’s local storage, which never leaves your device. The Cordane app uses a strictly-necessary session cookie to keep you signed in. That’s it.

5Why we process your data (legal bases)

Under the GDPR, we rely on:

• Consent — for handling your email when you join the waitlist. You can withdraw it at any time.
• Performance of a contract — to create your account and provide the service you sign up for.
• Legitimate interests — to keep the service secure, prevent abuse, and operate reliably (balanced against your rights).
• Legal obligation — where we must retain records, e.g. for tax or accounting.

6Who we share it with

We don’t sell your personal data. We share it only with the service providers (“sub-processors”) we need to run Cordane, under appropriate agreements. These currently include:

• Fly.io — cloud hosting for our website and control plane.
• Cloudflare — DNS for cordane.ai and cookieless web analytics for this website.
• GitHub — sign-in (OAuth) for the product.
• Our payment processor — to handle subscriptions and billing (merchant of record).
• An email provider — to deliver waitlist, purchase, and account email.

We may also disclose data if required by law, or to protect the rights, safety, and security of Cordane and its users. We can provide the current list of sub-processors on request.

7International transfers

Some of our providers may process data outside the European Economic Area. Where that happens, we rely on appropriate safeguards (such as the European Commission’s Standard Contractual Clauses) to protect your data.

8How long we keep it

• Waitlist emails: until you ask us to delete them, or until a slot has been offered and the list entry is no longer needed.
• Account data: for as long as your account is active, then deleted or anonymized within a reasonable period, except where we must keep records to meet legal obligations.
• Logs: for a limited period, then rotated out.

9Your rights

If you’re in the EU/EEA, you have the right to access, correct, delete, restrict, or object to our processing of your personal data, and to data portability. Where we rely on consent, you can withdraw it at any time. To exercise any of these, email contact@cordane.ai and we’ll respond within the time the law allows.

You also have the right to lodge a complaint with a supervisory authority. In Romania this is the National Supervisory Authority for Personal Data Processing (ANSPDCP).

10Children

Cordane is a tool for professional developers and is not directed at children. We don’t knowingly collect personal data from anyone under 16.

11Changes to this policy

We may update this policy as the product evolves. When we make material changes, we’ll update the date at the top and, where appropriate, let you know. Continuing to use Cordane after an update means you accept the revised policy.

12Contact

Sitedity SRL (Cordane) — Romania.
Email: contact@cordane.ai