Privacy Policy

Codegraff, including graff, CodeDB, CodeDB Pro, Harness, the Codegraff gateway, and codegraff.com, is the property of The Standard Harness Company of Singapore. The Standard Harness Company of Singapore is responsible for the personal data described in this policy. In this policy, “Codegraff”, “we”, and “us” mean The Standard Harness Company of Singapore.

Harness connects your phone to coding agents running on your desktop. Contact rach@codegraff.com for Harness support and privacy requests.

Data used to run Harness

• Account and authentication: your CodeGraff account identifier, email address, name when supplied, organization membership, and authentication credentials are used to sign you in and authorize access to your workspace. The iOS app stores sign-in credentials in the system Keychain.
• Connected devices and projects: app-generated device identifiers, device names, platform, connection/presence timestamps, project names and paths, session identifiers, and configuration are synchronized so the app can find your computers, show your work, and route commands.
• Conversations and files: prompts, queued messages, agent replies, tool activity and outputs, project or code content included in conversations, and images or other attachments you choose to send are transmitted and stored to synchronize your workspace and deliver work to the selected desktop. Conversation data is associated with your account. Archiving a conversation hides it from the active list; it does not delete its stored content.
• Support: when you email us or send feedback, we receive your email address, message, and any screenshots, reports, or files you include. Please avoid sending passwords, API keys, or unnecessary private project content.

Optional iOS performance reports

In iOS versions containing this policy update, performance sharing is off until you enable Settings → Diagnostics → Performance → Share anonymous performance data. Earlier beta builds enabled sharing by default; updating resets that preference and requires a fresh choice. You can disable sharing at any time. Local performance measurements remain available without uploading them.

If enabled, reports contain operation timing counts and histograms, the reporting time window, app and OS versions, platform/architecture, hardware model, screen refresh rate, and a random identifier created for each app launch. They do not contain chat text, code, file paths, account identifiers, authentication credentials, or a persistent device identifier. We use them to diagnose responsiveness and improve reliability, and retain these reports for 90 days. Network requests necessarily expose an IP address to the hosting provider; the statistics endpoint uses it for rate limiting, rather than including it in the performance report.

Where data goes

Harness uses CodeGraff authentication and cloud synchronization services, including Cloudflare hosting and storage, to deliver the service. Synced conversations and attachments are stored in the cloud as well as on your connected devices. Transport uses HTTPS/WSS in production; cloud synchronization is not a promise of end-to-end encryption or zero data retention.

Coding agents and tools execute on your selected desktop, not on your iPhone. The agent, model provider, and integrations you select may receive prompts, attachments, code, and tool results needed to carry out your instructions. Their privacy and retention policies apply to that processing. Read the selected provider's policy and share only content you intend that agent and its tools to process. Other participants may see content you share in collaborative rooms.

We do not use the iOS app to track you across other companies' apps or websites for advertising. Infrastructure providers may process connection and operational logs to deliver, secure, and troubleshoot the service. Apple separately handles TestFlight feedback and diagnostics under its TestFlight privacy notice.

Retention and deletion

Workspace and conversation data is retained to provide history and synchronization while your account remains active. In the iOS app, Settings → Delete account requests deletion of your CodeGraff account and Harness data. The deletion flow removes credentials and initiates cleanup of the account's registry, owned chats/session/device rooms, attachments, and associated cloud copies. Cleanup is asynchronous and performs another pass after existing access tokens expire. In shared rooms, posts are handled according to the deletion flow and room ownership; copies already obtained by others or retained on disconnected desktops are not remotely erased.

Account deletion may require resolving an active paid-plan blocker first; the app displays the service's explanation. Contact us if deletion fails or you need help. Turning off performance sharing stops future uploads; existing unlinked reports expire under the 90-day retention rule and cannot reliably be identified using your account. Billing, security, support, and infrastructure records may have separate operational or legal retention requirements, as described in the CodeGraff policy and provider policies.

Your controls

You choose what to submit to agents, which desktop to use, whether to share optional performance data, and whether to contact support. Photo selection uses the system picker. Saving a generated image to Photos requests permission when you ask to save it. You can revoke Photos access in iOS Settings. Signing out ends the app's signed-in session; it does not delete your cloud account or project files.

For privacy requests, email rach@codegraff.com. We may need to verify that you control the relevant account before providing or deleting account data. Updates to this policy will appear here with a revised date.

We process your code to generate embeddings. We do not keep that content. Our managed CodeDB embedding service applies zero data retention (ZDR) to embedding content for all users, including free users. Inputs and outputs are processed transiently in memory to fulfill the request; they are not logged, cached, or written to persistent storage by the embedding service.

• Covered content: request bodies, source code and snippets, candidate file paths, task or search text, and generated embedding vectors.
• No hosted repository index: we do not retain a copy of your repository or create a server-side vector index from embedding requests.
• Analytics are separate: content-free usage and service metadata may be stored as described below. ZDR does not mean that no operational records exist.

Depending on the retrieval mode and local index, CodeDB may send your query and bounded code snippets or paths for embedding. Building a semantic index sends batches of source chunks. The resulting index and vectors are stored on your device, under your control. For an on-device retrieval call that sends no query or source text to the embedding service, pass semantic: "local" to codedb_context.

This ZDR policy covers the managed CodeDB embedding service we operate. If you set CODEDB_EMBEDDINGS_URL to a custom endpoint, that provider’s retention policy applies. Your coding client, its model providers, and other connected services also have their own policies. See the CodeDB data and privacy documentation and our Terms of Service.

Gateway model aliases ending in -contributor (for example muse-spark-1.3-contributor) are not zero data retention. Prompts and completions sent to them may be stored by the party serving the model and may be used to train or improve future models. They are priced lower for that reason. If your requests must not be retained, use the matching alias without the suffix; the models page marks every contributor model No ZDR.

CodeDB client telemetry is enabled by default. It measures tool usage, latency, response sizes, startup and index statistics, software version, and platform. It does not include source code, file contents, file paths, or query text. Disable client telemetry with CODEDB_NO_TELEMETRY=1 or --no-telemetry.

To operate and protect the hosted embedding service, we also maintain installation and authentication records, usage counters, and request metadata. These may include installation or account identifiers, public installation keys and certificate status, client version and platform, model, input counts and character counts, response status, latency, region, and network-derived rate-limit identifiers. These records can be associated with an installation or account; they are not all anonymous. They do not contain embedding inputs or outputs.

We use these content-free records for usage reporting, reliability, capacity planning, authentication, and abuse prevention. Retention follows those operational purposes; the embedding-content ZDR policy does not apply to these records. Disabling client telemetry does not disable hosted-service authentication, accounting, or rate limits. You may contact us about access or deletion of records associated with your account or installation.

In addition to the CodeDB service metadata above, we collect the following account, billing, and CodeDB Pro telemetry data:

On public blog posts, we measure browser-reported active time and maximum article scroll depth. Across public website pages and blog posts, we record aggregate delivery counts by page, format, status, and coarse reported crawler family. A random identifier exists only for the current page view; no analytics cookies or cross-page visitor IDs are used. Reports can be incomplete or automated and do not prove human or agent reading.

We honor Do Not Track and Global Privacy Control signals. Custom website analytics do not store IP addresses, full user-agent strings, query strings, account IDs, or article content. Records are retained for 30 days and deleted by a daily cleanup job. Cloudflare platform logs have separate retention.

Transient embedding processing is described above. Our usage analytics and client telemetry do not record:

• File paths or file contents
• Search patterns or queries
• Embedding request bodies or generated vectors

Full card or bank details stay with Stripe. Infrastructure providers may process network and access metadata under their own retention policies; this is separate from our content-free application analytics and the embedding-content ZDR commitment.

• Email: to deliver your license key and send transactional messages (no marketing without consent)
• Stripe IDs: to manage subscriptions, billing portal access, and automatic top-ups you explicitly enable
• CodeDB Pro session summaries (if Pro telemetry is on): to compute your personal dashboard stats and anonymous aggregate counters on the public landing page

We share data with:

• Stripe: payment processing. Their privacy policy applies to your payment data.
• Resend: transactional email delivery.
• Cloudflare: infrastructure and edge network.

We do not sell your data to any third party.

Under GDPR and CCPA you have the right to:

• Access: request a copy of data we hold about you
• Deletion: request erasure of your account and data
• Telemetry opt-out: for CodeDB, set CODEDB_NO_TELEMETRY=1 or pass --no-telemetry. For CodeDB Pro, use codedb-pro config set telemetry=off.

To exercise these rights, email hi@codegraff.com. We action deletion requests within 30 days.

We set one first-party HttpOnly cookie (cg_session) when you log in to the dashboard. It expires after 30 days. We also set a cg_ref cookie (30 days) if you arrive via a referral link. No tracking or advertising cookies are used.

Privacy questions: hi@codegraff.com