1.1 Account Information

You can sign in with GitHub, Google, Microsoft, or a one-time code sent to your email. Depending on the method, we receive:

• GitHub: your display name, username (used as your CDBX username), primary email address and avatar, and the public profile details you can choose to show (bio, location, company, website). GitHub sign-in also asks for repository access, used only when you export or push an app to GitHub.
• Google: your name, email address and profile photo.
• Microsoft: your name and email address. We only accept a Microsoft account whose email address Microsoft has verified.
• Email code: your email address.

You can also write your own name, bio, location, company and website on your profile, and choose which of them are shown publicly. You can revoke a sign-in provider’s access from that provider’s account settings, for example GitHub → Settings → Applications.

1.2 Usage Data

We collect information about how you interact with CDBX, including:

• Pages visited and features used within the app
• App creation, editing, publishing, and deletion events
• Code Execution API invocations and execution outcomes (success/failure, duration)
• AI model invocations: which model was used, token counts, and whether BYOK was active (but not the content of AI responses)
• Browser type, operating system, and IP address for security and abuse prevention

We use Google Analytics and PostHog to understand how the product is used. PostHog may also record sessions — what was shown on screen and where you clicked — so we can see where people get stuck and fix problems. Text you type into form fields (such as API keys and passwords) is masked and never recorded.

1.3 AI Chat Content

When you use the AI assistant within CDBX, your messages and the associated code context (the files in your app) are transmitted to the AI provider of the model you selected — Anthropic, OpenAI, Moonshot AI or xAI. We do not train AI models on your chat content.

We log each AI request for quality, safety, and abuse-monitoring purposes — including the text of your prompt, the model used, token counts, and whether the request succeeded. This log is retained for 90 days and is accessible only to CDBX administrators; it is used to understand product usage in aggregate and to review requests that trigger automated abuse flags (e.g. malware or attack-tooling requests). It is separate from your in-app chat history, which persists for as long as your account or project exists.

If you use Bring Your Own Key (BYOK), your requests are proxied directly to the AI provider using your key. The same provider privacy policies apply.

1.4 Apps, Code and Files

The apps, decks, documents, code and files you create or upload are stored with your account. Private items are only accessible to you and the people you share them with. Items you publish, or make public, are accessible to anyone with the link. You can change who can see an item, or delete it, at any time.

1.5 Payment Information

If you subscribe to a paid plan, your payment is processed by Stripe. We do not store your raw card number, CVC, or bank account details. We store your Stripe customer ID and subscription status so that we can provide the correct plan features and generate invoices.

1.6 API Keys (BYOK)

If you choose to supply your own API keys for an AI provider, those keys are encrypted at rest using AES-256 encryption before being stored in our database. Keys are decrypted in memory only at the time of a proxied API request and are never logged or transmitted to any party other than the intended AI provider.

1.7 Connected Services (Google, Microsoft and Others)

You can connect other services to CDBX — for example Google Drive, Google Calendar, Gmail, Outlook, OneDrive or Excel — so the AI assistant can work with them when you ask it to. Each connection asks only for the permission it needs, and you can disconnect it at any time in Settings → Connectors.

• Google Drive (with Docs and Sheets): only the files you choose in Google’s file picker, plus files CDBX creates for you. CDBX reads them, and changes or adds to them when you approve it.
• Google Calendar: reads your events and creates or changes events when you approve it.
• Gmail: sends an email from your account when you approve it. CDBX cannot read, search or delete your email.
• Microsoft (Outlook, OneDrive, Excel): reads your email, calendar and files, and sends email or changes a workbook when you approve it.

How it is used. Data from a connected service is used only to do what you asked for in that conversation: it is read when you ask, passed to the AI model you selected (see 1.3) so it can answer, and shown back to you. Nothing is written, sent or changed without your approval in the chat. CDBX does not use it for advertising, does not sell it, and does not use it to train AI models — ours or anyone else’s. The AI providers we use do not train their models on data sent through their APIs.

What is kept. The access tokens for a connection are encrypted at rest (AES-256). The conversation where you used a connector keeps a short record of each step — which tool ran, and the first few hundred characters of what it returned — so the assistant knows what it already did. That record is deleted with the conversation or the app. CDBX does not otherwise copy or store the contents of your files, email or calendar.

CDBX’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can also remove CDBX’s access from your Google account at myaccount.google.com/permissions, or from your Microsoft account at account.live.com/consent/Manage.