Privacy Policy

This page explains what we do with your data, in plain language. If anything here is unclear, email legal@codity.app and we will explain it.

1. Who we are

Codity is responsible for the data described here. We are the “controller” under the GDPR. Our postal address is on our imprint.

You can reach us about anything on this page at legal@codity.app.

2. What this policy covers

It covers our websites — codity.app and learn.codity.app — and the products we run: matdesk, Kerlov, AI Factory and Someone Has to Go. Where a product does something different with your data, we say so in that product.

It does not cover other companies’ websites we link to.

3. When you visit our websites

Server logs. Our sites are hosted by Vercel. Their servers record each request: your IP address, the page you asked for, your browser and operating system, and the time. We use this to serve the site and to spot abuse and outages. Legal basis: our legitimate interest in running a secure website (Art. 6(1)(f) GDPR).

Analytics. We use Vercel Analytics to count page views. It sets no cookies and builds no profile of you — we only see aggregate numbers like “this page was viewed 400 times”. Legal basis: our legitimate interest in knowing which pages are useful (Art. 6(1)(f) GDPR).

Fonts. Our pages load the Inter and JetBrains Mono typefaces from Google Fonts, which means your browser contacts a Google server and Google receives your IP address. Legal basis: our legitimate interest in presenting the site consistently (Art. 6(1)(f) GDPR). We are working on serving these fonts from our own servers so this request disappears.

4. When you create an account

Accounts are handled by Clerk. Depending on how you sign up, that means your email address, your name, your profile picture, and — if you use Google or GitHub to sign in — the account identifier that provider gives us. Clerk also keeps your password (hashed, never in plain text) and a record of your sessions and sign-ins.

We need this to give you an account and keep you logged in. Legal basis: performing our contract with you (Art. 6(1)(b) GDPR).

5. When you use our apps

What you create in our apps — your documents, projects, settings and similar content — is stored in our database, which runs on Convex. We use it to provide the product to you and for nothing else. We do not sell it, and we do not use it to train AI models. Legal basis: performing our contract with you (Art. 6(1)(b) GDPR).

6. When you contact us

If you email us we keep the message and your address so we can reply and find the thread later. Legal basis: performing our contract with you, or our legitimate interest in answering questions (Art. 6(1)(b) and (f) GDPR).

7. Cookies

We set no advertising or tracking cookies, and there is no cookie banner because we do not need one. If you are logged in, Clerk sets a session cookie — that one is strictly necessary, because without it you would be logged out on every click.

8. Who else sees your data

We use a small number of service providers who process data on our behalf, under contracts that oblige them to follow our instructions (Art. 28 GDPR):

These providers are based in the United States, so your data can be processed there. Those transfers are covered either by the EU Commission’s Standard Contractual Clauses or by the EU–US Data Privacy Framework, depending on the provider.

Beyond that we share data only if you ask us to, or if the law requires it.

9. How long we keep it

  • Account data: until you delete your account. We then remove it within 30 days, except where we have to keep records for tax or accounting reasons.
  • App content: until you delete it, or until your account is deleted.
  • Emails: up to 24 months after the conversation ends.
  • Server logs: a short period, set by Vercel’s own retention policy.
  • Analytics: aggregate counts only, with nothing in them that identifies you.

10. Your rights

Under the GDPR you can ask us to:

  • tell you what data we hold about you, and give you a copy (Art. 15);
  • correct anything wrong (Art. 16);
  • delete your data (Art. 17);
  • restrict what we do with it (Art. 18);
  • hand it over in a portable format (Art. 20);
  • stop processing that relies on our legitimate interest (Art. 21).

Email legal@codity.app and we will handle it within one month. Asking costs you nothing, and we will not treat you differently for asking.

You can also complain to a data protection authority — either the one responsible for where we are based or the one where you live.

11. Children

Our products are not aimed at children under 16, and we do not knowingly collect their data. If you believe a child has given us data, email us and we will delete it.

12. Changes to this policy

If we change how we handle your data we will update this page and change the date at the top. If a change matters to you — a new service provider, a new purpose — we will tell account holders by email before it takes effect.