Privacy Policy

Last updated: October 18, 2026

Effective November 12, 2026.

Overview

Freebuff, Inc. (“Company”, “we”, “our”, or “us”) operates Freebuff and Codebuff, including our websites, apps, and other services (“Service”). This Privacy Policy explains how we collect, use, retain, and disclose information when you use Service. Our Terms of Service govern your use of Service.

Information We Collect

Depending on how you use Service, we may collect:

• Account and contact information, such as your name, email address, phone number, profile information, and identifiers from authentication providers.
• Prompts, messages, code, files, repository data, images, feedback, support messages, and other content you submit or connect, or that an agent reads or produces for you (“Prompt and Project Data”).
• Workspace and organization information, such as organization, workspace, administrator, role, and team-membership details.
• Usage and device information, such as your IP address, country, approximate location derived from IP, device, operating system, hardware, display, and system information, network performance, installed developer tools, app version and settings, features used, how you interact with Service and with ads, timestamps, installation or session identifiers, crash information, and diagnostic logs.
• Answers you give to onboarding questions and surveys.
• Device identification and network signals used to prevent duplicate accounts and abuse, as described in Device Identification below.
• Information from authentication, repository, AI, and other services you connect, according to the permissions you grant.
• Advertising and attribution information, such as campaign, referral, click, pixel, and conversion identifiers.
• Inferences such as advertising interests, profiles of the projects you work on, usage classifications, and fraud, abuse, or security scores.
• Transaction and billing information if we offer a paid product or service, such as purchase history, billing address, the last four card digits, and processor transaction identifiers. Full payment card details are handled by our payment processors rather than stored by us.

We collect this information directly from you, automatically from your use of Service, from services you connect, and from service providers. We may also receive information from business customers, teammates, referral partners, and public sources.

Prompts, Code, Files, and AI Providers

We process Prompt and Project Data to provide the features you request. Depending on the product, model, and account you use, that data may be processed by Company systems and by AI model providers. Providers may change over time. When you connect and use your own third-party account, that provider's terms and privacy practices may also apply.

Agents on Your Device

Agents in Freebuff Desktop and CLI run with the permissions of your device account. They can read files, run commands, and access environment variables and other data that account can access, including outside your project. We do not design agents to seek out credentials or unrelated personal data, but AI agents can act unpredictably, for example by taking steps unrelated to your request or following instructions found in files or web content, and we cannot guarantee what an agent will access. Anything an agent reads becomes Prompt and Project Data. To limit exposure, run agents in an isolated environment, such as a container or separate account, and keep secrets out of their reach.

Files Outside Your Projects

Freebuff Desktop and CLI do not scan your computer or read arbitrary files on it. Outside the projects you open, they read only:

• files an agent reads or that its commands use, as shown in the conversation;
• files and folders you choose to open, attach, or import;
• Freebuff's own files;
• settings, instructions, skills, and similar files for your shell, editors, Git, coding agents, and other developer tools; and
• information about your device, system, and installed software.

We may also copy skills and instructions you set up for coding agents to your account. Third-party agents and tools you use in Freebuff, such as Claude Code, Codex, or MCP servers, may access files under their own terms.

Abuse Detection and Safety Review

We may review Prompt and Project Data, including prompts, messages, and agent activity, to detect, investigate, and prevent fraud, abuse, security incidents, and violations of our Terms. This review may be automated, using Company systems and service providers acting on our behalf (for example, to classify how Service is being used or to identify accounts that submit the same or similar prompts), and authorized personnel may review specific content when needed. We may use the results to limit, suspend, or terminate accounts, and we may retain the relevant data and results as described in Retention.

Personalized Advertising

We may use Prompt and Project Data to personalize advertising shown within Service, including by deriving general interest categories and a general profile of the projects you work on, such as the languages, frameworks, tools, and services they use. To build these profiles, our applications may automatically review project files, such as configuration and documentation files, without a separate prompt from you.

Our apps may also collect signals for advertising, such as information about your device, operating system, hardware, display, and system state; network performance; installed developer tools, editors, and connectors; how you use the app, including typing, pointer, and focus activity and text you type before sending it; which ads appear on screen, for how long, and how you respond to them; and whether you later install or set up an advertised product. We use these signals only for advertising, including to select, deliver, measure, and improve ads, train the models that do so, and prevent ad fraud.

We and service providers acting on our behalf, including AI model providers, analyze this data to select, deliver, measure, and prevent fraud in advertising, and to train the models that do so. These providers may not use it for their own purposes except as permitted by law and our agreements with them. Content you include in a prompt, such as pasted text, attached files, or command output, is part of that prompt. We do not provide separately uploaded files, project files, or connected repository contents to advertising providers, and we do not target advertising based on sensitive characteristics such as race or ethnicity, religious or philosophical beliefs, health, sex life or sexual orientation, union membership, precise geolocation, or financial account information. Advertising and measurement providers may also receive limited identifiers and events needed for these purposes.

If you take part in a sponsored survey or sponsored task, its sponsor may receive your responses with general profile details, such as your role or team size, or a record of the task, including agent messages that may quote your code. With your permission, we may also share your email address with a sponsor.

Where required by applicable law, we provide choices concerning targeted advertising, sale or sharing of personal information, and related profiling. We honor legally recognized opt-out preference signals where required. In jurisdictions where these choices are not legally required, certain advertising processing may be necessary to use the free Service.

AI Training

Except to train the models we use to select and measure advertising, as described in Personalized Advertising, we do not use Prompt and Project Data to train our or third-party AI models unless, before you use the applicable model or feature, we clearly state that the data may be used for AI training. A label or notice such as May use data for AI training means that Prompt and Project Data submitted through that model or feature may be retained and used by Company or the applicable provider to train, evaluate, and improve AI models and products. We may also share, license, or sell that data, including agent traces, to third parties, such as researchers and companies, who may use it for AI training, research, and other commercial purposes. A general notice that data is collected or stored does not by itself permit these uses.

Phone and Identity Verification

To keep free access to one account per person, we may ask you to verify a phone number by text message, using an SMS provider acting on our behalf, and we check whether that number is already used by another account.

You may be able to verify your identity from your account settings, and when we need to confirm that an account belongs to a unique person (for example, an account that shares a device with another account, or that shows signs of abuse) we may require it, including before the account can keep using free features. Verification is performed by our processor Didit (Didit Identity S.L.). With your consent, Didit processes a photo of your government ID and a short selfie, including biometric data (a template of your facial geometry), and information about the network you connect from, to check that the document is genuine, that the selfie is a live capture that matches it, and whether the same face or document was already used for another Freebuff account.

We keep the result, the document's issuing country and type, a keyed hash of the document number, Didit's risk signals, and a record of the terms you accepted, but not your photos, selfie, name, or date of birth. We use these records to detect an identity used on more than one account or a false identity, which leads to the suspension of the accounts involved. Didit keeps its copy only for the retention period configured for our account, and biometric data is never retained longer than necessary for this purpose and in any case no longer than three years after your last interaction with us. When you delete your account, we ask Didit to erase your verification, except where the account was suspended for abuse.

Device Identification

To detect duplicate, shared, and automated accounts, we use Fingerprint (FingerprintJS, Inc.), a device-identification provider acting as our service provider. When you sign up on our website, Fingerprint's script collects technical attributes of your browser and device and returns a visitor identifier with a confidence score and signals such as whether a VPN, proxy, virtual machine, browser tampering, developer tools, incognito mode, or automation (a bot) was detected. Our CLI and desktop app send installation and machine identifiers, and our website sets a device cookie.

We store keyed hashes of these identifiers (not the raw values), with those signals and the networks an account uses, and compare them across accounts to find accounts that share a device or network. We use the results to require verification, limit access, or suspend accounts that break our Terms. We keep these records while the account exists and as long as needed to prevent abuse.

How We Use Information

We use information to:

• provide, maintain, personalize, and support Service;
• process prompts and generate requested output;
• save projects or conversation history when you request it;
• select and measure advertising as described in this Privacy Policy;
• perform the limited Codebase Evaluation described in this Privacy Policy;
• develop, test, evaluate, improve, and analyze Service;
• detect, investigate, and prevent fraud, abuse, security incidents, and violations of our Terms;
• communicate with you about Service and provide support;
• comply with law and protect our rights and users; and
• carry out another purpose we explain when collecting the information, with any consent required by law.

We will not use personal information for a materially different purpose without appropriate notice and any consent required by law.

Cookies, Local Storage, and Telemetry

Web portions of Service use cookies, local storage, and similar technologies for authentication, preferences, security, analytics, advertising, and attribution. Our products also send bounded usage, performance, and diagnostic events to analytics and observability providers.

Advertising and conversion events may include hashed identifiers, IP address, user agent, and source URL, but not prompt contents. Attribution information may be retained in first-party browser storage.

You can control cookies through your browser and any consent controls we make available. Some portions of Service may not work correctly if you block necessary storage. Because there is no common standard for “Do Not Track,” our websites do not currently respond to that signal.

How We Disclose Information

We may disclose information to:

• AI model providers, as described above.
• Hosting, storage, sandbox, database, security, support, analytics, and observability providers.
• Authentication and connected-service providers when you use or connect those services.
• Advertising and measurement service providers acting on our behalf, including providers that process prompts and messages for the purposes described above.
• Sponsors of surveys or tasks you choose to take part in, as described above.
• Third parties, such as researchers and companies, that license or buy data submitted through models or features labeled for AI training, as described in AI Training.
• Service providers and evaluation partners acting on our behalf for the limited Codebase Evaluation described above.
• Identity, phone, and device verification providers, as described above.
• Payment processors if you purchase a paid product or service.
• Government authorities or other parties when required by law or reasonably necessary to protect rights, safety, and security.
• A buyer, successor, or other relevant party in connection with a merger, financing, acquisition, reorganization, or sale of assets, subject to appropriate confidentiality protections.

We may also create and disclose aggregated or de-identified information that does not reasonably identify you.

We may sell data submitted through models or features labeled for AI training, as described in AI Training. Otherwise, we do not sell personal information for money. Certain disclosures to advertising or measurement partners may be considered a “sale,” “sharing,” or targeted advertising under some privacy laws even when no money changes hands. Rights and choices required by applicable law apply to those disclosures.

Legal Bases and International Transfers

Where applicable law requires a legal basis, we process personal information as necessary to perform our contract with you, comply with legal obligations, and pursue legitimate interests such as securing and improving Service, preventing abuse, and supporting our business. We rely on consent where required, including for certain advertising, cookies, connected services, or training uses associated with models or features identified for AI training. You may withdraw consent without affecting processing that occurred before withdrawal.

We are based in the United States, and we and our providers may process information in the United States and other countries. Where required, we use recognized safeguards for international transfers, such as adequacy decisions or contractual protections.

Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Please do not include passwords, private keys, access tokens, or other secrets in prompts or files unless a feature expressly requires them. If you believe an agent accessed a secret, rotate it and contact support@freebuff.com.

Your Choices and Privacy Rights

You may ask to access, correct, delete, or receive a copy of your personal information, or object to or restrict certain processing, by emailing support@freebuff.com. You may also opt out of marketing emails through the unsubscribe link and exercise any additional privacy rights available under applicable law. We may verify your identity before completing a request and may retain information when an exception under applicable law applies.

United States State Privacy Rights

Depending on where you live and whether the applicable law covers Company, you may have rights to know or access personal information, correct inaccuracies, delete information, obtain a portable copy, opt out of sale, sharing, or targeted advertising, limit certain uses of sensitive personal information, use an authorized agent, and appeal a denied request. We will not discriminate against you for exercising a privacy right. Submit a request or appeal by emailing support@freebuff.com.

European and United Kingdom Privacy Rights

If European or United Kingdom data-protection law applies, you may have rights to access, rectify, erase, restrict, or port your personal information and to object to processing. You may object at any time to processing for direct marketing, including related profiling. You may also lodge a complaint with your local data protection authority.

Children

Service is not intended for anyone under 18, and we do not knowingly collect personal information from anyone under 18. If you believe a minor has provided personal information, contact us so we can take appropriate steps to delete it.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated policy and revise the date at the top. We will provide advance notice when required by law or when a change materially affects your rights. An updated policy takes effect on its stated effective date.

Contact Us

If you have questions or want to exercise a privacy right, email us at support@freebuff.com.