Privacy Policy

1. Data we receive

• Account and service records: name and email, account/workspace membership and settings, authentication and OAuth connection/revocation records, subscription/payment-status and transaction references, and information you send in support or contact requests. Payment processing is handled by our payment provider; the ChatGPT tools do not request payment-card data.
• Coding activity: session, event, trace and call identifiers; timestamps; user/member, repository, file-path, branch and commit references; assistant/model and environment metadata; tool activity, exit status, token counts, costs, durations and measured code outcomes. Identifiers and derived labels can themselves identify people, projects or work.
• Optional recorded content: prompts, visible assistant replies, command text, tool arguments/results and errors, and file contents or source-code excerpts when included in telemetry or a session upload. Source instrumentation and upload settings determine what is transmitted. Metadata-only collection does not include message bodies; enabling content capture or uploading a content-bearing session adds them. Account content visibility is a separate read-time control, not a collection or deletion switch.
• ChatGPT tool requests: the arguments, filters, task text or draft plans listed below, together with the bearer credential needed to authenticate the request. CodeTelemetry receives the tool request, not the entire ChatGPT conversation. Text from that conversation can nevertheless be included in an argument that ChatGPT sends.
• Operational and website data: request/network metadata such as IP address, browser/client information, URLs, timestamps, trace/query IDs, status/errors, timings and request/response sizes; necessary sign-in and preference storage; and, if you allow optional website analytics, the marketing-page interaction data described in section 5.

2. Why we use data

We use these records to authenticate and isolate accounts, ingest and display coding history, search and retrieve recorded evidence, calculate usage/cost and workflow measures, build saved classifications and interpretations, compare sessions, provide history-informed planning, operate subscriptions and support, and diagnose abuse, failures and capacity. Classification and semantic retrieval can infer categories or patterns about coding activity; they are advisory and can be incomplete or wrong. They are not employment or other high-impact decisions.

CodeTelemetry does not sell coding telemetry and does not run model-training jobs using your coding history. Inference, classification and embedding processing described below still use data. This statement does not promise that every third-party service has identical training, retention or account settings.

3. Connected ChatGPT: requests and results

When you link CodeTelemetry and use its tools in ChatGPT, OpenAI sends an authenticated tool request to CodeTelemetry. We check your account, personal scope, grant and content-visibility rules, then return the requested result to OpenAI/ChatGPT. Attaching the plugin does not grant another customer’s or team’s history. The five tools are read-only: they do not execute commands, edit repositories, delete sessions or change issue trackers.

The table describes data each tool can receive or return. Availability, error and diagnostic messages can accompany any result. A linked session/event URL contains identifiers and is itself data sent to ChatGPT; opening it still requires the applicable CodeTelemetry access. Search results are not a guarantee that all returned titles, labels or identifiers are non-sensitive.

OpenAI processes tool inputs, results and the resulting chat under its separate terms, privacy policies and your ChatGPT/workspace settings. CodeTelemetry cannot set OpenAI’s retention, erase a ChatGPT conversation, or recall results already delivered. Use ChatGPT’s controls for those copies. Do not send credentials, government identifiers, payment-card details, health records or other restricted information in tool arguments or coding recordings.

OpenAI privacy policy

4. Recipients and processing providers

• Amazon Web Services (AWS) hosts our application, telemetry/database and object storage, operational logs, queues, backups and recovery snapshots. Amazon Cognito handles hosted sign-in; AWS messaging services deliver account and service notifications. The standard hosted environment is in the United States (AWS us-east-1).
• OpenAI receives connected ChatGPT tool requests/results. Separately, enabled semantic-retrieval features send bounded task or draft-plan text, saved interpretation summaries or taxonomy labels to the OpenAI API to compute embeddings. This feature is limited to configured eligible accounts. Lexical retrieval may be used when it is disabled or unavailable.
• Anthropic’s API processes selected captured prompt text and taxonomy context for enabled background use-case classification and session naming. Stored session interpretations and command/file hints also include deterministic processing within CodeTelemetry; invoking a saved-interpretation read does not itself request a new model analysis. Enabling content visibility is not a promise that previously ingested content has never been processed by a configured background worker.
• Microsoft receives optional public-marketing-page analytics through Clarity as described below. Stripe processes billing/payment information when you use paid CodeTelemetry services. The five ChatGPT tools do not initiate money transfers or investment trades.
• Authorized workspace members see data according to applicable membership, role and content policies. Integrations you separately enable (for example GitHub, Linear or Slack) receive the information needed for the requested integration action. Support correspondence is handled through our email/support services, including Gmail, and authorized personnel who need it to resolve your request.
• We may disclose records to comply with a binding legal requirement, address security or abuse, protect rights, or carry out a business transfer with applicable safeguards. Providers may process data in the United States or other locations under their applicable service terms. Contact us for current processing or contractual details; do not assume a particular provider retention or zero-data-retention agreement.

5. Website analytics and browser storage

Optional Microsoft Clarity analytics is off until you choose Allow optional analytics below. When allowed for an anonymous visitor on public marketing pages, it can receive page URLs/referrer information, device/browser/network metadata, pseudonymous cookie/session IDs, clicks, scrolling, page interactions, replay/heatmap data and audience-variant tags. It is not used to record signed-in customer pages, login/billing/invite routes or member-only session replays. These protections do not make public-page analytics anonymous or guarantee that every URL is free of personal information.

You can decline or withdraw optional analytics below. Your choice is stored in this browser’s local storage; clearing it returns to analytics off. We also keep analytics off when Global Privacy Control or Do Not Track is enabled. Necessary authentication and security storage remains available. Declining prevents future Clarity loading in this browser; it does not erase earlier data already received by Microsoft or remove cookies on Microsoft’s own domains.

Microsoft’s published Clarity schedule is 30 days for ordinary playback recordings and 9 months for click/heatmap data and labeled or favorited sessions. Microsoft processes this data under its own privacy statement, including its stated service-improvement uses. This is separate from coding-session retention and from ChatGPT settings.

Microsoft privacy statement · Clarity retention

6. Retention and expiry

The following are the standard hosted deployment’s configured lifecycles, verified November 2, 2026. They are not a promise of deletion at the exact second a period ends. Database expiry and physical cleanup are asynchronous; cold object storage follows database cleanup rather than an independent universal bucket-expiry rule. Separate stores can contain copies or derived information with different lifecycles.

Raw telemetry logs, traces and metrics (including optional content sent in them) become eligible for database expiry 365 days after their event timestamp. Many derived daily activity/evidence tables expire after 400 days; others use shorter schedules, including 365–367 days for some activity tables and hours for replaceable dashboard generations. These numbers do not apply to every derived record.

Materialized session-event pages, saved interpretation/evidence projections and their precedent records use a 30-day expiry from publication. Refreshing or rebuilding from retained source data can publish a new copy with a new expiry. Expired records are refused by readers; DynamoDB physical TTL cleanup can occur later. Short-lived caches, queues and transport sessions have their own shorter operational lifetimes and are not an archive.

Web/API and session-interpreter CloudWatch logs are configured for 14 days. Database diagnostic tables do not have automatic TTL expiry: scheduled maintenance removes eligible log partitions whose newest records are older than 31 days, and capacity limits can remove records earlier. Partition boundaries and maintenance failures can delay cleanup; crash logs use a capacity limit rather than an age deadline. Dedicated hosted-tool call logs record the tool, success/error category, a random trace ID, duration and byte counts, not tool argument/result bodies. Other database/infrastructure diagnostics can include identifiers, query text and request metadata; this is not a blanket claim that all operational logs are content-free.

Some account, billing/support, OAuth grant/revocation, saved title/taxonomy/enrichment and processing-control records have no automatic expiry. They are retained for the active account/history, support, accounting/dispute, security/revocation or operational purpose they serve, until a verified deletion request or operator cleanup removes them, subject to necessary legal/security exceptions. Disconnecting does not delete them. We do not offer an automatic account-wide deletion button or a universal fixed deletion deadline.

DynamoDB point-in-time recovery is enabled for relevant service tables with a 35-day recovery window. Separate manually created database/volume snapshots have no automatic expiry; they remain until an operator removes them when no longer needed for incident recovery, migration safety or legal preservation. These copies are access-restricted and not served by the plugin. An active-store expiry does not immediately erase an older backup. A deletion request must therefore address backup scope as well as active stores.

The standard schedules above are not automatically changed by buying a different workspace plan. Any different agreed schedule must be confirmed and implemented for that workspace; ask us before relying on it. OpenAI, Microsoft and other recipients retain their own copies under their respective terms and settings.

7. Your controls, export and deletion

• Choose which collectors/integrations and sessions to send, use their content-capture settings, and stop instrumentation or revoke an ingest key to stop future uploads. Read-time redaction does not remove data already ingested.
• On Account & privacy, set content visibility to Redacted to withhold captured content from covered reads, including the ChatGPT event/evidence paths. Redacted is the default. Choosing a wider content setting permits eligible content reads; it does not expand the hosted plugin beyond your personal scope. Team-ingested history has separate role/content policies.
• Filtering checks for credential-like content and withholds or shortens content under the applicable read controls. It is a safeguard, not a guarantee that all secrets, personal information, source code or identifiers will be detected. Review source-side capture settings and recordings before sharing them.
• Use Account → Disconnect ChatGPT for CodeTelemetry-side revocation: future requests are denied and active hosted sessions are closed. Reconnect requires a fresh eligible sign-in. Removing the plugin in ChatGPT is a separate action and does not by itself revoke the server-side grant. Neither action erases stored telemetry, derived data, backups or results already delivered to OpenAI.
• For access, correction, export or deletion, email elliot@codetelemetry.com or use Contact. Identify the account/workspace and requested scope; do not send passwords or API keys. We verify authority, review active stores and recovery copies, and explain the action we can take, timing, and any information retained for security, financial or legal reasons. These requests are handled manually; the plugin cannot perform deletion. For data controlled by an employer/workspace, an administrator may need to authorize the request.
• For ChatGPT copies and conversations, use OpenAI’s own privacy/data controls. For website analytics, use the choices in section 5 or contact us about an earlier recording.

Account & privacy · Privacy model · ChatGPT setup and disconnect · Contact · Email privacy requests

8. Security, policy changes and contact

Hosted access is authenticated and tenant-scoped, with scoped OAuth, transport encryption, access controls and encrypted AWS storage. Authorized operators may access data for support, maintenance, security or recovery. No security or redaction system eliminates every risk. We do not intentionally target children under 13; contact us if such data has been supplied so we can investigate and address it.

We update this page when our practices change and show the revision date above. For questions about Code Telemetry LLC’s processing, provider details or your rights and choices, contact elliot@codetelemetry.com. This policy describes CodeTelemetry’s practices; it does not replace the privacy policies of services you connect.