01Scope
This policy covers the Codvian website at codvian.com, the Codvian dashboard at app.codvian.com, the Codvian Desktop application for Windows, the Codvian extension for Visual Studio Code, our documentation, and support. It explains what information is processed, where it is stored, who receives it, and the choices and rights you have.
02Account and profile
Sign-in uses your Google account through our identity service. We process the account identity needed to authenticate you and run your account — such as your name, email address and profile image. This account identity is held by our sign-in service and is not removed by deleting local data on a device.
03Data stored on your device
Codvian Desktop is local-first. The following is stored on your computer, per account, and is not synced or uploaded by Codvian:
- Chats, messages and attachments
- Memories and projects
- Chat workspaces for work without a project
- Settings and permission preferences
- Local diagnostics (counts and timings only)
Provider API keys you add are stored encrypted with your operating system keychain and are never sent anywhere except the provider you choose.
The Codvian extension for Visual Studio Code is likewise local-first. Your Codvian sign-in session, your Codvian API key and any provider keys you add are kept only in VS Code’s SecretStorage (your operating system keychain). Conversation history and the per-answer file checkpoints that power Undo are kept in VS Code’s own storage on your computer — never in your repository — and deleting a conversation removes it from that computer only.
04Usage logs and token metrics
When you use Codvian’s managed models we record usage metadata needed to meter credits and operate the service: timestamps, the model used, token counts, request and error counts, and the resulting credit charge. We use this to show your usage, enforce quotas and budgets, detect misuse, and keep the service reliable.
05API key metadata
If you create Codvian API keys, we store only metadata about them: a name, a short non-secret prefix, scopes, timestamps, and a SHA-256 hash of the key. We do not store the key itself — the full secret is shown once at creation and cannot be recovered afterwards.
06Data sent to your model provider
When you run a request with your own provider key, Codvian sends it only to the provider you selected. This can include:
- Your message and the chat’s context
- File contents and tool results the agent uses for the task
- Attachments you include
Retention and use of that data follow the provider’s own terms. When you use a local model server such as Ollama or LM Studio, inference runs on the machine you configure.
07Codvian-managed models (paid with credits)
When you use a Codvian-managed model, the prompts, code context and tool results needed for the request — your message, the chat’s context, and the file contents, tool results and attachments the agent includes — are sent from Codvian Desktop, the Codvian extension for Visual Studio Code, or your API client to the CODVIAN gateway. The gateway forwards them to Concentrate AI, which routes them to the model provider it selects to serve your request; the response comes back the same way. CODVIAN selects the upstream path through Concentrate AI, so you do not choose the provider yourself for a managed model.
For each managed-model request, CODVIAN records usage metadata needed for billing, limits and support: the model, token counts, provider cost, credits charged, status, error code and timing. This run summary never includes your prompts, file paths or file contents. The content of a request may be processed by Concentrate AI and the model provider it selects to produce a reply; retention and use of that content follow their own terms. We do not claim zero data retention and we have no data-processing agreement with Concentrate or the providers to represent here.
08Service providers we use
- Clerk — sign-in and account identity (Google sign-in)
- Razorpay — payment processing
- Hosting and infrastructure providers — run the Codvian API, its database, this website and the dashboard
- Concentrate AI — the upstream inference gateway that routes Codvian-managed model requests to the model provider it selects
- AI model providers — process Codvian-managed model requests (selected and reached through Concentrate AI) to generate replies
- Google AdSense — may serve advertising on the blog pages only, when advertising is enabled
- Email delivery provider — sends transactional and support email
- Website analytics — measures website usage, only with your consent
Each processes data only for the purpose listed, under its own terms.
09Payments
Credit purchases are processed by our payment processor, Razorpay. We store references needed to operate your account and support you — such as a payment or order identifier, amount, currency, status and date — and the credits granted. We do not store your full card number or other complete card data; that is handled by the payment processor. Payment confirmations and receipts are sent by Razorpay to the email used at checkout, where Razorpay provides them. Your purchase history is always shown under Billing.
10Device and session
To keep your account secure and sync entitlements we may record device and session information associated with your account, such as a device identifier for Codvian Desktop and when a device was first and last seen. You can review the devices seen for your account in the dashboard.
11Website analytics and cookies
The website uses only an essential cookie to remember your cookie choice. With your consent, it also loads Google Analytics (measurement ID G-WJTG4SQ579) to understand how the site is used. Nothing analytics-related loads until you choose “Accept all”, or switch on non-essential cookies under “Customize” and save. You can change or withdraw this at any time with “Manage cookie preferences” on the Cookie Policy page. We never send tokens, emails, API keys or secret query strings to analytics. See the cookie policy.
Advertising on the blog: ads may be shown on the blog pages (codvian.com/blog) when advertising is enabled. Where ads are served, Google AdSense may use cookies to serve and measure them. The AdSense code is loaded only on blog pages and never on any other part of the site. See Google’s advertising policies at https://policies.google.com/technologies/ads.
12Retention
We keep account, usage, payment-reference and security information for as long as your account is active and as needed to provide the service, meet legal, tax and accounting obligations, resolve disputes and enforce our terms, after which it is deleted or anonymised per our documented process. Data stored only on your device remains until you delete it.
13Your rights (DPDP Act, 2023)
If you are in India, the Digital Personal Data Protection Act, 2023 gives you rights over your personal data, which we support:
- Access: a summary of the personal data we process about you and how.
- Correction and completion: correct inaccurate or incomplete data.
- Erasure: delete personal data we no longer need to keep.
- Grievance redressal: raise a complaint and receive a response.
- Nomination: nominate another individual to exercise your rights in the event of death or incapacity.
To exercise any of these, or to raise a grievance, contact us at support@codvian.com. We acknowledge requests and respond as soon as reasonably possible.
14Export and deletion
- Export: Settings → Data & Privacy → Export my data creates a JSON file with your projects, chats, memories, artifacts and settings.
- Delete local data: remove chats, memories, diagnostics, this account’s data, or everything on the device from Settings → Data & Privacy.
- Delete your account: request account deletion through support@codvian.com. Data held by your model providers is managed with each provider.
Uninstalling Codvian may leave local data in place. Delete it in the app first if you want it gone.
15Security
We protect the information we handle with reasonable technical measures, including encrypted key storage, hashed API keys and HTTPS. No system is perfectly secure; keep backups of your projects and protect your Google account.
16Changes and contact
We will update this page when our practices change and revise the date shown. Privacy questions or requests: support@codvian.com.
Last updated: 31 October 2026.