Legal

Privacy Policy

Last updated 14 October 2026

This policy explains what personal data CCode collects when you use ccode.si, app.ccode.si and the CCode API at api.ccode.si, why, who it’s shared with and what your rights are. CCode is responsible for this data (the “controller”). Questions and requests: support@ccode.si.

1. The short version

We collect what we need to run your account, bill you and keep the Service safe.
We don’t store the text of your prompts or of the answers. For each request we keep usage numbers: model, tokens, cost.
We don’t sell your data, we don’t use it for advertising, and we don’t use your content to train models.
We use no analytics, advertising or tracking cookies.

2. What we collect

Your account

Your email address, and your password, which our sign-in provider stores only as a hash.
If you sign in with or connect GitHub: your GitHub user ID, username and email address.
Your plan, credit balance and account history (credits added, used and expired), and the API keys you create: their names, limits and expiry dates. Keys themselves are stored only as hashes.

Your API requests

For each request: the time, the API key used, the model, the number of tokens, the cost, how long it took, whether it succeeded and, if it failed, the error message.
We don’t store the content of your requests (prompts, code, files) or the answers. They pass through our servers to produce the answer and aren’t kept. Error messages returned by a model are kept with the request record and in our logs, and occasionally quote a few words of a request.

Payments

For each invoice: what you bought, the amount, the coin and network, the status, the dates and the payment provider’s reference numbers.
We don’t store your wallet address. Our payment provider processes the transaction, and blockchain transactions, including wallet addresses and amounts, are public by nature.

Security and technical data

Your IP address and browser details when you sign up, sign in, reset your password or pay, and when an API request fails to authenticate. We use them to block abuse and limit repeated attempts.
The security check on those forms (Cloudflare Turnstile) looks at browser and device signals to tell people from bots.
Our servers keep technical logs (times, request IDs, errors) for troubleshooting and security.

Support

What you write to us and our replies.

3. Why we use it

To provide the Service: to create and run your account, process your requests, apply your plan and limits, and take payments. This is needed to perform our contract with you.
To keep records the law requires: invoices and payment records, under tax and accounting law.
To keep the Service safe: to prevent abuse and fraud, enforce the Acceptable Use Policy and fix problems. This is our legitimate interest in a secure, working service.
To improve the Service from aggregated usage numbers, such as which models are used and how often requests fail. This is our legitimate interest.
To talk to you: to answer your messages and tell you about important changes to your account, the Service or these policies. We don’t send marketing emails unless you’ve agreed to receive them.

5. Transfers outside Europe

Some of these providers process data outside the European Economic Area. Where the law requires it, we rely on the safeguards it provides for, such as the European Commission’s adequacy decisions and standard contractual clauses. Ask us at support@ccode.si for details.

6. How long we keep it

Account data and request records: while your account is open. When it’s closed, we delete them within 30 days, apart from what we must keep for billing.
Invoices and payment records: as long as tax and accounting law requires, which can be up to 10 years.
Security and server logs: only as long as needed for security and troubleshooting; they’re overwritten automatically.
Support emails: up to 2 years after the conversation ends.
Anything we must keep longer, to settle a dispute, prevent abuse or meet a legal duty, is kept only for that purpose.

7. Cookies

ccode.si sets no cookies.
app.ccode.si uses cookies only to keep you signed in, to return you to the right page after you sign up, and to remember whether the sidebar is collapsed. They’re needed for the app to work or set when you choose a setting, so they don’t need consent.
Cloudflare Turnstile runs on the sign-up, sign-in, password reset and checkout forms to protect them.
We use no analytics, advertising or tracking cookies. If that changes, we’ll ask for your consent first.

8. Your rights

Under data protection law (the GDPR), you can ask to see your data and get a copy, correct it, delete it, restrict or object to how we use it, and receive it in a portable format. Where we rely on your consent, you can withdraw it at any time.

Email support@ccode.si from your account’s email address. We reply within one month. You can also complain to the data protection authority where you live or work.

9. Security

Connections use HTTPS. Passwords and API keys are stored only as hashes. Access to our servers and admin tools is restricted and needs two-factor sign-in. No system is perfectly secure; if a breach affects your data, we’ll tell you as the law requires.

10. Children

The Service isn’t meant for children under 13, and we don’t knowingly collect their data; if you think a child under 13 has given us data, contact us and we’ll delete it. Users under 18 need a parent’s or guardian’s permission.

11. The CCode program

The CCode program runs on your device and keeps its settings, keys and sessions there. It doesn’t send us analytics. It sends your prompts and the content you work on to the model provider you configure; when that’s CCode, this policy covers those requests.

12. Changes

We update this policy when our practices change, and change the date at the top. For important changes, we’ll tell you by email or in your account before they take effect.