Privacy Policy

Last updated 29 July 2026

Codex AI reads your code in order to fix it, so being straight with you about where that code goes matters more here than on most websites. This page says exactly what we collect, who else sees it, and how to get rid of it.

The short version

We do not sell your data. Not to anyone, for any purpose.
We do not train AI models on your code.
Your code is sent to our AI provider so that a reply can be generated. That is unavoidable — it is how the product works — and it is named below.
You can ask us to delete everything, and we will.

1. What we collect

Information you give us

Account: your email address, and a password stored only as an irreversible hash. If you sign in with Google we receive your email address and name from Google instead, and never see a password.
Your code: files you upload, and repositories you connect from GitHub — including private ones, if you grant that access.
What you type: the tasks and questions you send to the assistant, and the conversation that follows.
Payment: handled entirely by Razorpay. We never receive or store your card details. We keep the plan, the amount, the tax split and the payment reference.

Information we collect automatically

Country, worked out from your connection when you sign up, so we can apply the right tax and show sensible prices.
Usage counters: questions asked, tokens used, tool actions, machine seconds and the estimated cost — the numbers behind your plan limits.
Technical logs: IP address, request paths, timing and errors, kept for security, abuse prevention and debugging.

2. Why we use it

To run the service — read your code, answer, make changes, show you the diff.
To keep your account secure and stop abuse (rate limits, sign-up limits).
To apply your plan's limits and calculate what you owe.
To contact you about your account, including confirmation and payment emails.
To find and fix faults.

3. Who else sees your data

We use a small number of specialist providers. Each one gets only what it needs.

Provider	What it receives	Why
DeepInfra	Your task, the relevant parts of your code, and the conversation	Runs the AI model that produces the answer
Modal	A copy of the code for the task, in a throwaway machine that is destroyed afterwards	Where commands and tests actually run, safely away from our server
Neon	Your account, repositories, conversations and usage counters	Our database
Upstash	Short-lived counters keyed to your IP or account	Rate limiting and quotas
GitHub	Only what you authorise, if you connect a repository	Reading your repository and opening pull requests
Razorpay	Your payment details, directly — not through us	Taking payment
Google	Sign-in only, if you choose it	"Sign in with Google"
Sentry	Error reports, with personal details switched off	Telling us when something breaks
Our advertising partner	Only if you switch on "Earn while you work". An anonymous reference that identifies your reward, not you, plus what any website visit reveals: IP address, browser and approximate location	Showing the ads you earn from

We may also disclose information if the law requires it, or to protect our rights, our users or the public from harm.

3a. Advertising, and how to avoid it entirely

Codex AI shows no ads unless you ask it to. "Earn while you work" is off for every account. If you never switch it on, no advertising company receives anything about you at all — not your address, not a cookie, nothing.

If you do switch it on, ads are shown inside an isolated frame that cannot read your account, your session or anything else on the page. Our advertising partner never receives your email address, your code, your conversations, or anything you type into Codex AI. It sees a reference we generate that means "this reward belongs to this account" and nothing about who you are.

Advertising partners set their own cookies and similar identifiers inside that frame, and use them to choose which ads to show. You can turn earning off at any time from the ✕ on the panel or the button in the top bar, and the frame disappears with it.

4. Where your data is held

Our database and cache are hosted in Singapore. Our web service, our AI provider and our sandbox provider may process data in other countries, including the United States. By using Codex AI you agree to that transfer, which is necessary to provide the service.

5. How your code is protected

Traffic is encrypted in transit (HTTPS).
Code runs in a disposable sandbox, isolated from our server and from other customers, and destroyed at the end of the session.
GitHub access tokens are held in memory only — never written to our database, our logs or the sandbox.
Your repository is fetched without leaving any credential behind inside it.
Passwords are stored only as irreversible hashes.

No system is perfectly secure. Please do not put secrets — API keys, passwords, certificates — in code you connect, and rotate anything you think may have been exposed.

6. How long we keep it

Sandbox copies of your code: destroyed when the session ends.
Account, repositories and conversations: kept while your account is open, so you can come back to earlier work.
Payment and tax records: kept as long as Indian tax law requires.
Logs and counters: a short rolling window, then discarded.

7. Your choices

See or correct your data — email us and we will help.
Delete a repository or a conversation — from inside the app.
Delete your account and everything in it — email us and we will do it, normally within 7 days, apart from records we must keep for tax.
Withdraw GitHub access — at any time, from your GitHub settings. We lose access immediately.
Stop marketing email — we do not send any today; if that ever changes there will be an unsubscribe link.

8. Cookies and similar technology

We do not use advertising or tracking cookies, and there is no third-party analytics on this site. Your browser stores your sign-in token and your current session so the page can pick up where you left off. Clearing your browser storage signs you out.

9. Children

Codex AI is not for anyone under 18. We do not knowingly collect their information; if we learn that we have, we delete it.

10. Changes

If we change this policy in a way that materially affects you, we will tell you by email or in the app before it takes effect. The date at the top always shows the current version.

11. Contact

Questions, requests or complaints about privacy: sameerup1996@gmail.com. We reply within 2 working days.