Privacy Policy

The short version

• devboxes has no ads and no analytics from third parties. Error monitoring runs on our own Sentry instance on German infrastructure.
• Cloud Sessions run on dedicated servers in Germany. We don’t use the EU region of a US cloud.
• devboxes processes your code only to do the work you hand it and doesn’t use it to train models. Your agreement with your model provider decides whether that provider may train on Run content.
• When you send devboxes a task, the model provider you connect, such as Anthropic, processes the code and instructions of that Run.
• When an agent searches the web during a Session, the search query goes through Monid, which returns the results.
• Write to privacy@devboxes.ai to export or delete your data. Organization owners and admins can erase individual Sessions.

Who is responsible (controller)

Firat Özcan, a sole proprietor based in Germany, operates devboxes. The Imprint lists the postal address.

Write to privacy@devboxes.ai about anything related to your data.

What we process, and why

Website and contact form

Visiting devboxes.ai sets no cookies. When you write to us through the contact form, the website emails your email address and message to hello@devboxes.ai through Cloudflare Email Sending. The website doesn’t store your message.

Account data

You sign up with an email address and a password, or with your GitHub account. We use your email address to create and operate your account and organization membership.

Purchases

When you buy credits or subscribe to a plan, our payment provider Stripe processes the payment. We share purchase-related sign-in data with Stripe to defend payment disputes.

Repositories and code

When you connect repositories and send devboxes a task, devboxes accesses the repository metadata and code it needs for the task.

Cloud Sessions run in Germany. On your own machine (a Runner), the workspace and its checkout stay on that machine. The Session event stream still reaches our servers so you can follow and resume the Session. It includes commands, tool output and diffs.

The model provider you connect receives what the Run sends it.

Connected tools

When your organization connects Slack, Google Chat, Microsoft Teams, Linear or Jira, devboxes receives the messages and issues it is asked to work on and replies there. When devboxes is first called into an existing thread, it also receives that thread’s earlier messages. Those services process that data under their own terms.

devboxes’ use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Web search

Agents can search the web during a Session. The agent writes each search query from your task, so a query can contain names or terms from your task or code. devboxes sends the query to Monid from our servers and gives the results back to the agent. Queries and results appear in the Session transcript.

Run logs and transcripts

A Session produces a transcript: prompts, commands, tool events, diffs, and links to the pull requests devboxes opens. The members of your organization can read its transcripts.

Operational logs and error telemetry

Server logs and error reports help us keep the service secure and working. Server logs include IP addresses.

Error monitoring uses a Sentry instance we host ourselves on German infrastructure. We don’t send error data to Sentry, the company, or any other third party.

Legal bases (GDPR)

• Contract performance (Art. 6(1)(b) GDPR): everything needed to provide the service, including your account, connected repositories and tools, Runs, and transcripts.
• Consent (Art. 6(1)(a) GDPR): product updates. You can withdraw consent at any time.
• Legitimate interest (Art. 6(1)(f) GDPR): security, abuse prevention, keeping the service operational (server logs, error telemetry), and defending payment disputes.

Where your data is stored

The service runs on dedicated servers in Germany. We store Session data encrypted, and each Session runs in its own isolated workspace.

Who else processes data (subprocessors)

These third parties process data:

• Our hosting provider runs the devboxes servers, databases and cloud workspaces in Germany.
• Cloudflare provides DNS and CDN for devboxes.ai, stores session artifacts in Cloudflare R2, and delivers contact form messages to hello@devboxes.ai through Cloudflare Email Sending.
• GitHub and GitLab provide the repository integrations that let devboxes read your repositories and open pull requests or merge requests.
• The model provider you connect, such as Anthropic, receives the code, instructions, and tool context of each Run, under your own subscription or API key and that provider’s terms.
• Monid, Inc., based in the United States, runs the web searches agents make during a Session. devboxes sends each search query to Monid from our servers, and Monid passes it to its search provider TinyFish, which returns the results. devboxes sends them only the query text and adds no account name, email address or network address.
• Slack, Google Chat, Microsoft Teams, Linear and Jira process the messages and issues devboxes reads and writes there, under their own terms, once your organization connects them.
• Stripe processes payments when you buy credits or subscribe to a plan.

You choose which model provider to connect. devboxes sends Run content to that provider only while a Run works on your task.

How long we keep data

• Sessions: a Session’s Runs, transcript, events and artifacts stay until an owner or admin of its organization erases the Session. Erasing a Session deletes all of them.
• Chat conversations: until an owner or admin of the organization erases the conversation. Erasing a conversation keeps the Sessions it started.
• Account data: for as long as your account exists.
• Operational logs and error reports: only as long as security and debugging need them, then rotated out.

Your rights

Under the GDPR you have the right to:

• access your personal data
• have it corrected or deleted
• restrict or object to its processing
• receive it in a portable format
• withdraw any consent you have given
• complain to a data protection supervisory authority

Write to privacy@devboxes.ai to export or delete your data, or with any other request. Organization owners and admins can erase individual Sessions through the CLI.

Cookies

This website sets no cookies. The CLI stores a session token in a local configuration file on your machine, and the API uses it to keep you signed in.

Changes to this policy

When the product changes in a way that affects your data, we update this page and the date at the top. For material changes we will notify you in the product or by email.