Privacy Policy

CuttleCode runs on your own machine, and it works fully without an account. Cloud sync starts when you sign in to CuttleCode Cloud from an install, which links that install to your account, so your projects and settings can follow you to your other machines. An install you never link sends nothing.

You stay in control of it. You can switch sync off for any machine in its Settings, and you can revoke a linked device from your account at any time.

With cloud sync on, these things are copied to our database:

• Your profile: display name and avatar URL. Your email address stays with your sign-in account rather than your profile; see signing in.
• Workspaces, their members and roles, and invitations. An invitation holds the invitee’s email address so we can send it.
• A list of the devices you have linked: name, platform, app version, permissions and when each last checked in, so you can see and revoke them.
• Projects and repository identity: project name and description, whether it is archived, repository name, remote URL and default branch.
• The full text of your project configuration (things like CLAUDE.md, agents.json, your skills, wiki pages and automations), plus earlier versions so you can look back and recover them. Files over 512KB and files containing binary data are skipped.
• Your project secrets, encrypted. See how secrets are handled below.
• Run history: one record per pipeline, trigger or agent run, with its title, summary, status, cost and details, and the artifacts those runs produced. Artifact contents up to 512KB are stored inline.
• Daily usage counters per project, install and model: how many tokens were used and how many sessions ran. These are numbers only, never what was said in a session.
• Personal preferences that follow you between machines: favourite projects, starred agents, and the plugins you have installed, with their versions and settings. Secret plugin settings travel encrypted, like other secrets, and settings that belong to one machine stay on it.

Everything above is there to make CuttleCode work for you. We use it to:

• keep your machines in agreement, which is the point of sync;
• show you your own run history and usage;
• apply your plan’s limits and keep billing accurate;
• keep the service healthy and make it better for the people using it.

That last one means a small number of CuttleCode team members can see an internal overview of accounts. For each account it shows the email address, when it signed up and last signed in, its plan, how many devices it has linked and on which platforms, and day-by-day counts of active days, sessions, runs and tokens.

It helps us notice when someone signs up but never manages to link a device, so we can fix whatever stopped them. It also shows us which features people actually rely on, so we know what to build and what to leave alone. And it warns us early when the service struggles to keep up with real use.

The overview works from counts and account details only. It never shows your config files, prompts, code, run titles or summaries, or secrets, and your sessions never reach the cloud in the first place. Access is limited to named team accounts and is checked by the database on every request, not just hidden in the interface. Nothing is copied out into a separate profile: the figures are calculated from the data described above each time the overview is opened, so when that data is deleted, it drops out of the overview too.

We do not sell this information, use it for advertising, share it with anyone outside CuttleCode, or use it to train AI models. We rely on our legitimate interest in running and improving the service, and on providing the service you signed up for. If you would rather not be included, write to the address at the end of this page and we will talk it through with you.

An admin of a CuttleCode install can choose to share a small daily summary with us. It is off unless someone turns it on in Settings. The summary is counts and categories, such as how many sessions ran, which kinds of automation were used and which app version is installed. It helps us see what works for people across different setups, and fix what doesn’t.

It never contains prompts, transcripts, code, file paths, project or repository names, email addresses or secrets: every field comes from a fixed list. Settings shows you the exact text before it is sent, and the last thing that was sent. Installs and workspaces appear only as one-way hashes, so the summary is pseudonymous rather than anonymous: we can tell two days came from the same install, but the summary does not name you.

Only linked installs can send it. Turning it off stops the next send, and “Delete my fleet data” in Settings erases everything that install has sent.

These are never sent to the cloud, in either direction, whether or not sync is enabled:

• Your sessions: terminal output, scrollback buffers and transcripts of what you and the agents said.
• Your source code, your git worktrees, and your git history.
• The filesystem path of any checkout. The cloud repository record stores identity only — there is no column for a local path.
• Your local secrets file and your codemap snapshots. Secrets reach the cloud only as encrypted values; see below.
• Your model-provider credentials, such as your Anthropic or OpenAI keys and sign-ins. You run CuttleCode with your own accounts, and we never hold those credentials.
• Search embeddings and local caches.

The exclusion list is enforced three times over: the scanner skips those paths, no API route can queue one, and anything arriving from the cloud is checked against the same list before it is written to disk. A row planted by a hostile or out-of-date client still never lands on your machine.

Cloud access tokens are also kept out of the environment CuttleCode gives to the agents it spawns. Agents talk to the CuttleCode server on your own machine, with a local token.

Where the cloud does handle a token — a workspace invite, a device linking code, a sign-in handoff — it stores only a hash of that token, never the token itself. The usable value exists only in the hands of the person it was issued to.

Secret values are encrypted on your machine before they are sent, and we receive ciphertext only. The cipher is AES-256-GCM, using a 32-byte key that belongs to your workspace.

That key is not stored in the database. The database column holds an identifier pointing at Supabase Vault, where the key is sealed at rest. A dump of the secrets table, or a copy of a database backup, therefore carries no usable key material. Reading the key at all goes through a single membership-checked, audit-logged path.

That same path is what lets a new machine pick up your secrets without you copying anything by hand. When you link another device to the workspace, it receives the workspace key, downloads your secrets as ciphertext and decrypts them locally.

Three things about this we would rather state plainly than bury:

• We can decrypt your secrets. The key is sealed from the database, not from us. That is what makes unattended scheduled runs and new-device setup possible. This is not end-to-end encryption, and we will not describe it as such. Projects you share with other people work differently; see sharing a project.
• Only the value is encrypted. A secret’s name and its description are stored as plain text, so avoid putting anything sensitive in the name.
• You can move secrets without the cloud. CuttleCode’s export-secrets and import-secrets commands produce and read a passphrase-encrypted file that never touches our servers.

You can share a project’s CuttleCode setup with people outside your workspace: its agents, CLAUDE.md, skills, wiki, memory, repository addresses and, if you choose, its pipelines and automations. All of it is encrypted on your device before it is uploaded, and the cloud never receives the keys. We cannot read what you share.

To deliver it, the cloud stores the encrypted copy along with routing details: account and device IDs, invited email addresses, membership, and timestamps. Your source code is not part of a share. Collaborators get repository access from your git host as usual, and secrets, sessions and run history are never included.

An invitation link carries a short, readable preview so the person you invite can see what they are joining: project and agent names, skill summaries, repository names and similar counts. Anyone holding the link can read that preview, so share links the way you would share that information. If you remove someone, they lose access to future changes but keep anything they already downloaded.

cuttlecode.dev is a static site. It sets no cookies of its own and loads no analytics, tag manager or other third-party tracking scripts. We do not track you across the web.

The site has no forms that collect personal information. Like any web host, Vercel processes standard request details, such as your IP address and browser type, to serve and protect the site. If you email us, we use your message only to reply.

Synced data is stored in a Postgres database hosted by Supabase in the us-east-1 region, in the United States. If you are outside the United States, using cloud sync means your data is transferred there.

We are on Supabase’s Pro plan, which takes automated daily backups of the database. Point-in-time recovery is not enabled. That means a restore returns the database to a daily backup, not to an arbitrary moment, and data written since that backup would be lost.

For the same reason, do not treat cloud sync as a backup of your work. It is a way to keep machines in agreement. Your own git remote is the thing that actually backs your config up.

Accounts are handled by Supabase Auth. You can sign in with an email address and password, or with GitHub, Google or Discord. When you use a social provider, we receive the basic profile it hands over — typically a display name, an avatar URL and the email address on the account.

Your sign-in account holds your email address, the sign-in methods you have connected, and when you signed up and last signed in. That is what lets you sign in, recover your account and get emails about it.

Your profile, which other parts of CuttleCode use, is narrower: a display name and an avatar URL. It has no email address, and a profile is readable only by the person it belongs to.

When you sign up with an email address and password, we send a confirmation email first, so nobody can create an account with an address they do not control.

Deleting a workspace removes its synced data. Everything in the cloud hangs off the workspace record (projects, config, secrets, run history, usage counters), so when the workspace goes, those rows go with it.

Smaller deletes work differently, and we would rather say so than let you assume otherwise. Deleting a single project, repository, config file or secret marks the cloud row as deleted rather than erasing it immediately, so your other machines learn about the deletion instead of re-uploading the thing you just removed. Run history is kept in the same way and outlives the project it came from.

Earlier versions of your config files are kept so you can look back and recover them. They are removed when the workspace is deleted.

Your project configuration already lives as ordinary files on your machine, so you always have your own copy, and agents can be exported individually. Secrets move separately with the passphrase-encrypted export described above. For a copy of anything we hold in the cloud, or to delete your account entirely, write to the privacy address at the end of this page.

These providers support the service:

• Supabase — the database, authentication and functions behind CuttleCode Cloud.
• Stripe — Managed Payments checkout, payment methods, and invoices through Link, the merchant of record for these purchases. Payment details are entered directly into Stripe’s secure form. CuttleCode stores customer and subscription identifiers, plan and seat counts, and payment status. Your billing contact and masked payment details are available to your workspace’s billing managers; full card numbers are not stored in CuttleCode. Stripe and Link receive the payment, billing, and device information needed to process transactions, prevent fraud, handle tax, and provide order support, under their own privacy policy. Link sends receipts and supports saved-card updates, billing addresses, refunds, and order management. Deleting your Link payment data can cancel subscriptions sold through Link.
• Postmark — sends account emails, such as sign-up confirmations and password resets. It receives the email address and the message it delivers.
• Vercel — hosting for this website and the CuttleCode Cloud web app.
• Cloudflare — DNS for our domains. It also forwards requests from older CuttleCode versions to our current cloud address, so those installs keep working.
• Your model providers — Anthropic, OpenAI or whichever providers you choose to use. CuttleCode talks to them from your machine with your own credentials. Your prompts go to them directly; we do not route them, and we never hold those credentials. Their own terms and privacy policies apply.

We do not sell your data, and we do not share it with advertisers or data brokers.

The rest of this policy describes what the software actually does, and every claim in it is checked against the code.

The entity responsible for this service — the data controller — is Restart Labs LLC, a Texas limited liability company, at 5900 Balcones Drive, Suite 100, Austin, TX 78731, United States.

To ask a question about your data, or to ask us to delete or export it, write to privacy@restartlabs.ai. We read it. We have not set a response-time commitment, so we are not going to print one.

Users in the European Union and California are welcome to sign up. Write to the address above to exercise the rights those laws grant you — access, correction, deletion, portability, objection, and the right not to have your data sold. We do not sell your data to anyone, so there is nothing to opt out of.

Two things we should say plainly rather than let you assume. We do not currently offer a Data Processing Agreement, and we have not appointed an EU representative. If your organisation needs either one before it can use CuttleCode Cloud, we are not ready for you yet — tell us and we will say honestly where we are.

Treat this page as a description of how CuttleCode handles data, not as a statement of legal compliance.