Privacy Policy

1. Information We Collect

1.1 Account Information

When you create an account, we collect your email address and a securely hashed password (bcrypt). If you sign in via OAuth (Google, GitHub, Microsoft), we receive your name and email from the identity provider. We never receive or store your OAuth password.

1.2 Device Information

When you link a VS Code installation, we store a locally generated device UUID, a human-readable device name (which you can customize), operating system type, and architecture (e.g., x64, arm64). This information is used to manage device-tunnel associations and display them on your dashboard.

1.3 Tunnel Configuration

When you create a tunnel, we store the subdomain, target port, expiry settings, and connection status. This data is necessary to operate the tunnel service, manage DNS records, and display tunnel status on your dashboard.

1.4 Billing Information

Payment processing is handled by our third-party payment processor. We do not store credit card numbers, bank account details, or other payment credentials on our servers. We receive and store subscription status, plan type, and billing cycle dates.

1.5 Server Logs

Our servers may log IP addresses, request timestamps, and HTTP methods for security monitoring, rate limiting, and abuse prevention. Server logs are retained for a maximum of 30 days and are not used for analytics or marketing.

2. Information We Do NOT Collect

MR Coder is architected so that sensitive data never reaches our servers:

• Source code & files. Your code, project files, and terminal output stay on your local machine. Tunnel traffic is end-to-end encrypted between your device and the browser client via Cloudflare — we cannot inspect it.
• API keys & credentials. All AI provider API keys are stored in your operating system's secure credential store (VS Code SecretStorage). They are never transmitted to mr-coder.io or stored in our databases.
• AI conversations. Chat messages, prompts, and AI responses are stored locally on your machine. We do not receive, process, or store any AI conversation data.
• Extension telemetry. The MR CoderVS Code extension sends zero telemetry. No usage analytics, no crash reports, no "anonymous" data collection.
• Tunnel tokens. Cloudflare tunnel tokens are generated and used locally. They are never displayed in the UI, returned in API responses, or stored in logs.

3. How We Use Your Information

We use collected information solely to:

• Authenticate your identity and manage your account.
• Create and manage Cloudflare tunnel configurations and DNS records.
• Process subscription payments and manage billing cycles.
• Send transactional emails (account verification, password reset, device linking confirmations).
• Monitor for abuse, fraud, and security threats.
• Enforce our Terms of Service and Acceptable Use policy.

We do not use your data for advertising, marketing profiling, or sale to third parties.

4. Data Sharing & Third Parties

We share data only with:

• Cloudflare — Tunnel infrastructure and DNS management. Cloudflare processes tunnel traffic under their own privacy policy.
• Payment processor — Subscription billing and payment processing. They receive only the data necessary to process payments.
• Email service — Transactional emails (verification, password reset). Only your email address is shared.

We do not sell, rent, or trade your personal information to any third party for any purpose.

5. AI Provider Data Handling

When you use AI providers through MR Coder, your prompts and code are sent directly from your machine to the AI provider's API. MR Innovations does not act as an intermediary and does not have access to this data. Each provider has its own data handling policies:

• Ollama (local) — All processing occurs on your machine. No data is sent to any server.
• API-based providers (Claude, OpenRouter, HuggingFace, Qwen, Codex, Gemini) — Data is sent to the provider's servers under their terms. Review each provider's privacy policy before use.
• CLI-based providers (Kilo Code, iFlow) — The CLI handles its own data routing. Refer to the CLI provider's documentation.

6. Data Storage & Security

• Account data is stored in encrypted databases with access controls.
• Passwords are hashed using bcrypt with salt rounds — we cannot read your password.
• All connections to mr-coder.io use TLS 1.2+ encryption.
• Tunnel traffic flows through Cloudflare's global network with end-to-end encryption.
• Session cookies are HttpOnly, SameSite=Strict, and Secure.
• API rate limiting and brute-force protection are applied to all authentication endpoints.

7. Data Retention

• Account data — Retained while your account is active, plus 30 days after deletion to allow recovery.
• Tunnel configurations — Deleted immediately when you delete a tunnel. Suspended trial tunnels are purged after 90 days.
• Server logs — Retained for a maximum of 30 days.
• Billing records — Retained as required by applicable tax and financial regulations (typically 7 years).

8. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access — Request a copy of the personal data we hold about you.
• Correction — Request correction of inaccurate personal data.
• Deletion — Request deletion of your personal data (available via dashboard settings).
• Data portability — Request your data in a machine-readable format.
• Restrict processing — Request that we limit how we use your data.
• Withdraw consent — Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

9. Cookies

mr-coder.io uses only essential cookies required for authentication and session management. We do not use advertising cookies, analytics cookies, or third-party tracking cookies.

• Session cookie — Authenticates your login session. HttpOnly, Secure, SameSite=Strict. Expires when you sign out or after 30 days.
• CSRF token — Protects form submissions. Session-scoped.

10. Children's Privacy

The Service is not intended for users under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.

11. International Data Transfers

Your data may be processed in jurisdictions outside your country of residence, including countries where Cloudflare operates edge servers. We ensure that appropriate safeguards are in place for international transfers in compliance with applicable data protection laws.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a prominent notice on the Service at least 30 days before they take effect. The "Effective date" at the top reflects the most recent revision.

13. Contact

For privacy-related questions, data requests, or concerns, contact our privacy team at [email protected] or visit our contact page.