Privacy

What the app sends

Novadeck doesn’t send your code, terminals, agent chats or logs anywhere. Your agents talk to their own providers, as they do in your terminal. Novadeck itself goes online for updates, and for its local models if you turn those on.

An update check says why it ran, which version you have, and whether it’s installed or portable. No ID: the one its update library would add is left out.

Like any request, it also carries a few standard headers, your system’s language among them, and Cloudflare sees your IP address. We keep none of that but the country. From the checks we count copies open each hour, by channel and system, and launches each day, also by version, build and country.

If you send a note from the app’s feedback card, it goes to us as the card says: anonymous. It’s sent only when you press Send, and a note you haven’t sent stays on your computer. We keep what you wrote, the kind you picked if any, your version, system and chip, and the hour it arrived:

Nothing else of the request is kept, not even the country, so a note says nothing about who wrote it, unless you write that in it. Notes older than 12 months are deleted as new ones come in. For the same reason we can’t delete one on request: nothing ties it to you, so we couldn’t tell which is yours. Don’t put anything in a note you wouldn’t want us to keep.

We read the notes on a private page only we can open. Each night an AI model sorts the last month’s notes into themes for us: their text, kind, version, system and the day they came in go to it through OpenRouter, and only to providers that don’t train on what they’re sent. The themes it writes are kept for two months at most.

What the site counts

Opening a page or downloading adds a row like this:

For a visit, your system comes from your browser; your country and region come from Cloudflare. Via is set when you followed a download link from another page here: the part of the page it was in, and whether you’d tried the demo. The link carries those in its address, so nothing is stored in your browser. On a phone or tablet, the download buttons readGet Novadeck: the download page they open is marked as a hand-off asked for, and the link its Send to your computer button sends is marked too, so opening it on your computer, and a download from it, count as one that arrived. Those marks are in the links as well; your phone’s share sheet reports nothing back. A download keeps, instead of the page, which system it’s for, whether it’s the installer, the portable build or the install command, and the release.

Never kept:

• [NO]your IP address
• [NO]your browser’s full user agent, or its language
• [NO]cookies, visitor IDs or ad click IDs
• [NO]analytics scripts: the page reports nothing back while you read

The site keeps one thing in your browser: whether the screen effect is on, until you close the tab. The demo saves its own settings there, like the app does. Neither gets sent.

If you contribute

Before your first pull request to Novadeck merges, you sign its Contributor License Agreement. CLA Assistant, a free service SAP runs, records the signature on Microsoft Azure in Europe:

The form can fill in your name and email from your GitHub profile, and your pull request shows publicly whether you’ve signed. We need the record to make the agreement (GDPR article 6(1)(b)) and then to show it was made, our legitimate interest (article 6(1)(f)), for as long as we or anyone we license use your contributions, and until any claim about them runs out. To fix a detail, you sign again with the right one; we can’t erase the record while we need it to show the license. If the agreement passes to a company, as its section 8 allows, the record goes with it.

Who else sees your requests

• Cloudflare hosts the site, the demo, the app’s update checks and its feedback notes, so it sees your IP address, like any host.
• Downloads, updates and release notes come from GitHub.
• If you contribute, SAP runs CLA Assistant, which keeps your signature, and Microsoft hosts it in Europe.
• Voice input and the summarizer, if you turn them on, get their engines from GitHub and their models from Hugging Face.

Why, and who to ask

We count to know how many people use Novadeck, on what, and how they found it. That’s our legitimate interest under GDPR (article 6(1)(f)). We use your IP address only while a request is handled, to work out the country and region and to tell robots apart, and never store it; Cloudflare processes it for us under its data processing terms. What’s left says nothing about who you are, and we keep it for as long as it helps us run Novadeck. Signing the CLA is the one exception, as above.

Cloudflare, GitHub, Microsoft and Hugging Face are US companies, so your requests, and a CLA signature, may be handled outside the EU, under the EU–US Data Privacy Framework or standard contractual clauses, as their privacy policies describe.

Novadeck is run by Mateusz Pietrzak in Poland. Write to privacy@novadeck.dev with questions, to object to this counting, or to use your other GDPR rights: to see, correct or erase your data, or to limit its use, though nothing we keep can be matched to you unless you signed the CLA, and a signature can’t be erased while we need it. You can also complain to UODO, Poland’s data protection authority. What you write is used only to answer you.