Privacy Policy

How devboxes handles your personal data under the GDPR.

Last updated

The short version

  • devboxes has no ads and no analytics from third parties. Error monitoring runs on our own Sentry instance on German infrastructure.
  • Cloud Sessions run on dedicated servers in Germany. We don’t use the EU region of a US cloud.
  • devboxes processes your code only to do the work you hand it and doesn’t use it to train models. Your agreement with your model provider decides whether that provider may train on Run content.
  • When you send devboxes a task, the model provider you connect, such as Anthropic, processes the code and instructions of that Run.
  • When an agent searches the web during a Session on our servers, the search query goes through Monid, which returns the results. On a Runner, the query goes from your machine to Exa.
  • Write to privacy@devboxes.ai to export or delete your data. Organization owners and admins can erase individual Sessions.

Who is responsible (controller)

Firat Özcan, a sole proprietor based in Germany, operates devboxes. The Imprint lists the postal address.

Write to privacy@devboxes.ai about anything related to your data.

What we process, and why

Website and contact form

Visiting devboxes.ai sets no cookies. When you write to us through the contact form, the website emails your email address and message to hello@devboxes.ai through Cloudflare Email Sending. The website doesn’t store your message.

Account data

You sign up with an email address and a password, or with your GitHub or Google account. You can also sign in with a code we email you. We use your email address to create and operate your account and organization membership.

We send sign-in codes, address confirmations and invitations through Cloudflare Email Sending.

Purchases

When you buy credits or subscribe to a plan, Stripe sells them to you through Link as the merchant of record. Stripe processes your payment, billing and order data under its own privacy policy and sends your receipts and invoices. We share purchase-related sign-in data with Stripe to defend payment disputes.

Repositories and code

When you connect repositories and send devboxes a task, devboxes accesses the repository metadata and code it needs for the task.

Cloud Sessions run in Germany. On your own machine (a Runner), the workspace and its checkout stay on that machine. The Session event stream still reaches our servers so you can follow and resume the Session. It includes commands, tool output and diffs.

The model provider you connect receives what the Run sends it.

Connected tools

When your organization connects Slack, Google Chat, Microsoft Teams, Linear, Jira, Discord or Telegram, devboxes receives the messages and issues it is asked to work on and replies there. When devboxes is first called into an existing thread, it also receives that thread’s earlier messages. Those services process that data under their own terms. Google Chat delivers its messages to devboxes through Google Cloud Pub/Sub in devboxes’ own Google Cloud project.

devboxes’ use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Web search

Agents can search the web during a Session. The agent writes each search query from your task, so a query can contain names or terms from your task or code. In a Session on our servers, devboxes sends the query to Monid from our servers and gives the results back to the agent. On a Runner, the agent uses OpenCode’s built-in Exa search, which sends the query from your machine to Exa. Queries and results appear in the Session transcript.

Run logs and transcripts

A Session produces a transcript: prompts, commands, tool events, diffs, and links to the pull requests devboxes opens. The members of your organization can read its transcripts.

Operational logs and error telemetry

Server logs and error reports help us keep the service secure and working. Server logs include IP addresses.

Error monitoring uses a Sentry instance we host ourselves on German infrastructure. We don’t send error data to Sentry, the company, or any other third party.

We trace Runs and Chat turns to debug them, in a Langfuse instance we host ourselves on the same servers. We don’t send trace data to Langfuse, the company.

Data processing agreement

For the data of your organization’s work, devboxes processes personal data on your organization’s behalf. Our data processing agreement (Art. 28 GDPR) covers that processing once your organization concludes it: send it signed, or accept it by email, to privacy@devboxes.ai.

Legal bases (GDPR)

  • Contract performance (Art. 6(1)(b) GDPR): everything needed to provide the service, including your account, connected repositories and tools, Runs, and transcripts.
  • Consent (Art. 6(1)(a) GDPR): product updates. You can withdraw consent at any time.
  • Legitimate interest (Art. 6(1)(f) GDPR): security, abuse prevention, keeping the service operational (server logs, error telemetry), and defending payment disputes.

Where your data is stored

The service runs on dedicated servers in Germany. We store Session data encrypted, and each Session runs in its own isolated workspace.

Who else processes data (subprocessors)

These third parties process data:

  • Hetzner Online GmbH, our hosting provider, runs the devboxes servers, databases and cloud workspaces in Germany.
  • Cloudflare provides DNS and CDN for devboxes.ai and protects the service from attacks, so requests to devboxes pass through Cloudflare. It stores Session artifacts and our encrypted backups in Cloudflare R2 in the EU, and sends our account emails and contact form messages through Cloudflare Email Sending.
  • GitHub and GitLab provide the repository integrations that let devboxes read your repositories and open pull requests or merge requests.
  • The model provider you connect, such as Anthropic, receives the code, instructions, and tool context of each Run, under your own subscription or API key and that provider’s terms.
  • OpenAI runs devboxes’ own model, which the onboarding and calibration Sessions of a new Project on our servers use to read its repository.
  • Monid, Inc., based in the United States, runs the web searches agents make during a Session. devboxes sends each search query to Monid from our servers, and Monid passes it to its search provider TinyFish, which returns the results. devboxes sends them only the query text and adds no account name, email address or network address.
  • Exa receives the web searches of agents on a Runner, sent from that machine by OpenCode’s built-in search.
  • Slack, Google Chat, Microsoft Teams, Linear, Jira, Discord and Telegram process the messages and issues devboxes reads and writes there, under their own terms, once your organization connects them.
  • Google Cloud delivers Google Chat messages to devboxes through Pub/Sub, and Google signs you in when you continue with Google.
  • Stripe sells credits and plans through Link as the merchant of record and processes the payment.

You choose which model provider to connect. devboxes sends Run content to that provider only while a Run works on your task.

How long we keep data

  • Sessions: a Session’s Runs, transcript, events and artifacts stay until an owner or admin of its organization erases the Session. Erasing a Session deletes all of them. The onboarding and calibration Sessions devboxes runs for a new Project stay until the organization is deleted.
  • Chat conversations: until the organization is deleted. When a person deletes their message in Slack, Google Chat, Microsoft Teams or Discord, devboxes deletes its copy. Telegram doesn’t report deletions, so devboxes keeps its copy of a Telegram message.
  • Account data: for as long as your account exists.
  • Operational logs: only as long as security and debugging need them, then rotated out.
  • Error reports: 90 days.
  • Security audit log: 180 days.
  • Traces of Runs and Chat turns: 30 days. Media that Langfuse extracts from them, such as images, stays.
  • Backups: up to 38 days. Data you erase stays in backups until they expire.

Your rights

Under the GDPR you have the right to:

  • access your personal data
  • have it corrected or deleted
  • restrict or object to its processing
  • receive it in a portable format
  • withdraw any consent you have given
  • complain to a data protection supervisory authority

Write to privacy@devboxes.ai to export or delete your data, or with any other request. Organization owners and admins can erase individual Sessions through the CLI.

Cookies

This website sets no cookies. The CLI stores a session token in a local configuration file on your machine, and the API uses it to keep you signed in.

Changes to this policy

When the product changes in a way that affects your data, we update this page and the date at the top. For material changes we will notify you in the product or by email.