Privacy Policy

Last updated: 10/08/2026

Effective September 2, 2026.

Overview

Freebuff, Inc. (“Company”, “we”, “our”, or “us”) operates Codebuff and Freebuff CLI, Freebuff Web, Freebuff Cloud, Freebuff Chat, and Freebuff Desktop. This Privacy Policy explains how we collect, use, retain, and disclose information when you use our websites, applications, software, and other products and services (collectively, “Service”). Our Terms of Service govern your use of Service.

Information We Collect

Depending on how you use Service, we may collect:

• Account and contact information, such as your name, email address, profile information, and identifiers from authentication providers.
• Prompts, messages, code, files, repository data, images, feedback, agent activity and tool traces, support communications and attachments, information about third parties, and other content you submit, connect, create, or modify through Service (“Prompt and Project Data”).
• Workspace and organization information, such as organization, workspace, administrator, role, and team-membership details.
• Usage and device information, such as your IP address, country, approximate location derived from IP, browser or application version, device type, operating system, features used, interaction timestamps, installation or session identifiers, crash information, and diagnostic logs.
• Device identification and network signals used to prevent duplicate accounts and abuse, as described in Device Identification below.
• Information from authentication, repository, AI, and other services you connect, according to the permissions you grant.
• Advertising and attribution information, such as campaign, referral, click, pixel, and conversion identifiers.
• Inferences such as advertising interests, usage classifications, and fraud, abuse, or security scores.
• Transaction and billing information if we offer a paid product or service, such as purchase history, billing address, the last four card digits, and processor transaction identifiers. Full payment card details are handled by our payment processors rather than stored by us.

We collect this information directly from you, automatically from your use of Service, from services you connect, and from service providers. We may also receive information from business customers, teammates, referral partners, and public sources.

Prompts, Code, Files, and AI Providers

We process Prompt and Project Data to provide the features you request. Depending on the product, model, and account you use, that data may be processed by Company systems and by AI model providers. Providers may change over time. When you connect and use your own third-party account, that provider's terms and privacy practices may also apply.

Abuse Detection and Safety Review

We may review Prompt and Project Data, including prompts, messages, and agent activity, to detect, investigate, and prevent fraud, abuse, security incidents, and violations of our Terms. This review may be automated, using Company systems and service providers acting on our behalf (for example, to classify how Service is being used or to identify accounts that submit the same or similar prompts), and authorized personnel may review specific content when needed. We may use the results to limit, suspend, or terminate accounts, and we may retain the relevant data and results as described in Retention.

Personalized Advertising

We may use Prompt and Project Data to personalize advertising shown within Service, including by deriving general interest categories.

We may use Company systems and service providers acting on our behalf to analyze prompts and messages and to select, deliver, prevent fraud in, and measure advertising. These providers may not use that information for their own independent purposes except as permitted by law and our agreements with them. Code or other content pasted into a prompt or message is part of that message and may also be processed. We do not provide separately uploaded files or connected repository contents to advertising providers. We do not use Prompt and Project Data to target advertising based on sensitive characteristics such as race or ethnicity, religious or philosophical beliefs, health, sex life or sexual orientation, union membership, precise geolocation, or financial account information. Advertising and measurement providers may also receive limited identifiers and events needed for these purposes.

Where required by applicable law, we provide choices concerning targeted advertising, sale or sharing of personal information, and related profiling. We honor legally recognized opt-out preference signals where required. In jurisdictions where these choices are not legally required, certain advertising processing may be necessary to use the free Service.

AI Training

We do not use Prompt and Project Data to train our or third-party AI models unless, before you use the applicable model or feature, we clearly state that the data may be used for AI training. A label or notice such as May use data for AI training means that Prompt and Project Data submitted through that model or feature may be retained and used by Company or the applicable third-party provider for AI training, development, evaluation, testing, fine-tuning, quality improvement, safety research, and related model or product improvement. A general notice that data is collected or stored does not by itself permit these uses.

Identity Verification

You may be able to verify your identity from your account settings, and when we need to confirm that an account belongs to a unique person (for example, an account that shares a device with another account, or that shows signs of abuse) we may require it, including before the account can keep using free features. Verification is performed by our processor Didit (Didit Identity S.L.). With your consent, Didit processes a photo of your government ID and a short selfie, including biometric data (a template of your facial geometry), and information about the network you connect from, to check that the document is genuine, that the selfie is a live capture that matches it, and whether the same face or document was already used for another Freebuff account.

We keep the outcome, the issuing country and type of the document, a keyed hash of the document number (not the number itself), the scores and warning codes Didit returns (for example, that a document appears to be a screen capture), and a record of the consent and identity-lock terms you accepted. We do not keep your photos, selfie, name or date of birth from the document. We use these records to detect an identity used on more than one account or a false identity, which leads to the suspension of the accounts involved. Didit keeps its copy only for the retention period configured for our account, and biometric data is never retained longer than necessary for this purpose and in any case no longer than three years after your last interaction with us. When you delete your account, we ask Didit to erase your verification, except where the account was suspended for abuse; the keyed document hash is kept so that deleting an account does not reset the one-account-per-person rule. The purpose is to keep free access to one account per person and to prevent abuse.

Device Identification

To detect duplicate, shared, and automated accounts, we use Fingerprint (FingerprintJS, Inc.), a device-identification provider acting as our service provider. When you sign up on our website, Fingerprint's script collects technical attributes of your browser and device and returns a visitor identifier with a confidence score and signals such as whether a VPN, proxy, virtual machine, browser tampering, developer tools, incognito mode, or automation (a bot) was detected. Our CLI and desktop app send installation and machine identifiers, and our website sets a device cookie.

We store a keyed hash of these identifiers (not the raw values) together with those signals and the networks an account is used from, and compare them across accounts to find accounts that share a device or network. We use the results to require identity verification, to limit access, or to suspend accounts that break our Terms. We keep these records while the account exists and as long as needed to prevent abuse. When an account is deleted, we keep keyed hashes of its identifiers (email address, sign-in account ids, verified phone number and device identifiers, never the raw values) together with whether it was suspended or limited to a region, the free allowance it had used that day and which Earn rewards it was paid for, so that deleting an account and signing up again does not reset a suspension, a region limit, the daily allowance, a referral or an Earn reward.

How We Use Information

We use information to:

• provide, maintain, personalize, and support Service;
• process prompts and generate requested output;
• save projects or conversation history when you request it;
• select and measure advertising as described in this Privacy Policy;
• perform the limited Codebase Evaluation described in this Privacy Policy;
• develop, test, evaluate, improve, and analyze Service;
• detect, investigate, and prevent fraud, abuse, security incidents, and violations of our Terms;
• communicate with you about Service and provide support;
• comply with law and protect our rights and users; and
• carry out another purpose we explain when collecting the information, with any consent required by law.

We will not use personal information for a materially different purpose without appropriate notice and any consent required by law.

Cookies, Local Storage, and Telemetry

Web portions of Service use cookies, local storage, and similar technologies for authentication, preferences, security, analytics, advertising, and attribution. Our products also send bounded usage, performance, and diagnostic events to analytics and observability providers.

Advertising and conversion events may include hashed account, campaign, click, pixel, and conversion identifiers; IP address; user agent; source URL; and an event indicating that a prompt was accepted. The prompt's contents are not included in these routine conversion events. Attribution information may be retained in first-party browser storage.

You can control cookies through your browser and any consent controls we make available. Some portions of Service may not work correctly if you block necessary storage. Because there is no common standard for “Do Not Track,” our websites do not currently respond to that signal.

How We Disclose Information

We may disclose information to:

• Model providers that process prompts and related context to provide requested AI features.
• Hosting, storage, sandbox, database, security, support, analytics, and observability providers.
• Authentication and connected-service providers when you use or connect those services.
• Advertising and measurement service providers acting on our behalf, including providers that process prompts and messages for the purposes described above.
• Service providers and evaluation partners acting on our behalf for the limited Codebase Evaluation described above.
• Our identity verification provider, Didit, when you verify your identity (see Identity Verification above), and our device-identification provider, Fingerprint (see Device Identification above).
• Payment processors if you purchase a paid product or service.
• Government authorities or other parties when required by law or reasonably necessary to protect rights, safety, and security.
• A buyer, successor, or other relevant party in connection with a merger, financing, acquisition, reorganization, or sale of assets, subject to appropriate confidentiality protections.

We may also create and disclose aggregated or de-identified information that does not reasonably identify you.

We do not sell personal information for money. Certain disclosures to advertising or measurement partners may be considered a “sale,” “sharing,” or targeted advertising under some privacy laws even when no money changes hands. Rights and choices required by applicable law apply to those disclosures.

Legal Bases and International Transfers

Where applicable law requires a legal basis, we process personal information as necessary to perform our contract with you, comply with legal obligations, and pursue legitimate interests such as securing and improving Service, preventing abuse, and supporting our business. We rely on consent where required, including for certain advertising, cookies, connected services, or training uses associated with models or features identified for AI training. You may withdraw consent without affecting processing that occurred before withdrawal.

We are based in the United States, and we and our providers may process information in the United States and other countries. Where required, we use recognized safeguards for international transfers, such as adequacy decisions or contractual protections.

Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Please do not include passwords, private keys, access tokens, or other secrets in prompts or files unless a feature expressly requires them.

Your Choices and Privacy Rights

You may ask to access, correct, delete, or receive a copy of your personal information, or object to or restrict certain processing, by emailing support@freebuff.com. You may also opt out of marketing emails through the unsubscribe link and exercise any additional privacy rights available under applicable law. We may verify your identity before completing a request and may retain information when an exception under applicable law applies.

United States State Privacy Rights

Depending on where you live and whether the applicable law covers Company, you may have rights to know or access personal information, correct inaccuracies, delete information, obtain a portable copy, opt out of sale, sharing, or targeted advertising, limit certain uses of sensitive personal information, use an authorized agent, and appeal a denied request. We will not discriminate against you for exercising a privacy right. Submit a request or appeal by emailing support@freebuff.com.

European and United Kingdom Privacy Rights

If European or United Kingdom data-protection law applies, you may have rights to access, rectify, erase, restrict, or port your personal information and to object to processing. You may object at any time to processing for direct marketing, including related profiling. You may also lodge a complaint with your local data protection authority.

Children

Service is not intended for anyone under 18, and we do not knowingly collect personal information from anyone under 18. If you believe a minor has provided personal information, contact us so we can take appropriate steps to delete it.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated policy and revise the date at the top. We will provide advance notice when required by law or when a change materially affects your rights. An updated policy takes effect on its stated effective date.

Contact Us

If you have questions or want to exercise a privacy right, email us at support@freebuff.com.