Privacy notice

Controller and contact

Privacy requests and questions: privacy@codlab.app.

Website and service security

Cloudflare delivers the website and application. Requests involve IP addresses, request times, requested URLs, browser information and security events needed to deliver and protect the service. We use this information to operate the requested service and prevent abuse: Article 6(1)(b) GDPR where needed for a requested contract or pre-contract steps, and Article 6(1)(f) for the legitimate interests of availability, security and abuse prevention. Hosting logs and provider security records are separate from saved project reports.

Accounts and necessary browser storage

Customer sign-in offers CodHub and Cloudburg. CodLab stores the identity and workspace relationship, selected workspace name, acceptance version and timestamps to operate the requested account under Article 6(1)(b) GDPR. Google customer sign-in is unavailable.

CodHub sign-in is available. When you choose it, CodHub at codhub.org processes the sign-in request and sends CodLab your provider identity identifier, email address, username, name and authentication claims. CodLab checks the signed identity response to establish your CodLab session. This sign-in does not read repository contents or connect repositories. For this identity-only sign-in, CodLab does not retain CodHub access or refresh tokens, and it does not automatically link accounts by matching email addresses. The same requested-account purpose and Article 6(1)(b) basis apply.

If you choose Cloudburg at cloudburg.org, CodLab requests openid, profile and email for customer identity only. Cloudburg supplies a signed identity token and matched UserInfo. CodLab validates the issuer and immutable subject, signature, audience, nonce and token times, then matches UserInfo to the token and checks the verified external contact email. The reserved @cloudburg.org address is not used as that verification proof. CodLab stores the provider identity and profile name for your requested account, not Cloudburg access or refresh tokens. This grants no Cloudburg mailbox, file, automation, repository or billing access. Accounts are keyed by provider, issuer and subject and are not automatically linked by email or name; choose your original provider to reopen an existing workspace. The requested-account purpose and Article 6(1)(b) GDPR apply. Separate repository authorization remains with CodHub.

Authentication uses a necessary session cookie, with the current session lasting up to 15 minutes. Login state expires after ten minutes. The upload interface keeps an opaque request ID and file digest in session storage to recover a request; it does not store source files there. Language controls may remember the chosen language. These functions support the service or preference you request.

Optional CodHub repository read connection

Basic CodHub sign-in verifies your identity. CodLab does not retain its CodHub access or refresh tokens. Repository access is a separate, optional authorization; signing in does not create a repository connection.

If you authorize a repository read connection, CodHub grants CodLab read access to your profile and repositories your CodHub account can access, including private repositories. This provider grant applies across your account and is not limited to one selected repository. CodLab retrieves repository metadata so you can make a selection, then limits operational repository reads to the immutable repository IDs selected for your workspace. This first connection release provides inventory and selection; it does not read repository source, create webhooks, publish PR reviews or change files.

CodLab stores the repository access token encrypted on its server, together with your immutable CodHub user ID, its workspace and owner association, the selected repository IDs, the granted read scope, connection identifier and creation, update and expiry times. The encryption context binds the credential to that owner, workspace and connection. The repository connection does not retain refresh tokens or ID tokens. Authorization-state records contain encrypted one-use proof material and expire after five minutes; completed or failed claimed callbacks remove them.

The connection expires at the time shown in your dashboard. You must reconnect after expiry; CodLab does not automatically refresh this grant. Reconnecting clears the previous repository selection so you choose it again. Expired connection records, encrypted credentials and selected IDs are removed by the next scheduled cleanup, including when repository authorization is paused. Pending authorization records are also removed after expiry.

Disconnecting removes CodLab's saved repository connection and pending authorization for that workspace. It leaves your identity sign-in and workspace intact. Disconnecting does not itself revoke the OAuth grant at CodHub. To withdraw that provider grant as well, revoke the separate repository application in CodHub Settings → Applications. Provider permission loss is checked again during repository access.

Private project uploads

The upload service accepts up to 40 selected JavaScript/TypeScript files: 32 KiB and 1,000 lines per file, 512 KiB total. Only submit files you are authorized to share, after removing credentials, secrets and personal data. Do not submit special-category data or confidential third-party material without an appropriate arrangement.

Native static checks process selected source transiently in the Cloudflare Worker request. This upload path does not execute code, install dependencies or send source to an AI provider. Its application database does not store the raw source files or source excerpts. It stores report findings, file paths, line numbers, static import names and relationships, coverage, limits and a digest of the selected files. Paths and import names can themselves contain identifying information. Processing provides the requested review under Article 6(1)(b) GDPR.

Report access, deletion and other records

Reports are accessible to their workspace owner for seven days from creation, including after paid access ends. The owner can delete saved report content sooner. Expired reports are excluded from customer retrieval; scheduled cleanup removes expired report content. This is not deletion of every related record or provider backup.

Report/request identifiers, file digests, account/workspace references, timestamps, state and usage counters remain for request recovery, allowance accounting and abuse prevention. Account and identity records remain while needed to operate the account. Billing, consent, security and support records may need longer retention for legal obligations, unresolved requests or claims. Retention is limited by those purposes; contact us to request erasure or the criteria applicable to your records. An account-wide self-service deletion operation is not currently offered.

Optional finding decisions and manual repair plans

When the finding workspace is available, you may save your own triage status, dismissal reason, manual repair plan, notes and HTTPS evidence links beside an owned retained upload report. CodLab records the authorized account, server timestamp, previous and new state, revision and request identifiers to recover saves and show their history. These customer entries are separate from the original analyzer findings; dismissal or customer-reported completion does not verify a repair, execute a test or establish that code is safe.

This processing provides your requested finding workspace under Article 6(1)(b) GDPR. Do not put source code, credentials, secrets, special-category data or unnecessary personal information in notes, reasons or links. Evidence URLs are stored as customer-supplied links; CodLab does not fetch them, run them or verify their results. Opening a link is your choice and may share ordinary browser request information with its destination.

Decisions, plans, notes, evidence links and their history inherit the parent report's seven-day expiry. They become unavailable immediately when it expires and are removed when the report's saved content is deleted or cleared by scheduled cleanup; report replacement also removes work bound to the former evidence. They are not retained as longer-lived project records. Minimal existing report/request and allowance records retain the separate purposes already described above. Saved work can be recovered after sign-in only while the same owned report remains retained. Necessary session storage may keep opaque report/finding and save-request identifiers, filter values, evidence/request hashes, revision numbers and operation labels for navigation and recovery of an uncertain save. It does not keep notes, plan text, history bodies or report contents. Saving or reading this work does not run another review or restore/spend review allowance.

Payments and support

New purchases remain unavailable until the payment service is qualified. If you later choose an enabled Stripe checkout, Stripe processes payment and billing information. CodLab records customer/subscription references, selected plan, payment state, periods and allowance data; the application does not collect full card details. Contract administration uses Article 6(1)(b), and required accounting records use Article 6(1)(c) GDPR.

Support correspondence is used to answer your request, provide service or investigate problems. Do not email source code or credentials. Contact support@codlab.app. Business email may be forwarded through Cloudflare to the operator's Google Workspace inbox. Requested assistance uses Article 6(1)(b); proportionate security and dispute records use Article 6(1)(f) or an applicable legal obligation.

Optional onboarding requests and existing review records

The separate company onboarding-email request records the verified account, notice version, affirmative request and confirmation timestamps. Sending remains paused. An onboarding request is not consent to unrelated marketing. Where optional email is enabled, it requires the stated consent and you may withdraw it at any time via the published control or privacy contact; Article 6(1)(a) GDPR applies to that optional purpose.

New pull-request reviews and fix publishing are not currently available. The dashboard shows whether the separate optional repository read connection is enabled. Existing hosted review records may include PR metadata, findings, selected evidence, decisions and audit/delivery records. They follow the applicable workspace retention controls; the seven-day upload-report rule does not retrospectively delete those separate records. Contact us about existing records.

Recipients and international processing

Service providers involved in the selected function include Cloudflare for hosting, protection and storage; Google for business email; CodHub at codhub.org for your chosen identity sign-in and any separately authorized repository read connection; Cloudburg at cloudburg.org for your chosen identity-only sign-in; and Stripe for an enabled checkout. The current native upload path does not use an AI processor. Access is limited to the function requested and authorized service administration.

Cloudflare, Google and Stripe operate internationally and processing can occur outside the European Economic Area. Where required, international processing needs a valid adequacy decision or appropriate safeguards, such as standard contractual clauses. Ask the privacy contact for the applicable provider terms, processing locations and safeguards before sharing data that requires a processor agreement. No EU-only hosting promise is made.

Your rights

Subject to the GDPR conditions, you may request access, correction, erasure, restriction, data portability and objection to processing based on legitimate interests. You may withdraw consent without affecting earlier lawful processing. We use proportionate identity checks and do not ask for passwords or source code.

Write to privacy@codlab.app. You may also complain to a supervisory authority, including the Lower Saxony data protection authority.

Account information is needed to establish the requested account; selected files are needed only if you request a review. You can read public pages without creating an account. The native review does not make a solely automated decision producing legal or similarly significant effects; a finding is not a decision about a person or permission to deploy code.

Professional Handoff and device copies

When you request a handoff, CodLab reads your owned, unexpired report and saved finding state to prepare a transient preview under Article 6(1)(b) GDPR. It does not save a separate package, create another review, execute code/tests, fetch evidence URLs or contact an AI provider. Owner, expiry and saved-state checks apply again to downloads; changed decisions or plans can invalidate a preview.

Notes, dismissal reasons, dismissed findings and history default to excluded. This does not exclude every customer entry: proposed checks, customer-reported outcomes and last-plan author name/identity identifier/date can remain. Technical detail also includes inspection/change text and evidence URLs. Inspect the exact preview before sharing and select only information you may disclose.

Markdown, JSON and HTML copies are downloaded to your device. Print/Save as PDF is your browser operation, not server PDF generation. Device copies remain after the report expires or is deleted; you and your chosen recipients manage them. Customer statements do not establish a verified repair.

Browser storage and expiry

Session and authorization-cookie expiry are access limits, not a blanket erasure timer for identity or account records. The current session lasts up to 15 minutes; the identity authorization cookie up to ten minutes and separate repository-state cookie up to five minutes. Language selection can store the chosen en/de preference locally without a set automatic expiry. Tab session storage holds opaque upload/finding/navigation/recovery metadata, not raw source or customer draft/report text; it has no separate seven-day timer.