Privacy Policy

Last updated: September 30, 2026

Introduction

Gipity ("we", "our", "us") operates the gipity.ai platform. This Privacy Policy explains how we collect, use, and protect your personal information when you use our services.

Information We Collect

We collect information you provide directly: email address for authentication, display name (optional), and content you create on the platform (files, code, databases, functions, workflows, and deployed applications). If you sign in with Apple, Google, or Discord, we receive your name, email address, and profile photo from those providers. We also collect technical data automatically: IP address (used for authentication logging, analytics, and geolocation), browser user agent, screen dimensions, browser language, referrer URL, and UTM campaign parameters. Usage data is tracked per operation, including token counts, credit consumption, model used, and cost. If you purchase credits or subscribe, payment is processed through Stripe. We do not store full payment card details on our servers. If you connect GitHub to import a repository, or connect Gmail through the Gipity CLI, we store the OAuth tokens for that connection and access only the data needed for the feature you use (the repositories you import, or the email messages you search, read, or send through Gipity).

Location Data

We collect location information in two ways. First, we may determine your approximate location from your IP address using a geolocation database hosted on our own servers. Second, if an app on Gipity uses the location service, your browser may share precise GPS coordinates with your permission; these are reverse-geocoded via OpenStreetMap (Nominatim) to determine your city and region. Location data is stored in your account and used to provide location-aware features. You can decline browser location prompts at any time.

Analytics

When you load the application, a lightweight analytics beacon is sent to our servers. This beacon includes your IP address, referrer URL, browser user agent, screen dimensions, browser language, and any UTM parameters from the page URL. If you are logged in, this data is associated with your user account. We do not use third-party analytics services, advertising trackers, or tracking pixels.

Project Memory and Session Transcripts

Each project can keep memory entries that you or your coding agent write. We generate vector embeddings from your memory entries using OpenAI to enable semantic search. Session capture is off by default. If you turn it on for a project (gipity init --capture), transcripts of your coding agent sessions in that project, including prompts, tool usage, and responses, are sent to Gipity and stored in our database so you can review them in Monitor. Workflow runs that call AI models are also recorded so you can review them. You can view, edit, and delete project memories and captured transcripts at any time through the platform.

How We Use Your Information

We use your information to: provide and maintain the Gipity platform; authenticate your identity and prevent fraud; deliver platform services including code execution, file storage, databases, serverless functions, app hosting and deployment, jobs, AI model calls, image and video generation, text-to-speech and other audio services, web search, workflow automation, realtime multiplayer, push notifications, email sending, and app sign-in; process payments and manage credit balances; track usage and enforce resource limits; analyze platform usage patterns to improve our services; and communicate important updates. We process your data on the legal basis of contract performance (providing the services you signed up for), legitimate interest (analytics, security, fraud prevention), and consent (optional features like location sharing).

Data Storage and Security

Your data is stored on cloud infrastructure in the United States. Projects and databases are isolated per user. Code execution occurs in sandboxed containers with no network access, memory limits, and dropped privileges. We use JWT-based authentication with short-lived access tokens (15 minutes) and refresh tokens (7 days). All data in transit is encrypted via TLS.

Third-Party Services

We use third-party services to provide platform features: Anthropic and OpenAI for AI language models, image generation, and text embeddings; Google (Gemini) and BFL/Flux for image generation; ElevenLabs for text-to-speech, sound effects, music generation, audio transcription, and audio isolation; Brave for web search; OpenStreetMap/Nominatim for reverse geocoding; Stripe for payment processing; SendGrid for email delivery; Apple, Google, and Discord for OAuth authentication; GitHub for repository imports; and Google for Gmail access you choose to connect. Prompts and content that you, your coding agent, or your apps send to AI services are sent to the relevant AI provider for processing. Your data shared with these services is governed by their respective privacy policies.

Your Rights

You may request access to, correction of, or deletion of your personal data by contacting us. You can delete your projects, project memories, captured transcripts, and databases at any time through the platform. You may export your data before deleting your account. Account deletion removes all associated data including files, databases, captured transcripts, memories, workflows, and deployed applications.

Data Retention

We retain your data for as long as your account is active. Captured session transcripts and project memories persist until you delete them. Credit transaction records are retained for accounting and legal compliance purposes. Upon account deletion, we remove your data within 30 days, except where retention is required by law.

Cookies and Local Storage

We use browser local storage to maintain your session (authentication tokens, UI preferences). We do not use third-party tracking cookies or advertising trackers.

Children's Privacy

The Service is not directed to children under 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected data from a child under 16, we will take steps to delete that information.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on the platform. Continued use after changes constitutes acceptance.

Contact

For privacy-related questions, contact us at privacy@gipity.ai. See also our Terms of Service and Contact page.