What we collect, and what never leaves your machine

Effective 8 September 2026 Controller: Prodify Labs LLC

This policy covers fAI, the desktop application, this website, and the online features that support them. The data controller is Prodify Labs LLC, 30 N Gould St, Ste R, Sheridan, WY 82801, United States. Questions and requests go to support@prodifylabs.io.

The short version

fAI runs on your computer. Your code, your prompts and your conversations stay there. We do not receive them, store them or train on them. What we hold is the minimum needed to know that your licence is valid: who you are, which machine is activated, and that the app was running.

The AI requests fAI makes go from your machine directly to the provider whose account you connected — not through us. Your provider key is used locally and is never sent to us.

What we collect

Account and licence

Your email address and the display name your sign-in provider returns, used to identify you and to match you to your licence.
Your licence record: the licence key, its status, its expiry date, its seat limit and the email it is assigned to.

Activation and licence enforcement

A machine fingerprint — a derived identifier for the computer you activate on — the operating-system user name on that machine, and the activation time. This is how the one-machine rule is enforced and how a deactivation frees the seat.
Heartbeats while the app is open: the licence key, the machine fingerprint, your IP address and a timestamp. These are aggregated into a daily total of how long the app was open and how many sessions there were.
Anti-abuse signals derived from the above — for example an unusual number of distinct machines or IP addresses on one licence — and, where a licence or IP address is blocked, a record of that block.

Heartbeats tell us that the app was running. They do not tell us what you did in it: no project names, no file paths, no prompts, no model usage, no feature-by-feature tracking.

Payments

Your purchase is handled by Paddle.com Market Ltd as merchant of record. Paddle collects your billing details and payment information directly. We never see or store your card number. We receive the order record: what was bought, the amount, the country used for tax, and your email.

Optional cloud features — only if you use them

These are off until you invoke them. If you do:

Sharing a document uploads that document's contents and title so the people you send the link to can open it, together with its version history, the comments people leave (with the name each commenter gives) and the email addresses you invite.
Mobile, voice, webhooks and automations route messages between your phone or an external service and the fAI running on your machine. Content passes through our relay in order to be delivered.

Only the documents you deliberately share go to our servers. The rest of your work never does.

Support and bug reports

If you email us, we keep the correspondence. If you send a bug report from inside the app, we receive what that report contains — review it before sending, since you choose what goes in.

This website

The site sets no cookies and runs no analytics or advertising trackers. When you sign in, a short-lived session token is kept in your browser's own sessionStorage and disappears when you close the tab. Our servers keep standard request logs, including IP addresses, for security.

What we never collect

Your source code, repositories, file contents or file names.
Your prompts, your agents' output, or any conversation held in fAI.
Your AI provider keys or tokens. fAI passes them from your machine to your provider; they are never transmitted to us.
Your card number.

We do not sell personal data, we do not share it for advertising, and we do not use anything you do in fAI to train AI models.

Why we are allowed to hold it

Where the GDPR or a similar law applies, our legal bases are:

Performing our contract with you — account, licence, activation, payment records, support, and the cloud features you choose to use.
Our legitimate interests — enforcing licence terms, preventing piracy and abuse, and keeping the service secure. Heartbeats, fingerprints and IP addresses sit here; we keep them to the minimum that works.
Legal obligation — tax and accounting records for the invoices raised on our behalf.

How long we keep it

Account and licence records: for as long as you hold a licence, then up to 24 months, so a returning customer keeps their history.
Raw heartbeats: pruned on a rolling window; only the aggregated daily totals are retained, and those are kept for the life of the licence.
Shared documents, versions and comments: until you delete the share or your account. Revoking a share stops it being served immediately.
Order and tax records: as long as tax law requires, typically seven years.
Relay traffic for mobile and automations: in transit only; it is not retained as a message archive.

Who we share it with

We currently use a small number of processors, each for one job:

Paddle.com Market Ltd (Ireland / United Kingdom) — merchant of record: payment, invoicing and sales tax.
WorkOS, Inc. (United States) — sign-in and email verification.
Google Cloud (United States) — hosting and encrypted storage for our servers.
Supabase — the managed database behind the sharing features.

We also disclose data where the law requires it, and to a buyer if the business is ever sold — in which case this policy travels with it and we will tell you first.

International transfers

We are based in the United States and our processors operate there and in the European Union and United Kingdom, so your data may be transferred outside your country. Where the GDPR applies, transfers rely on the European Commission's Standard Contractual Clauses or an equivalent safeguard.

Security

Data in transit is encrypted with TLS; data at rest in our cloud storage is encrypted, with keys we manage. Access to production data is limited to those who need it to operate the service. No system is perfectly secure, and we do not claim otherwise; if a breach affects your data we will notify you and the relevant authority as the law requires.

Your rights

Wherever you live, you can ask us to show you the data we hold about you, correct it, delete it, or send you a copy in a portable format. Depending on your country you may also object to processing based on legitimate interests, ask us to restrict it, or withdraw consent where consent was the basis.

Email support@prodifylabs.io. We reply within 30 days. We do not charge for this, unless a request is manifestly unfounded or excessive, in which case the law allows us to charge a reasonable fee or to decline. Deleting your account data ends your licence, since the licence record is the data. If you are in the EEA or the UK you may also complain to your local data-protection authority.

Children

fAI is a professional tool and is not directed at anyone under 16. We do not knowingly collect data from children; if we learn we have, we delete it.

Changes

If we change this policy materially we will email current customers at least 30 days beforehand and update the effective date above.