Privacy Policy
Last updated 7 September 2026
Codepixel ("we", "us") is an agentic software-delivery platform operated by Softpixel. This policy explains what we collect when you use Codepixel at codepixel.app, why we collect it, who we share it with, and what you can ask us to do with it.
1. Information we collect
Account information
When you create an account we store your email address, a username, your first and last name where you provide them, and a one-way cryptographic hash of your password. We never store your password itself.
Google sign-in
If you choose "Sign in with Google", we request only the openid,
email and profile scopes. From that we receive and store your
email address, given name and family name. We do not request access to your Gmail, Drive,
Calendar, Contacts or any other Google service, and we do not store Google refresh tokens
— our sign-in uses short-lived access only, discarded once your account is identified.
Because your email is verified by Google, signing in this way marks your email as verified
with us.
Your code and projects
Codepixel exists to build and run software for you, so it necessarily processes the material you give it: project descriptions and requirements, repository contents, files you upload, and the code our agents generate on your behalf. Development sandboxes run in isolated containers and are destroyed when the session ends.
Model provider API keys
If you supply your own API keys for OpenAI, Anthropic, xAI or Google, we store them so your projects can use them. They are stored for your account only, are never displayed back to you in full, and are used solely to make requests you initiate. You can remove them at any time from your settings, which deletes them from our database.
Usage and technical data
We record token consumption per request for billing and quota purposes, along with ordinary server logs — IP address, browser user agent, timestamps and the pages requested. We use IP addresses and email addresses for rate limiting, to protect accounts against brute-force and credential-stuffing attempts.
Payment information
Subscriptions are processed by Stripe. Card numbers never reach our servers; we retain only the subscription status and identifiers Stripe returns to us.
2. How we use it
- To provide the service: authenticate you, run your projects, and deliver results.
- To send transactional email — verification, password reset, invitations and notices about your projects. We do not send marketing email without your consent.
- To meter usage, apply plan limits, and bill you.
- To keep the platform secure and available: rate limiting, abuse prevention, debugging and capacity planning.
We do not sell your personal information, and we do not use your code or project content to train our own models.
3. Who we share it with
We share data only with the processors required to run the service, and only what each one needs:
| Processor | What it receives | Why |
|---|---|---|
| Google Cloud Platform | All hosted data | Hosting, database, file storage and container infrastructure |
| Anthropic, OpenAI, xAI, Google | Prompts and project content sent to the model you select | Generating code and documents you request |
| Stripe | Email, billing details | Subscription payments |
| SendGrid | Email address, message content | Transactional email delivery |
| GitHub | Repository data you connect | Reading and writing the repositories you authorise |
We may also disclose information where we are legally required to, or where it is necessary to protect our rights, users or infrastructure.
4. Retention
We keep account and project data for as long as your account is active. When you delete your account we delete your personal information and project content, except where we are required to retain records for legal, tax or accounting purposes. Sandboxes and their contents are ephemeral and destroyed at the end of a session. Server logs are retained for a limited period for security and debugging.
5. Security
Traffic is encrypted in transit with TLS. Passwords are hashed, secrets are held in managed secret storage rather than in code, and sessions are time-bounded — a session expires after seven days, and changing your password invalidates every session issued before the change. No system is perfectly secure, but we treat these as a floor rather than a ceiling.
6. Your rights
You can access and correct your account information from your settings page, remove your stored API keys at any time, and request a copy or the deletion of your data by writing to us. Depending on where you live you may have additional rights under laws such as the GDPR or the DPDP Act; we will honour those requests regardless of where you are.
7. Children
Codepixel is not intended for anyone under 16, and we do not knowingly collect information from children.
8. Changes
If we change this policy we will update the date at the top of this page, and for material changes we will notify you by email or in the product before the change takes effect.
9. Contact
Questions, requests or complaints: hello@codepixel.app.