Privacy Policy

CCC runs on your own machine. Cloud sync is off unless you turn it on by setting CCC_CLOUD_SYNC=1. Until you do, nothing is queued and nothing is sent — there is no backlog waiting to drain.

With cloud sync enabled, these things are copied to our database:

• Your profile: display name and avatar URL. The profiles table has no email column.
• Organisations, their members and roles, and invitations. An invitation holds the invitee’s email address so we can send it.
• A registry of your CCC installs: name, platform, app version, scopes and when each was last seen.
• Projects and repository identity — project name and description, repository name, remote URL and default branch.
• The full text of your project config files (things like CLAUDE.md, agents.json and your skills and wiki pages), plus their version history. Files over 512KB and files containing binary data are skipped.
• Your project secrets, encrypted. See how secrets are handled below.
• Run history — one record per pipeline, trigger or agent run, with its title, summary, status, cost and details — and the artifacts those runs produced. Artifact contents up to 512KB are stored inline.
• Daily token-usage counters per project, install and model.

These are never sent to the cloud, in either direction, whether or not sync is enabled:

• Your sessions: terminal output, scrollback buffers and transcripts of what you and the agents said.
• Your source code, your git worktrees, and your git history.
• The filesystem path of any checkout. The cloud repository record stores identity only — there is no column for a local path.
• Your encrypted secrets file and its local master key, and your codemap snapshots.
• Your Anthropic credentials. You run the CCC runtime with your own Anthropic account; we never hold those keys.
• Search embeddings and local caches.

The exclusion list is enforced three times over: the scanner skips those paths, no API route can queue one, and anything arriving from the cloud is checked against the same list before it is written to disk. A row planted by a hostile or out-of-date client still never lands on your machine.

Cloud access tokens are also kept out of the environment CCC gives to the agents it spawns. Agents talk to the CCC server on your own machine, with a local token.

Where the cloud does handle a token — an organisation invite, a device linking code, a sign-in handoff — it stores only a hash of that token, never the token itself. The usable value exists only in the hands of the person it was issued to.

Secret values are encrypted on your machine before they are sent. We receive ciphertext only. The cipher is AES-256-GCM, using a 32-byte key that belongs to your organisation.

That key is not stored in the database. The database column holds an identifier pointing at Supabase Vault, where the key is sealed at rest. A dump of the secrets table, or a copy of a database backup, therefore carries no usable key material. Reading the key at all goes through a single membership-checked, audit-logged path.

Three things about this we would rather state plainly than bury:

• We can decrypt your secrets. The key is sealed from the database, not from us. That is what makes unattended scheduled runs possible. This is not end-to-end encryption, and we will not describe it as such.
• Only the value is encrypted. A secret’s name and its description are stored as plain text, so avoid putting anything sensitive in the name.
• Secrets only travel upward. Nothing pulls your secrets back down onto a second machine. Moving them between machines is a separate, deliberate step: a passphrase-encrypted archive you export and import yourself.

codecc.ai is a static site. It runs no server code of its own, sets no cookies of its own, and loads no analytics, tag manager or other third-party scripts. We do not track you across the web.

The one thing this site collects is what you type into the waitlist form: your email address and your description of how you would use CCC. That is sent to a Supabase function and stored so we can email you. If the form is not configured, it falls back to a plain email link and sends nothing.

Synced data is stored in a Postgres database hosted by Supabase in the us-east-1 region, in the United States. If you are outside the United States, using cloud sync means your data is transferred there.

We are on Supabase’s Pro plan, which takes automated daily backups of the database. Point-in-time recovery is not enabled. That means a restore returns the database to a daily backup, not to an arbitrary moment, and data written since that backup would be lost.

For the same reason, do not treat cloud sync as a backup of your work. It is a way to keep machines in agreement. Your own git remote is the thing that actually backs your config up.

Accounts are handled by Supabase Auth. You can sign in with an email address and password, or with GitHub, Google or Discord where that provider is enabled. When you use a social provider, we receive the basic profile it hands over — typically a display name, an avatar URL and the email address on the account.

What we keep in the cloud profile is narrower than that: a display name and an avatar URL. The profiles table has no email column at all, and a profile row is readable only by the person it belongs to.

One thing to know while CCC Cloud is early: sign-ups are currently auto-confirmed and we do not send a verification email. Nobody has to prove they control an address before an account is created with it. We are changing this before general availability.

Deleting an organisation removes its synced data. Everything in the cloud hangs off the organisation record — projects, config, secrets, run history, usage counters — so when the organisation goes, those rows go with it.

Smaller deletes work differently, and we would rather say so than let you assume otherwise. Deleting a single project, repository, config file or secret marks the cloud row as deleted rather than erasing it immediately, so other machines learn about the deletion instead of re-uploading the thing you just removed. Run history is kept in the same way and outlives the project it came from.

Old versions of config files are pruned on a schedule that keeps the most recent 100 versions or 180 days of history, whichever is larger.

To take your data with you, a project’s config can be exported as a tar archive containing the files themselves. Secrets are not part of that archive — moving them is a separate, deliberate step using CCC’s secrets export and import commands, which produce a passphrase-encrypted file.

Four companies, and no others, handle any part of this:

• Supabase — the database, authentication and functions behind CCC Cloud, and the function behind this site’s waitlist form.
• Vercel — hosting for this website and the CCC Cloud web app.
• Cloudflare — DNS for codecc.ai.
• Anthropic — the Claude models CCC drives. You supply your own Anthropic credentials and your prompts go from your machine to Anthropic directly; we do not route them, and we never hold those credentials.

We do not sell your data, and we do not share it with advertisers or data brokers.

The rest of this policy describes what the software actually does, and every claim in it is checked against the code.

The entity responsible for this service — the data controller — is Restart Labs LLC, a Texas limited liability company, at 5900 Balcones Drive, Suite 100, Austin, TX 78731, United States.

To ask a question about your data, or to ask us to delete or export it, write to privacy@restartlabs.ai. We read it. We have not set a response-time commitment, so we are not going to print one.

Users in the European Union and California are welcome to sign up. Write to the address above to exercise the rights those laws grant you — access, correction, deletion, portability, objection, and the right not to have your data sold. We do not sell your data to anyone, so there is nothing to opt out of.

Two things we should say plainly rather than let you assume. We do not currently offer a Data Processing Agreement, and we have not appointed an EU representative. If your organisation needs either one before it can use CCC Cloud, we are not ready for you yet — tell us and we will say honestly where we are.

Treat this page as a description of how CCC handles data, not as a statement of legal compliance.