Privacy notice

In short

• Statistics with Google Analytics happen only if you click "Accept" in the notice. Without your yes, the page loads nothing from Google and sets no statistics cookies. Advertising and personalisation always stay off.
• The page sets a sign-in cookie only when you sign in (with GitHub, Google, Apple or e-mail), to keep you signed in.
• Fonts, images, the film and scripts come from our own server. Your browser also asks GitHub for the newest version number, so the download buttons point at the right file, and for the number of GitHub stars, on the changelog page for the release notes, and our AyCode Cloud for the most popular community ideas.
• Out of the box, the AyCode app sends no usage data. Only if you turn on "Share usage statistics" does it report anonymously that it is running, and only if you agree to "Share voice samples" does it send chat dictations to train the speech recognition. Chats, code and your vault always stay on your computer.

Controller

Responsible for the processing on this website and in the AyCode app is:

Niccolo Bodenstedt
Ayont
c/o Postflex #7329, Emsdettener Str. 10
48268 Greven
Germany

Email: [email protected]
Website: ayont.me

Hosting

The website and AyCode Cloud run on infrastructure operated by Ayont. Data arising from their use is processed to provide the respective features. The legal basis is our legitimate interest in a secure and reliable service (Art. 6 (1) (f) GDPR).

Cloudflare

Between your browser and our server sits the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare provides the encrypted connection, delivers the page quickly and fends off attacks. For this, Cloudflare processes your IP address, the address you requested, date and time, and details about your browser and operating system. Your browser may also send technical error reports about the connection to Cloudflare (Network Error Logging).

The legal basis is our legitimate interest in a secure, fast website (Art. 6 (1) (f) GDPR). Cloudflare acts as our processor. For transfers to the USA, Cloudflare is certified under the EU-US Data Privacy Framework (adequacy decision under Art. 45 GDPR); the EU standard contractual clauses apply in addition. More: https://www.cloudflare.com/privacypolicy/.

Access data

Whenever you open a page, your browser transmits technically necessary data: IP address, date and time, the address requested, the previous page (if your browser sends it), browser, operating system and the response status. The aycode.ai web server itself writes no access logs. Cloudflare and the proxy in front of our server may log this data briefly to detect errors and attacks. We do not combine it with other data, do not analyse it to recognise visitors, and delete it as soon as it is no longer needed for this purpose. The legal basis is Art. 6 (1) (f) GDPR.

Version number, stars, changelog and downloads via GitHub

So the page always offers the newest version, your browser asks GitHub's public interface (api.github.com) for AyCode's latest release and for the number of GitHub stars of its public release repository when the page loads. GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA, receives your IP address, details about your browser and, as the origin, only "https://aycode.ai". The download buttons lead to the releases on GitHub; when you click one, your browser downloads the file directly from GitHub.

On the changelog page, your browser also asks the same interface for the list of published releases with their release notes, the newest 20 first and older ones only when you open them. GitHub receives the same details, no cookies and no referrer. The page loads no images from the release notes; links in them open only when you click them.

The legal basis is our legitimate interest in offering you the current, matching file directly and in showing what changed in each version (Art. 6 (1) (f) GDPR). GitHub is certified under the EU-US Data Privacy Framework through Microsoft. More: GitHub privacy statement.

Your browser keeps GitHub's answers (only public facts about the releases and the stars, nothing about you) for up to 30 minutes in this tab's session storage, so it does not ask again on every page. They are gone when you close the tab. This is strictly necessary for the page you requested (§ 25 (2) no. 2 TDDDG).

Ideas from the community

For the "What the community wants" block, your browser asks aycode.ai for the most popular ideas from the community portal once you scroll near the block. The request is forwarded to the AyCode Cloud, our server operated by Ayont. Only titles, type, votes and status come back, no names and no profile pictures. The server receives your IP address and details about your browser; no cookies and no referrer are sent. The service keeps the IP address only in memory, for at most a day, to slow down too many requests, and writes it to no log; the host's web server in front of it may keep its own short-lived access logs. The legal basis is our legitimate interest in showing you what others want from AyCode (Art. 6 (1) (f) GDPR).

Account and sign-in

At aycode.ai/login, /account and /community, aycode.ai shows the pages of the AyCode Cloud: your browser talks to aycode.ai, which forwards the requests to the AyCode Cloud on the same server operated by Ayont. You only need an account for your phone, team sessions, encrypted chat backups and the community portal. You can sign in like this:

• GitHub: we store your numeric GitHub ID, user name, display name and picture address. AyCode asks only for read:user, reads no repositories and does not store the GitHub token.
• Google or Apple: you sign in directly with the provider, which confirms to us who you are via OpenID Connect (we ask only for openid email profile, at Apple name email). We store the fixed identifier the provider gives you, your e-mail address, whether the provider verified it, and your name. At Apple the address may be a relay ("Hide My Email"), and Apple sends the name only on the first sign-in. The server discards the providers' tokens once it has checked them; AyCode reads no mailbox, contacts, calendar or files.
• E-mail and password (where the page offers it): we store your address and, of the password, only a scrypt hash. To set the password you get a link by e-mail that works once (60 minutes, 30 minutes for "forgot password").

What happens at the provider is governed by its own privacy policy: Google (Google Ireland Limited, Dublin), Apple (Apple Distribution International Ltd., Cork), GitHub. Our server then only exchanges a one-time code for the confirmation. The providers may also process data in the USA; the EU-US Data Privacy Framework applies to that.

Once you sign in, the page sets the cookie "__Host-ayc_session" (180 days, HttpOnly, HTTPS only, SameSite=Lax), which keeps you signed in; signing out deletes it. During a sign-in with GitHub, Google or Apple a check cookie "ayc_flow_…" is added, which expires after 10 minutes and goes only to that provider's way back; for Apple with SameSite=None, because Apple sends its answer as a form from its own page. Both are strictly necessary for the sign-in you request (§ 25 (2) no. 2 TDDDG).

The legal basis is Art. 6 (1) (b) GDPR (you use your account). Under "My account" you see your devices, ways in and usage, remove them and delete the whole account. What else the cloud stores and for how long: AyCode Cloud privacy.

Google Analytics (only with consent)

If you agree, we use Google Analytics 4 (measurement ID G-4N0EMTW9WN), a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It shows us which pages are read, which sections are viewed and which downloads are clicked, so we can improve aycode.ai. For this, Google records among other things the pages viewed, time spent, clicks, approximate region, device type, browser, operating system and the previous page. Google Analytics 4 does not store IP addresses; Google uses them only briefly to work out the approximate region. Google signals, advertising features and personalisation are switched off.

Google Analytics sets the cookies "_ga" and "_ga_…" (lifetime up to 2 years), which recognise your browser. Google keeps the measurement data for us for 2 months and deletes it after that.

The legal basis is your consent (Art. 6 (1) (a) GDPR and § 25 (1) TDDDG). Without a yes, gtag.js is not loaded and nothing is sent to Google. Google processes the data as our processor. Data may be transferred to Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework (Art. 45 GDPR), and the EU standard contractual clauses apply in addition.

Withdrawal: with "Cookie settings" at the bottom of every page you can change your choice at any time with effect for the future; the page then also removes Google's cookies. More from Google: Google privacy policy.

Storage in your browser

If you switch between the light and dark design, your browser stores that choice as "aycode-theme" in local storage, so the page looks the same on your next visit. Your answer to the statistics notice is kept there as "aycode-consent" (yes or no and the date; we ask again after a year). These values never leave your browser; you remove them by clearing the site data for aycode.ai. Storing them is strictly necessary for the function you chose (§ 25 (2) no. 2 TDDDG). So the page does not ask GitHub again for the version, downloads, stars and changelog on every visit, your browser also keeps GitHub's public answers in session storage and uses them for at most 30 minutes ("aycode-release", "aycode-stars", "aycode-changelog-…"). They contain nothing about you, never leave your browser and disappear when you close the tab; this too is strictly necessary for the page you request (§ 25 (2) no. 2 TDDDG).

Film, images and docs search

The film, images, animations and the docs search are served from our own server. The film loads only when you press play. What you type into the docs search stays in your browser.

Contact by email

If you write to us, we store your message and contact details to answer your request and any follow-up (Art. 6 (1) (b) GDPR for requests about a contract, otherwise (f)). We delete them once the request is settled and no retention duty applies. Our mailbox is hosted by Microsoft (Exchange Online, Microsoft Ireland Operations Ltd., Dublin), which processes emails on our behalf (Art. 28 GDPR). Microsoft may also process data in the USA; the EU-US Data Privacy Framework and the EU standard contractual clauses apply.

The AyCode app

• No telemetry by default. Unless you choose otherwise, the app sends no usage or analytics data to us. Crash reports stay on your computer; they leave it only if you copy a diagnosis and send it yourself.
• Usage statistics (optional, off by default). If you turn on "Share usage statistics" under Settings → About, the app reports to the AyCode Cloud (cloud.aycode.ai) every 4 minutes: a random installation ID, the app version, the operating system and processor type, whether AyCode is signed in to the cloud and which providers (such as Claude or Codex) were used in the last 7 days. No chats, files, paths, names or prompts, and no link to any account. The server keeps the ID only as a hash (HMAC), without an IP address, together with the latest details and on which of the last 30 days it reported; times of day are only counted as a total per hour across all installations. After 90 days without a report it deletes the ID. So that nobody can make up installations, it counts, only in memory and for at most a day, how many new ones arrive from one IP address (Art. 6 (1) (f) GDPR). We only see totals, such as how many installations are running right now. The legal basis is your consent (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG). You withdraw it at any time with the same switch; the app then deletes its ID, and turning it back on creates a new one.
• Transcription in the AyCode Cloud (optional). If you choose the "AyCode Cloud" engine under Settings → AyNotes, dictations and meeting recordings go encrypted to cloud.aycode.ai, dictations already while you speak. The server turns them into text with a speech recognition model on its own processor (currently NVIDIA Parakeet, whisper.cpp for some languages) and sends the text back. Audio and text are then discarded right away, also when you cancel a dictation, not stored and not logged; no third party is involved. This requires signing in to the AyCode Cloud. The legal basis is Art. 6 (1) (b) GDPR (you use the feature you chose). With recognition on your own computer, nothing leaves the device.
• Voice samples (optional, only after your yes). After the introduction, AyCode asks once whether you want to help improve its speech recognition; nothing is pre-selected, and without an answer nothing is sent. If you say yes, the app sends dictations you send in the chat to the AyCode Cloud: the recording (at most 60 seconds), the text the recognition heard, the text you sent, the language and the app version. Never meetings, never dictation into other programs. The cloud files them under a hash (HMAC) of a random ID of your computer, without account, name or IP address, and uses them only to train its own speech model (whisper) on technical terms. The recordings are not used to recognise you by your voice. Should training later run on a rented machine at another provider, we will name that processor here beforehand. So that nobody can fill the server with made-up IDs, it counts, only in memory and for at most a day, how many samples arrive from one IP address (Art. 6 (1) (f) GDPR). Samples are deleted after 730 days; "Delete my voice samples" under Settings → About deletes all of this computer's samples at once. If you delete your voice samples, we remove them from the AyCode Cloud's storage and from any training data we still keep from them. A speech model already trained with them contains no individual recordings and is not changed afterwards; future models are trained without them. The legal basis is your consent (Art. 6 (1) (a) GDPR), which you withdraw there at any time with the switch.
• Community portal (optional). At aycode.ai/community you can sign in with GitHub, post ideas and bugs, reply and vote. We store your numeric GitHub ID, name, display name and picture address, and your posts, replies and votes. Posts and replies are public, under your GitHub name; your browser loads profile pictures directly from GitHub. You can delete your own posts and replies at any time; the team may hide posts or block an account from writing. The legal basis is Art. 6 (1) (b) GDPR (you use the portal).
• Report a problem. If you send a report from AyCode, the app first shows exactly what it sends: title, description, app version, operating system and processor type, and only if you tick "attach diagnosis" the diagnosis (version, system, provider status and the latest errors, without chat content or keys). It never includes the diagnostic recording. The report goes to the AyCode Cloud without account, name or IP address, and only the team sees it. It is deleted after 180 days. If the team publishes the title and text as a bug post in the portal, that post stays without the diagnosis. The legal basis is Art. 6 (1) (b) GDPR (you ask us to fix a problem).
• Updates. The app asks GitHub's public interface for new versions and downloads updates from there. GitHub receives your IP address and the app's version string. If you choose the "Nightly" channel in the settings, the app asks the AyCode Cloud (cloud.aycode.ai) and downloads updates through it; the cloud fetches the files from our own server and receives your IP address and the app's version string without storing them. The legal basis is Art. 6 (1) (f) GDPR (secure, current software).
• Discovering connectors. Under Settings → Connectors, "Discover" shows popular connectors (MCP servers). Only when you open it and the saved list is older than six hours, or you choose "Refresh", does the app fetch GitHub's public list (api.mcp.github.com). When you search (from two characters) or open an entry of the official MCP Registry, your search term goes to registry.modelcontextprotocol.io. The app loads logos once from GitHub (avatars.githubusercontent.com, raw.githubusercontent.com) or from the publisher's verified website, also for connectors you have already set up. These services receive your IP address and the app's version string, nothing else about you. AyCode logs no search terms; the list and the logos stay on your computer. When you install a connector, the program in charge (npx, uvx or Docker) fetches it from its public source (such as npm, PyPI or Docker Hub); from then on the publisher's terms apply. Keys you enter for a connector stay on your computer, encrypted whenever your system provides a keychain. The legal basis is Art. 6 (1) (b) GDPR (you use the feature); storing on your device is strictly necessary for it (Section 25 (2) no. 2 TDDDG).
• Coding agents. AyCode starts the programs of the providers you installed and signed in to yourself, such as Claude Code or Codex. Your prompts and code go from your computer directly to that provider, under its terms. We receive none of it.
• Diagnostic recording (optional, off by default). If you turn it on under Settings → General → Privacy, AyCode records what the app and your coding agents say to each other, including your prompts, answers and file contents. The recording stays in your AyCode profile on your computer, readable only by your user account, and is never sent anywhere, neither with the chat backup nor to your phone. Keys, tokens, login and cookie headers and passwords are blacked out before anything is saved. While it runs, the sidebar says "Diagnostic recording on". The app deletes each file 7 days after it last changed and keeps at most 200 MB in all; "Delete recordings" removes everything at once. We receive none of it.
• AyCode Cloud (optional). For your phone, team sessions and encrypted chat backups, you can sign in to the AyCode Cloud. It runs on the same server operated by Ayont and stores only what it needs, chat backups only end-to-end encrypted. Details (in German): AyCode Cloud privacy.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). An email to [email protected] is enough.

Right to object (Art. 21 GDPR): where we process data based on our legitimate interest, you may object at any time on grounds relating to your particular situation.

You may also lodge a complaint with a data protection authority (Art. 77 GDPR). Ours is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, www.ldi.nrw.de.

Other

There is no automated decision-making or profiling. You are not obliged to provide data; without the technically necessary access data, however, the page cannot be delivered. The connection is always encrypted with TLS.