What this policy covers
This policy describes how LegionCode (“we” or “us”) handles information through the website, access-request form, and hosted cloud workspace at legioncode.dev. Contact information appears below. Information in a workspace can include personal information contained in your code, prompts, attachments, and tool results.
If you run the open-source software yourself, you control that deployment’s storage, logging, and provider connections. This policy covers information sent to our hosted features; it does not describe every independent deployment or replace the policies of services you connect.
Information used by the hosted service
- Access requests: your email address, the form’s source, and request timestamps when you join the cloud-access waitlist.
- GitHub identity and access: your account identifier, login, avatar, available name and email, commit identity, authorization scopes, and OAuth credentials needed for the connection.
- Workspace content: connected repository details, branches, checked-out files, prompts, attachments, responses, commands and their results, proposed changes, review artifacts, and Git actions.
- Task and connection records: thread and run history, permission decisions, provider selection, connection status, API credentials you supply, model usage, and related task metadata.
- Operations and support: request and error records, diagnostic identifiers, and information you send when asking for help. Hosting and network providers also receive network information such as IP addresses and browser request metadata when serving requests.
How cloud tasks process your data
Cloud tasks execute on hosted infrastructure. The runtime can read the connected repository, use the credentials required for the task, and send prompts, selected context, attachments, and tool results to the model provider you configure. Supported integrations may receive information when your instructions or enabled tools call them.
Transcripts, lifecycle events, workspace metadata, and review artifacts are stored server-side so tasks can continue and their history can be reconstructed. We use account and operational information to control access, run the service, troubleshoot failures, prevent abuse, answer requests, and meet applicable legal obligations.
Provider credentials are stored in encrypted form. The service decrypts them when needed to validate a connection or make authorized provider requests. Using your own API key still involves server-side processing for hosted tasks. See the provider credential documentation for more detail.
Model providers and training
LegionCode uses configured model providers to perform the tasks you request. LegionCode does not use your private code, prompts, or task responses to train its own models. Keeping task history to support replay and review is separate from training a model.
A provider’s own retention, security, and training terms apply to information sent to that provider. Those terms can differ by provider, account type, and settings. Review them before using confidential or personal information. Connecting a provider through LegionCode does not change your agreement with that provider.
Retention and deletion requests
We keep records needed to operate accounts and workspaces, preserve requested task history, investigate faults and abuse, and meet legal obligations. The period depends on the record and its purpose. Some temporary execution data and artifacts may expire separately from account and transcript records.
You may ask for account or hosted-data deletion using the contact below. We may need to verify your identity and authority over a workspace. Records required by law or needed for an active security investigation may be retained, and backups may persist until their normal removal. We will explain any applicable limits when handling your request.
Signing out, archiving a chat, clearing your browser, or revoking GitHub authorization is not a deletion request. Disconnecting a provider removes it from active LegionCode connections; historical credential records can remain subject to the retention needs above. Revoke the credential with the provider as well if you want it to stop working elsewhere. We cannot erase copies held independently by your repository host, model provider, or your own deployments.
Your choices and applicable rights
You choose which repositories and providers to connect, what to submit in a task, and which supported actions to authorize. You can stop using hosted features, disconnect provider connections, and revoke GitHub access from your GitHub account settings. Keep passwords, API keys, and unnecessary personal information out of prompts and support reports.
Depending on the law that applies to you, you may have rights to access, correct, obtain a copy of, or request deletion of personal information, and to object to or limit certain processing. Contact us to make a request. We will assess it under applicable law, verify identity where needed, and explain the outcome. You may also have the right to contact a privacy regulator or appeal a decision.
Security and processing locations
Hosted access uses HTTPS, session cookies have security protections, and connected credentials are encrypted when stored. Access controls, workspace boundaries, and diagnostic redaction help protect the service. No system can eliminate every risk. Limit connected permissions, review changes, and protect your own accounts and backups.
Processing locations depend on the hosting infrastructure and providers used for a feature and may be outside your country. This notice does not promise that all workspace data stays in a particular country or region. Contact us before submitting data that requires a specific processing arrangement.
Children, updates, and contact
The hosted service is intended for adults and is not directed to children. If you believe a child supplied personal information, contact us so that we can investigate and take appropriate action.
Revisions will be dated on this page. We will give additional notice of material changes where required. Questions about this policy and requests concerning your personal information can be sent to the contact route below. See also our Terms of Service.
Contact LegionCode through the project support tracker. For a privacy, account-deletion, or legal request that involves confidential information, first ask for a private follow-up channel. Do not post credentials, private code, identity documents, or other sensitive personal information in a public issue.