Privacy Policy
CleverCoder · Last updated: October 10, 2026
The short version, in three sentences. CleverCoder runs on your computer and your code is
never sent to us. Everything the program learns about your projects stays on your own disk. Everything that
leaves your machine is listed below.
Data controller
CleverCat SpA, tax ID (RUT) 78.515.188-7, a company registered in
Chile.
To exercise your rights or ask anything about this policy, write to
support@clevercoder.app.
1. Your code never leaves your computer
CleverCoder analyses the projects you open so it can search and navigate them: files, symbols and the
references between them. That analysis is stored on your own disk, in a local database inside
the project folder (.clevercoder/). It is not uploaded to any server of ours: our only server
stores your license and your subscription, never your code.
2. What the program stores, and where
| What | Where it stays |
|---|
| Index of your code (files, symbols, references) | Project folder, .clevercoder/ |
| Agent configuration, sessions and identities | Project folder, .clevercoder/ |
| Assistant memory (the notes they keep) | Your user profile, inside the Claude Code folder |
| Passwords and keys you store in the vault | %APPDATA%\CleverCoder\vault, encrypted |
| Backups, if you enable them | The destination you choose (an external drive, for example) |
| Install notice (your email, a machine identifier, the type of key, the program version, the time and an anti-spam signature) | Your user profile, in %APPDATA%\CleverCoder\install-outbox.json. Today it is not sent to any server. |
3. The credential vault
If you store passwords, tokens or API keys in the vault, they are encrypted with AES-GCM
using a key derived from your PIN via PBKDF2. The encrypted file lives on your machine and
is never transmitted: the vault module has no network code at all.
Because the encryption depends on your PIN, if you lose it we cannot recover your data.
We hold no copy.
4. What does leave your computer (the complete list)
| When | Where to | What is sent |
|---|
| When CleverCoder opens with a purchased license and, while it stays open, every 24 hours; with a connection, if the license is about to expire or has already expired (the server only renews it if your subscription is still paid); and when you ask to free your machines |
Our license server (clevercoder.app), hosted at HostGator |
Your whole license (it carries your email address, your subscription number, the plan and its expiry) and,
in the machine check, a machine identifier computed with a hash (HMAC-SHA256 of the Windows machine
identifier: the original identifier does not leave your machine), a random number for each check and the protocol
version. When you ask to free your machines, the language of the program (Spanish or English) is also sent,
so that we write the email in that language. Your machine name, your Windows version and your code are not sent. As on any connection, the server sees
your IP address; we only store it as a salted hash, to limit abuse. The hosting provider may record it in its own
access logs. The free license, the 3 days without registering, the beta and the master key do not make this check. |
| When you request the free license (in the program or at clevercoder.app/gratis), when you renew it as it is about to expire, and when you redeem a Pro code |
Our license server (clevercoder.app), hosted at HostGator |
Your email (in lowercase), the language of the program and whether you want to receive emails. With the second step, the 6-digit PIN that reached you by email to confirm that it is yours.
When you renew, your free license is sent. When you redeem a code, the code and your email are sent. As on any connection, the server sees your IP address;
we only store it as a salted hash, to limit abuse. |
| About 90 seconds after CleverCoder opens |
models.dev |
Nothing of yours: the public catalog of AI models is downloaded. That service sees your IP address and that you use CleverCoder. |
| On that same startup, when checking which free models are available |
integrate.api.nvidia.com and opencode.ai/zen |
No key and nothing of yours: a request for the model list and, at NVIDIA, for each model missing from its list, a minimal test message. Those services see your IP address. |
| Only if you choose the Dss status bar: while Claude Code is open, at most once a minute |
Anthropic (api.anthropic.com/api/oauth/usage) |
A read-only request with your own Claude token, to show your usage limits in the bar. It sends no message and spends no tokens. A PowerShell script that runs on your machine makes it. It is between you and Anthropic: we do not see it. If you do not choose that bar, it does not happen. |
| When you open the Account panel |
Anthropic (api.claude.ai) |
Your Claude name and email, with your own token, to display them. It is between you and Anthropic: we do not see it. Your usage limits (5 hours and week) are not requested from Anthropic: they are read from what Claude Code already passes to the status bar on your machine, without going out to the network. |
| When you install VERDESK from the MCP manager, or verify a GitHub token that you type in |
api.github.com |
A public request to offer VERDESK. If you verify a GitHub token, that token goes to GitHub with the request. Nothing reaches us. |
| Sending a bug report or feedback |
Our license server (clevercoder.app), hosted at HostGator, which forwards it by email to the CleverCoder team: to a mailbox on the server and to a copy in a Gmail account (Google). Earlier versions still send it to a form hosted on Google (Apps Script + spreadsheet) until they are updated. |
The report title and text, the type, the app version, a random identifier generated on your machine, the
date, an anti-spam signature, and your email only if you type it in. A report that an AI assistant
working on your machine writes and you confirm also goes out through here. Crash reports include the technical detail of
the failure. See the notice below. |
| Starting the program |
worldtimeapi.org |
Nothing. It only reads the UTC time. As with any connection, that service sees your IP address. |
| When you open the skills Pool (and when you press refresh in the Skills window) |
GitHub (raw.githubusercontent.com) |
Nothing of yours: the public skills catalog is downloaded. GitHub sees your IP address and that you use CleverCoder. |
| On opening an installed CleverCoder and then every 6 hours |
GitHub (public releases repository) |
Nothing of yours: it checks whether a newer version exists. GitHub sees your IP address and that you use CleverCoder. |
| Downloading updates, plugins or voices |
GitHub, the npm registry, NuGet, Hugging Face |
Nothing of yours — these are downloads. Those services see your IP address, as with any download. |
What our server does with that data. It records your license (email, plan, expiry and how far it is paid)
and links that license to the machines where you use it (it stores the hash of each machine, the first and
last time it saw it). With that it applies the limit of 2 machines and lets you free them. It counts how many
different machines ask for each license within 30 days and flags the ones above 4, so support can look at them: it
is a measure against sharing a license. Because the hash of a machine is always the same, the server could recognise that
one machine uses more than one license. To let you free your machines we write to the email of your license with a
single-use link that expires in 60 minutes.
An honest note about crash reports. The technical detail of a failure can include
file paths from your machine, and those paths often contain your Windows username and your
project names. The send checkbox is ticked by default and you can untick it before closing the dialog.
If you prefer it never to send anything, set ReportEndpointUrl
in %APPDATA%\CleverCoder\settings.json to a value that is not an address, for example off;
if you leave it empty, the default address is used.
5. What is recorded
We do not record which files you open, how much you use the program, or what you write. What is
recorded are the checks of your license (your license and the hash of your machine, see above) and, if you choose to
send them (or confirm one drafted by your assistant), your bug reports or feedback. Outside of that, the program does not connect to our servers.
(The install notice is saved only on your machine, see section 2.)
Visits to this website. We count how many times the public pages of clevercoder.app are opened (home, free license, privacy, terms, release notes and license agreement), to know how many people visit us and in which language.
For each hour we store only numbers: how many visits there were, from people or from crawlers (such as Facebook's or Google's), to which page, in which language the page was shown, the browser's preferred language (for example "es-CL")
and whether the language was changed with the selector. We do not store your IP address, the name of your browser, or the page you came from, and we use no new cookies or third-party tools for this.
To avoid counting the same person twice in one day we compute an irreversible fingerprint (a hash with a secret key that changes every day) and keep it for 48 hours at most; after that it is deleted and only the number of visitors for that day remains,
so it is not possible to recognize you from one day to the next. These counts carry no name or email and are not linked to your license. Like any web server, our hosting provider (HostGator, section 7) may keep its own technical access logs, which we do not manage from this account.
6. The AI assistants are yours, not ours
CleverCoder does not send your code to any AI model. What it does is launch, on your machine, the
tool you chose (Claude Code, for example) using your own account and your own credentials.
The conversation with that provider happens between you and them: we do not see it, store it or
intermediate it.
This means that how that provider handles your code is governed by their privacy policy, not
by this one. We recommend reading it.
When you buy. The purchase does not happen inside the program, but on this website and on PayPal. When you
choose a plan we send you to PayPal, where you pay and approve the recurring charge. PayPal handles your payment details
under its own policy; we do not see your card. Of what PayPal reports to us we keep only your email address, the
plan, your subscription number, the status of the charges (charged, failed,
cancelled, refunded) and the charge references (sale identifier and date of the last charge). With that we keep your order and your license and send you the license by email from
support@clevercoder.app. The same license is shown on the page you return to when the purchase ends, only in the
browser you bought with, for 24 hours: for that, the page uses a technical cookie (purchase session,
httpOnly, 24 hours) that is not used to track you or for advertising. The website also stores a language
cookie (cc_lang, 1 year) to remember whether you see it in Spanish or English. After 24 hours the
license stays in your email; if you lose it you can ask us to send it again, always to the email you bought with.
When you request the free license. You request it in the program or at clevercoder.app/gratis. To give it to you we keep your email address, the
language of the program, its expiry and your choice about emails. To confirm your email we send you a 6-digit PIN that is valid for 15 minutes: we keep only a fingerprint of the PIN, not the PIN, until you use it or it expires. We neither ask for nor keep documents or proofs. We use that data to sign and renew your
license, to send it to you by email, to limit abuse (one free license per email, with limits on requests per hour and per day) and, only if you asked for it, to send you emails. We keep it while your free
license is valid and afterwards until you ask for it to be deleted (see below).
CleverCoder emails. When you request the free license, the box to receive emails comes unchecked. If you check it, we send you an email so that you
confirm from your own email that you want them: until you confirm, you are not on the list. They are informational emails and
every email carries a link to unsubscribe. Unsubscribing always works and does not affect your license. For everything else we write to you (your license, its renewal, freeing your machines)
you do not need to be on the list. If you ask us to delete your data, you also leave the list.
7. Third parties involved
- PayPal — processes the payment and manages the recurring charge. It receives your payment details under
its own privacy policy; of what it reports to us we keep only your email, the plan, the subscription number, the status of the charges and the charge references (sale identifier and date of the last charge).
- HostGator — hosts our license server (where bug reports arrive) and the clevercoder.app mailboxes where we receive
the bug reports and the notices of issued licenses. The reports and those notices are sent to the team by HostGator's own mail server, without going through any other sending service.
- Resend — sends, on behalf of our server and from support@clevercoder.app, the CleverCoder emails that reach you: your license, the confirmation and machine-release links
and the emails you asked for and confirmed. It receives the content of those emails (including your license when we send it to you) under its own privacy policy. Bug reports and license notices do not go through Resend.
- Google — receives, in a Gmail account, a copy of the bug reports and of the notices of issued licenses (without the license). It also hosts the form and sheet that receive bug reports from earlier versions, which do not use our server yet.
- GitHub — distributes the installer and updates.
How long bug reports are kept, and how to have one deleted
Bug reports arrive in an email inbox and
stay there: there is no automatic
deletion schedule and no database rotating them out.
You can ask for yours to be deleted. Write to
support@clevercoder.app and it will be removed
on request, from the copy as well. Deletion is manual, not automatic, which is why you need to ask.
Your license and purchase data. We keep them while your subscription or your free license is valid and afterwards until you
ask for them to be deleted.
You can ask us to delete your data by writing to
support@clevercoder.app; deletion is manual, not automatic: that's why
you need to ask for it. The hashes of the machines where you activated your license are kept with it and are deleted when you free your machines or when you ask for your data to be deleted. In addition, the record of machines that asked for your license, used to detect misuse, is deleted 30 days after its last check; freeing your machines does not delete it. We will not be able to delete
what the law requires us to keep.
Notice to support. Each license we issue (purchase, resend, free license or code redemption) also leaves a notice by email, so we can help you, in a mailbox on the server (support@clevercoder.app) and in a copy in a Gmail account (Google):
your email, the plan, the expiry date, the license identifier, the language and a short code that lets us recognize it, but
not the license itself.
8. Minors
CleverCoder is a professional tool and is not directed at minors.
9. Changes to this policy
If this policy changes, the date in the header is updated. If the change affects what data leaves your
machine, it will be announced in the release notes for that version.