Privacy Policy
Kodarr is an IDE for running and repairing infrastructure. Most of what it handles, including your servers, your credentials and your files, stays on your machine, and we never receive it. That is about where data goes, not how well it is guarded locally: some of what stays is stored unencrypted and is readable by other software running as you. This policy describes what leaves, where it goes, what we can and cannot see, and what protection local storage does and does not give you.
Contents
Section 1Who we are
Kodarr is produced by MortalMinds Labs, Inc., a corporation registered in Delaware, United States. Where this policy says “we”, it means that company. Where it says “Kodarr”, it means the desktop application and the services it talks to.
We are a US company with users worldwide. European and UK data protection law applies to us because our users are there, not because we are. See Your rights.
Our registered office:
MortalMinds Labs, Inc.2810 North Church Street
Wilmington, DE 19802
United States
Section 2What we collect
Kodarr collects very little, and all of it is tied to having an account.
| Data | When | Where it is stored |
|---|---|---|
| Email address | At sign-up | Neon (managed Postgres), via Neon Auth |
| Name | At sign-up, if you provide one | Neon, via Neon Auth |
| A one-time verification code | At sign-up and at sign-in | Neon, hashed, short-lived |
| Your Google or GitHub account number | When you sign up or sign in with Google or GitHub | Our authentication database, so we can recognise that account next time |
| Your email address and name, as Google or GitHub gives them | The first time you sign up with Google or GitHub | Our authentication database, as your account’s email address and name |
Signing in with Google or GitHub. If you choose “Continue with Google” or “Continue with GitHub”, that company tells us your account number with them, your email address, whether they have verified that address, and your name. Google also sends a link to your profile picture; GitHub sends your username, your profile picture link, the other details on your public GitHub profile, and the list of email addresses on your GitHub account. We keep only the account number, the one email address we use for your Kodarr account, and your name. We do not keep your picture, your other email addresses, your other profile details, or the access keys Google or GitHub issue for the sign-in, and we never use those keys to read anything else from your Google or GitHub account. We ask Google only for your basic profile and email address, and GitHub only for read access to your profile and email addresses.
We join a Google or GitHub sign-in to an existing Kodarr account only when both Google or GitHub and Kodarr have verified the email address. We never create an account from an email address Google or GitHub has not verified.
There is no analytics, no telemetry and no crash reporting in Kodarr. We do not know which features you use, how often you open the application, or whether it crashed.
Separately, if you send us beta feedback from the download page, we receive what you wrote, any screenshot you attach, and your email address if you chose to give one. That reaches an inbox we read; screenshots are also kept in our own Cloudflare storage, which is not public.
Section 3What stays on your machine
Kodarr keeps a local database in your user profile. We have no access to it. It holds:
- Your list of servers: labels, hostnames, ports, usernames.
- AI Chat, Agent and Network conversations, when transcript storage is on.
- Terminal output from Network panes, only if you turn scrollback persistence on for that session. It is off by default, because device output can contain anything typed at a prompt.
- An audit log of what Kodarr did to your infrastructure: commands run, files written, approvals given, and refusals. It records actions, not conversations.
- Rollback snapshots of files the Agent changed, so an edit can be undone.
All of it is on your disk, and none of it is transmitted to us.
This database is not encrypted, and is readable by other software running as you. It sits in your user profile as an ordinary file. Anything that runs under your user account, a shell, a VS Code extension, a coding agent you have installed, can read it, because it runs with your permissions, which are the permissions the file is protected by. This is inherent to a local tool: the same account that uses Kodarr can open Kodarr's files.
So treat the server list (labels, hostnames, ports, usernames), the audit log, and any stored conversations as visible to other software on your machine. It does not leave your machine and it does not reach us, but "on your machine" is not the same as "sealed off from everything else on your machine". Encryption of this database at rest is planned; until it ships, this is the accurate position.
Your SSH passwords, passphrases and private keys are the exception: they are held in your operating system's credential store, not in that database, and are never transmitted to us. Kodarr reads private key files from disk at connection time and does not copy them. Note that the credential store is also accessible to software running as you, and it raises the bar over a plain file rather than sealing it, so it is a stronger place to keep a secret, not an absolute one.
Section 4AI requests, and what happens to your prompts
When you send a message to a model, that message and the context Kodarr assembled for it leave your machine. There are two routes.
Free models, through our proxy
The request goes to a Cloudflare Worker we operate, which forwards it to OpenRouter, which routes it to a model provider. The Worker relays the request and the response; it exists to authenticate you, enforce rate limits, and confirm the model is actually free before spending on it.
Prompts you send to a free model are used to train models. This is not a risk
to be aware of; it is how the free tier works. Every request our proxy makes to OpenRouter
carries an explicit data policy of allow, which permits routing to providers that
retain inputs and train on them.
This is why the free tier is free. The alternative setting, deny,
restricts routing to providers that do not collect user data, and it would refuse nearly every
free model, because those models are offered free largely in exchange for the data. Sending
deny would not make the free tier private. It would make it empty. We would rather
say this plainly than offer a privacy assurance the product does not deliver.
So: do not paste credentials, private keys, a running production configuration, or anything you would not publish, into a free model. Use your own API key for those.
Why we state it as a policy rather than a setting. OpenRouter also exposes this as an account-level toggle in a dashboard. Had we relied on that, this paragraph would have been true only for as long as nobody changed a checkbox, months later, with no connection to what this page promises. The policy is instead sent on every individual request, from a single named constant in our proxy, so what this page says and what the code does cannot drift apart silently. If OpenRouter can find no provider matching the policy, the request fails with that reason rather than quietly routing somewhere else.
Your own API key, used directly
If you supply your own OpenRouter key, requests go from your machine to OpenRouter directly. Our proxy is not involved, we see nothing about those requests, and the data settings that apply are the ones on your OpenRouter account, including its training and data-collection settings. Nothing described above about the free tier applies to these requests.
What a request contains. Your message, earlier messages in that conversation, a summary of your connected servers, the contents of any file you attached, and, on the Agent, output from commands it ran. Assume anything you put in front of a model has left your machine.
Kodarr can read the folder you have open, but only sends a file's contents to a model if you attach it or name it. A directory listing is included so the assistant knows what exists; contents are not.
Section 5Third parties who process data
| Provider | What they handle | Why |
|---|---|---|
| Neon | Email, name, account records | Managed Postgres and authentication |
| Neon (email sender) | Verification emails | Currently sends one-time codes; being replaced by Resend |
| Resend | Verification emails | Transactional email, replacing the above |
| Cloudflare | Proxied AI requests, rate-limit counters, this website, installer downloads | Edge compute, storage and hosting |
| OpenRouter | Prompts and responses | Routes requests to model providers |
| Model providers | Prompts and responses | Generate the response; which one depends on the model you pick |
| The fact that you signed in to Kodarr with your Google account, if you choose to | Signing in with Google | |
| GitHub | The fact that you signed in to Kodarr with your GitHub account, if you choose to | Signing in with GitHub |
We do not sell personal data, and we do not share it with anyone for advertising.
Section 6Why we are allowed to process it
- Performance of a contract: your email and account record, because there is no account without them.
- Legitimate interests: rate-limit counters, to keep a free tier available and prevent abuse.
- Consent: sending your prompt to a model provider, which happens only when you send a message.
- Your choice: your Google or GitHub account number, email address and name, because you chose to sign in with Google or GitHub. You can use an email address and password instead.
Section 7How long we keep it, and deletion
Verification codes are short-lived and hashed at rest. Rate-limit counters expire on their own. Account records persist while the account exists.
Deleting your account. Deletion removes your profile from our database and then your identity from our authentication provider, in that order, so that if the second step fails your personal data is already gone rather than stranded behind an identity you can no longer sign in to.
You can do this yourself: Delete account, at the top right of the Kodarr panel, behind a confirmation. No request to us and no waiting.
It does not touch your local data. Servers, conversations, approvals and the audit log live in a database on your machine, and deleting your account leaves them exactly where they are. Remove those by deleting Kodarr’s data folder.
Deleting your account also removes the record that it can be signed in to with Google or GitHub. It does not change anything in your Google or GitHub account; to remove Kodarr from the list of apps there, use Google’s “Third-party apps & services” page or GitHub’s “Authorized OAuth Apps” page.
Section 8Your rights
Depending on where you live, you may have the right to access the data we hold about you, correct it, delete it, receive a copy in a portable format, object to processing, or restrict it. Because what we hold is essentially an email address and a name, most of these are quick to satisfy, and deletion you can carry out yourself without asking us.
EU and UK users. The GDPR and UK GDPR apply to us because we offer Kodarr to people in those territories, regardless of where the company sits. Users in California have rights under the CCPA/CPRA, including to know what is collected and to request deletion; we do not sell or share personal information as those terms are defined there.
To exercise any of these, write to hi@kodarr.com. You also have the right to complain to your local data protection authority.
Section 9International transfers
Our providers operate globally, and data you give us is processed in the United States and at Cloudflare edge locations worldwide, which means data from the UK or EEA leaves those territories.
Each of our providers publishes Standard Contractual Clauses and a UK Addendum as part of its data processing terms. We are confirming which of those we have executed, and until that is done we are not claiming them as a safeguard we hold. This section will state the position exactly once we have checked, rather than describing an arrangement we have not verified.
Section 10Security, and lending a node
Credentials are held in your operating system's credential store rather than by us. Connections to your servers are verified against a host key recorded on first use, and a changed key blocks the connection rather than warning about it. Traffic to our services is encrypted in transit.
Kodarr can lend an authenticated server session to other software on your machine, so tools like a terminal or another extension can reach a node without their own credentials. This happens only when you explicitly grant it, per node. While a node is lent, anything running under your user account can reach it, because Kodarr cannot tell one program from another. A grant ends when you revoke it or close Kodarr, is shown in the status bar the entire time it is active, and every session through it is recorded in your local audit log.
No system is perfectly secure, and we cannot guarantee the security of data in transit to third parties.
Section 11Children
Kodarr is a professional tool and is not directed at children.
Section 12Changes
We will update this page when what Kodarr does changes, and the date at the top will change with it. During the beta, behaviour is still moving.
Section 13Contact
If you have any questions or requests in connection with this Privacy Notice or other privacy-related matters, please send an email to hi@kodarr.com
Alternatively, inquiries may be addressed to:
MortalMinds Labs, Inc.Attn: Privacy Compliance Officer
2810 North Church Street
Wilmington, DE 19802 US