Privacy and retention

Skopac doo, Salakovci 26, Labin, Croatia operates DevKit. Auth0 handles identity, Stripe handles payments, and AWS hosts the production service.

Cloud stores account identifiers, entitlements, device and operation metadata, browser leases, and aggregate usage. We use these records to authenticate accounts, enforce access, connect devices, route requested tasks and operate the service. Source repositories stay on your Mac. Task requests pass through the cloud relay. Results and bounded diffs are temporarily stored in an encrypted relay table and normally deleted when the request completes. If execution is interrupted, expired relay records await asynchronous database deletion, which can take several days. Relay results are excluded from database backups. The paired Codex process sends selected project content to your configured model provider using your own account, including OpenAI when you use OpenAI models. Browser profiles are destroyed after each session.

Codex manages its ChatGPT login and refresh credentials locally on the Mac. DevKit does not read, copy or upload them, send them to the relay, expose them to task shells or save them in job receipts. The local Codex process sends selected project content directly to OpenAI under your ChatGPT account. DevKit requires subscription quota and does not fall back to API-key billing.

Account, entitlement, device, operation-binding and aggregate-usage records have no automatic expiry. They remain stored unless removed following a deletion request. You can disconnect the ChatGPT integration and revoke a paired device; revocation stops its access but does not delete historical metadata.

Operational logs contain metadata only. Logs are retained for 14 days and encrypted metadata backups for 7 days.

Contact nino@devkit.run for access or deletion requests.