Privacy Policy

In plain English

We don't collect your code. Ever.
If you sign up for the launch email, we store your email address. That's the only personal data we hold directly.
We use Resend to send the email, Cloudflare to route web traffic, and Google Analytics to count visits. No advertising, no behavioral profiling.
You can ask us to delete your data at any time by emailing [email protected].

1. Who we are

Chorus is operated by us, the Chorus team based in Sydney, Australia ("we", "us", "our"). For privacy questions, contact [email protected].

2. What this policy covers

This policy applies to:

The website at chorus.codes (the "Site").
The Chorus CLI engine and local daemon when used in its default configuration.
Future hosted services we operate (cloud Pro/Teams tiers, edge proxy for bundled credits) — separate notices may apply once those launch.

It does not cover the third-party CLIs (Claude Code, Codex, Gemini CLI, Kimi CLI, OpenCode, etc.) you authenticate Chorus to talk to. Those have their own privacy policies, and your prompts and code go to those vendors directly under their terms.

3. What we collect

3.1 What we DO collect

Email address — only if you submit it via the "Get notified" form. Stored in our Resend audience for the purpose of sending you one launch email and any future opt-in updates you've explicitly subscribed to.
IP address — captured transiently by our notify endpoint for rate-limit enforcement (5 submissions per hour). Not persisted to disk.
Web server access logs — standard nginx logs (timestamp, request path, response code, user-agent, IP). Retained for up to 30 days for debugging and abuse prevention, then deleted.
Aggregate analytics — Google Analytics 4 collects standard web analytics (page views, referrer, approximate location from anonymized IP, device/browser type, session duration) via the _ga and _ga_ZG8HTGXJCS cookies. We use this only to understand which pages people read and where visitors come from. See our Cookie Policy for details.

3.2 What we DO NOT collect

Your source code, files, or repository contents.
Your prompts to AI models.
The responses you receive from AI models.
Any telemetry from the local Chorus daemon — there is none, by default.
Cookies for advertising, retargeting, or behavioral profiling.
Information about you from third-party data brokers.

4. How we use what we collect

Email addresses are used solely to send the messages you signed up for. We will never sell, rent, or share your email with third parties.

IPs and access logs are used for security, rate limiting, and debugging. We do not use them to build profiles or track individuals across sessions.

5. Third parties we use

Resend (privacy policy) — stores your email in our audience and delivers messages on our behalf.
Cloudflare (privacy policy) — routes traffic to chorus.codes and provides DDoS / bot protection. Cloudflare may set short-lived security cookies; see our Cookie Policy.
Google Analytics 4 (privacy policy) — provides aggregate web analytics for the Site. IP anonymization is on by default; we have not enabled Google Signals, advertising features, or remarketing.
GitHub (privacy policy) — hosts our public source repository. We do not embed GitHub UI on the Site.
Google Fonts — the Site loads the Geist webfont from Google Fonts. Your browser will make a request to fonts.googleapis.com; per Google's policy, no cookies are set.

6. Data retention

Email addresses: retained until you unsubscribe or request deletion.
Access logs: rotated and deleted after 30 days.
Rate-limit IP records: held in process memory only; cleared on service restart.

7. Your rights

Depending on where you live, you may have rights under GDPR, CCPA, or similar laws, including:

Access — ask what we hold about you.
Deletion — ask us to delete it.
Correction — ask us to fix it if it's wrong.
Portability — ask for a copy in a common format.
Objection / withdrawal of consent — at any time.

To exercise any of these, email [email protected]. We respond within 30 days.

8. Security

API keys and credentials we hold for ourselves are stored with file-system permissions restricted to a single OS user (mode 600) and never checked into source control. Email addresses are stored at Resend, which encrypts data at rest.

That said, no transmission over the internet is 100% secure. You use the Site and the software at your own risk. See the Terms of Use for the full disclaimer.

9. Children

The Site is not directed at children under 16 and we do not knowingly collect data from anyone under 16.

10. International transfers

Our infrastructure runs on servers in the EU, North America, and Asia depending on the service. By using the Site you consent to your data being processed in any of these regions.

11. Changes to this policy

We may update this policy as the product evolves (e.g., when bundled credits launch, or when hosted Pro tier is introduced). Material changes will be announced on the Site and, where relevant, by email to subscribers. The "Last updated" date at the top of this page always reflects the current version.

12. Contact

Privacy questions, deletion requests, or anything else: [email protected].