Privacy Policy

Who we are

Polka Codes is owned and operated by XEN SOFTWARE CONSULTING LIMITED in New Zealand. This policy explains how we collect, use, disclose, and protect personal information when you use Polka Codes.

For privacy questions, access or correction requests, or complaints, contact us at hello@polka.codes.

Information we collect

When you sign in with GitHub, we collect information GitHub provides to us, such as your GitHub user ID, login, name, avatar, email address, email verification status, OAuth tokens, and repository installation information needed to provide the service.

When you use the app, we collect workspace and account information such as chat messages, prompts, code snippets, generated outputs, selected repositories, repository settings, workflow progress, memory files, uploaded images, support messages, preferences, usage records, quota state, and billing metadata.

We also collect technical and diagnostic information such as request metadata, error logs, workflow durations, tool invocations, token usage, model/provider metadata, analytics events, and security or abuse-prevention records.

How we use information

We use personal information to authenticate users, provide repository-aware AI workflows, maintain chat and workspace continuity, process billing, enforce quotas and feature access, troubleshoot issues, improve reliability, prevent abuse, and respond to support or legal requests.

We use usage and diagnostic information to understand service performance, billing costs, product health, and failure patterns. Where practical, analytics are aggregated or limited to the information needed for operation and support.

Service providers and overseas processing

We use service providers to run Polka Codes, including GitHub for authentication and repository access, Stripe for payments, Cloudflare for hosting, storage, analytics, Workers, Durable Objects, R2, D1, AI Gateway, and sandbox infrastructure, AI model providers routed through AI Gateway, and email infrastructure for account and support messages.

These providers may process information outside New Zealand. We use them only for operating, securing, supporting, and improving Polka Codes, and we expect them to handle information under their own applicable security, privacy, and data processing commitments.

Repository content and AI processing

If you connect a repository or provide code, prompts, files, logs, or screenshots, that content may be sent to AI model providers and supporting infrastructure so the app can answer questions, generate plans, inspect errors, propose code, run workflows, and produce outputs.

Uploaded images are stored under your account and are served only to your authenticated account while they remain in Polka Codes.

You should not submit secrets, credentials, private keys, regulated personal information, or confidential material unless you are authorised to do so and are comfortable with it being processed by the service providers needed to operate the app.

Retention and deletion

We keep account, workspace, chat, repository, billing, usage, and diagnostic records for as long as needed to provide the service, meet legal or accounting obligations, resolve disputes, prevent abuse, and maintain backups or audit records.

You may request access, correction, or deletion by contacting hello@polka.codes or by using account deletion in settings. We may need to retain limited information where required by law, for billing records, security, abuse prevention, dispute handling, or backup integrity.

Security

We use technical and organisational safeguards designed to protect personal information, including access controls, hosted infrastructure security, authentication, logging, and separation of application data across the relevant storage systems.

No online service can guarantee absolute security. If you believe your account or data has been exposed, contact hello@polka.codes promptly.

Your rights

Under New Zealand privacy law, you can ask for access to personal information we hold about you and ask us to correct it. We may need to verify your identity before responding.

If you are not satisfied with our response to a privacy concern, you can contact the New Zealand Office of the Privacy Commissioner.