Pragma Privacy Policy

01 Privacy Overview

Pragma is a developer tool that integrates AI capabilities to assist with code generation, analysis, and suggestions. Your privacy is fundamental to our design:

• Optional Backend Mode: When using Pragma with our backend proxy, your code and prompts are sent to our servers to interact with AI models.
• Standalone Mode: You can run Pragma independently by providing your own API keys (Claude or OpenAI), keeping all data local to your machine.
• No Code Selling: We never sell your code, prompts, or generated outputs to third parties.
• Full Transparency: This policy discloses exactly what data we collect, where it goes, and why.

02 What Data We Collect

Account & Authentication Data

• Email address and authentication credentials
• OAuth provider information (if using social login)
• Account tier/plan information for billing
• Session tokens and refresh tokens for security

Usage & Telemetry Data

When you use Pragma, we may collect:

• Console Interactions: Commands you run, their execution time, and output (excluding sensitive secrets)
• AI Request Metadata: Model used, response time, token counts, error types
• Feature Usage: Which Pragma features you use (code completion, suggestions, etc.)
• Device Information: OS type, Pragma version, app crashes and errors
• Geographic Data: Inferred from IP address for service optimization

AI & Code Data

In Backend Mode: When you submit code prompts to Pragma's backend, we send to our AI partners:

• Your code snippets or natural language prompts
• Relevant file context (for better AI understanding)
• Project type/language hints for optimization

In Standalone Mode: All data stays on your machine; we receive zero code or prompts.

Billing Data

• Payment method information (handled by payment processors, not us)
• Billing address and invoice data
• API usage metrics for billing calculation

03 AI Partners & Data Sharing

To provide AI capabilities, Pragma partners with:

Anthropic (Claude)

• What We Share: Your code prompts and context (necessary for Claude to generate responses)
• Retention: Anthropic retains data per their Privacy Policy
• Your Control: Choose Haiku (free), Sonnet (pro), or Opus (enterprise) models based on your needs
• Note: As of 2026, Anthropic does NOT train on user interactions unless you opt-in

OpenAI (GPT Models)

• What We Share: Your code prompts and context (necessary for GPT to generate responses)
• Retention: OpenAI retains data per their Privacy Policy
• Your Control: Choose GPT-4 Turbo (standard), GPT-4o (balanced), or GPT-4o Advanced (premium) based on your tier
• Note: Verify OpenAI's current data usage policies on their website

⚠️ Important: Do NOT include passwords, API keys, or tokens in code submitted to AI. These services will see this data. If you need privacy for secrets, use standalone mode with local models or carefully redact sensitive information.

04 How We Use Your Data

• Service Delivery: Running Pragma, processing your requests, sending to AI partners
• Performance: Analyzing usage patterns to improve response times and model selection
• Billing: Tracking API usage to calculate subscription charges and enforce rate limits
• Debugging: Investigating crashes, errors, and support tickets
• Product Improvements: Anonymized telemetry to understand feature adoption and pain points
• Security: Detecting abuse, fraud, and unauthorized access attempts
• Communications: Notifying you of service updates, billing issues, or policy changes

05 Where Your Data is Stored

• Primary Storage: CredVault cloud infrastructure (details in CredVault's Privacy Policy)
• AI Partner Servers: Code/prompts sent to Anthropic or OpenAI servers when using backend mode
• Backups: Encrypted backups retained for up to 90 days for disaster recovery
• Logs: Authentication and error logs retained for 30 days for security

You may request data deletion; historical telemetry cannot be recovered but will be purged after 1 year.

06 Your Privacy Controls

Telemetry Settings

You can disable telemetry collection in Pragma settings:

• Disable console interaction logging
• Disable crash reporting
• Disable feature usage analytics

Standalone Mode (Recommended for Privacy)

Configure Pragma to use your own API keys:

• Provide your Anthropic or OpenAI API key directly in Pragma
• Zero data sent to CredVault backend (only to your chosen AI provider)
• Full control over what data leaves your machine

Data Requests & Deletion

You have the right to:

• Request export of your personal data
• Delete your account and associated data (within legal retention limits)
• Opt-out of specific data uses (e.g., marketing emails)

Contact privacy@credvault.net to exercise these rights.

07 Security & Protection

• Encryption in Transit: All data transmitted to Pragma backend uses TLS 1.3
• Encryption at Rest: Database records encrypted with AES-256
• API Keys: Never exposed to frontend; stored only in backend environment
• Authentication: JWT-based session security with automatic expiration
• Secrets Filtering: We attempt to filter common patterns (AWS keys, tokens) from telemetry
• Audit Logs: All account access and data exports are logged

We cannot guarantee 100% security, but we follow industry best practices and maintain cyber liability insurance.

08 Third-Party Services

Pragma uses the following third parties:

• Anthropic & OpenAI: AI model providers (see Section 03)
• Paystack: Payment processing (does NOT store card data with us)
• Sentry: Error tracking and crash reporting (only in Telemetry Mode)
• Google Analytics: Website analytics only (not app analytics)

Each service has its own privacy policy; you are responsible for reviewing them.

09 Data Retention

10 Children & Minors

Pragma is intended for developers aged 18+. We do not knowingly collect data from children under 13. If we discover a minor's account, we will delete it immediately. Parents/guardians concerned about minor accounts should contact privacy@credvault.net.

11 International Data Transfers

By using Pragma, you consent to your data being transferred to and stored in countries where CredVault and its partners operate (including Kenya, USA, and EU). These countries may have different data protection laws than your home country. We ensure transfers comply with applicable regulations (e.g., Standard Contractual Clauses).

12 Policy Changes

We may update this Privacy Policy periodically. Material changes will be announced via email or in-app notification. Continued use after 30 days constitutes acceptance. The effective date is shown at the top of this page.

13 Contact Us

For privacy questions or to exercise your rights: