Code Crux Security & Compliance

Privacy Policy

Effective Date: October 13, 2025 · Contact: [email protected]

01 / LOCAL-FIRST

Zero Code Telemetry

Your source code, file trees, and terminal buffers remain on your device. We do not store or inspect your code.

02 / ENCRYPTION

Encrypted Peer Mesh

Collaboration flows through WebRTC peer-to-peer data channels with DTLS/SRTP end-to-end cryptographic protection.

03 / SOVEREIGNTY

Bring Your Own Key

AI model keys stay in your macOS Keychain or local storage. We never proxy or log your API keys or prompts.

1. Introduction & Philosophy

Code Crux ("Crux", "we", "our", or "us") operates the website at codecrux.us, the browser IDE at /ide, and the native Crux desktop application.

We believe developer tools must treat user source code as sacred, confidential property. Crux is designed from the silicon up as a local-first collaborative environment. This Privacy Policy explains our minimal data collection practices, our security posture, and how your privacy is protected.

2. Information We Do NOT Collect

Unlike conventional cloud-tethered editors, Crux does NOT collect:

Your Source Code: Files opened in Crux remain on your local disk or local browser memory. We never transmit your codebase to remote storage.
Terminal History & Commands: Shell sessions, commands, and outputs executed in Crux terminal instances run strictly in local PTY containers or local WebAssembly sandboxes.
Keystroke Logging & Audio/Video Streams: Cursor positions and edits are shared strictly peer-to-peer between your authorized collaborators via WebRTC CRDT sync.
Environment Secrets: API credentials, .env files, and SSH keys are never harvested or synchronized to our servers.

3. Information We Collect and Process

A. Waitlist & Early Access Contact Details

When you voluntarily register for early access or newsletter updates, we collect your email address and requested role. This information is stored securely in our Cloudflare D1 encrypted database and is used solely to provide waitlist updates, activation tokens, and critical release notices.

B. Authentication & Session Verification

Access to preview or protected IDE instances utilizes cryptographically hashed passcodes. We store one-way cryptographic hashes (never plaintext passwords). Successful authentication issues a time-bound cryptographic token stored in client localStorage.

C. Technical Telemetry (Web Only)

Our Cloudflare edge network processes standard HTTP connection headers (IP address, user agent, requested URL) to protect the site against distributed denial-of-service (DDoS) attacks and malicious bots. These logs are ephemeral and purged on automated retention schedules.

4. AI Models & Third-Party Providers

Crux supports connecting to local AI runners (such as Ollama or local llama.cpp) and external AI model APIs (such as Anthropic, Google, or OpenAI):

Local AI: When using local models, all inference executes 100% on your local GPU/CPU with 0 bytes sent across the public internet.
Cloud AI APIs: If you input your own API keys, they are stored securely on your machine (in the macOS Keychain on desktop, or isolated client storage). Requests go directly to the respective provider. Crux servers do not proxy, inspect, or retain your prompts.

5. Security Infrastructure & Hardening

We maintain rigorous defenses to protect our users and infrastructure against unauthorized access:

Cloudflare Edge Defense: Automated rate limiting, DDoS shielding, and strict IP attempt limiting on sensitive authentication gateways.
Zero Plaintext Secrets: Admin tokens and session credentials utilize timing-attack resistant cryptographic comparisons.
Memory Safety: Crux desktop core is compiled in Rust, eliminating buffer overflows, use-after-free, and common binary exploit vectors.
Content Security Policy: Enforced security headers preventing clickjacking, unauthorized script execution, and cross-site data exfiltration.

6. Your Data Rights (GDPR / CCPA)

Regardless of your geographic location, you retain full sovereignty over your data:

Right to Access / Portability: Request confirmation of any email address or waitlist entry associated with your identity.
Right to Erasure ("Right to be Forgotten"): Request immediate and permanent deletion of your waitlist record and email from our systems.
Right to Rectify: Update incorrect email or contact preferences at any time.

To exercise any of these rights, contact our security and privacy team directly at [email protected]. Requests are processed within 48 business hours.

7. Contact & Security Inquiries

For privacy requests, compliance questions, or vulnerability reports, please reach out directly:

CODE CRUX PRIVACY & SECURITY TEAM

Email: [email protected]

Domain: codecrux.us