Privacy Policy

This is the privacy policy for Expecto Centum, an AI-assisted engineering tool. We've tried to keep this document free of jargon. If a sentence here is doing more work than it should, write to us.

The tool runs as a desktop application on your computer. Your code never leaves your machine via Expecto Centum — we don't collect, store, or transmit it. The data we do handle is the modest amount needed to run an account: your name, email, OAuth identity, IP-level web logs, and (if you pay us) payment information processed by Stripe. The desktop app sends nothing about how you use it unless you say yes: the first time you open it, it asks whether to send a few anonymous daily usage counts, and if you say no it sends none. Beyond those, the only thing it sends about itself is an error report you explicitly choose to send. This website counts visits and sign-up steps with Aptabase, an analytics service that sets no cookies and records nothing that names you.

What the app does on your behalf is a separate matter, and worth stating plainly: the CLI coding agents you install and register run on your machine under your own credentials, and the code they read goes to whichever model provider each one is configured to call. That traffic is between you and that provider — it never passes through us — but it is not the same thing as your code staying on the machine.

You can ask us to show you, correct, or delete your data at any time, for any reason, and you don't need to give a reason.

Expecto Centum is operated by:

Alfonso Cejudo
Revoluční 2137/8b
110 00 Prague, Czech Republic
Business ID (IČO) 23226684
privacy@expectocentum.com

Because we're established in the EU, we act as the data controller under the GDPR for the personal data described in this policy.

Account information

When you create an account we collect your name, email address, and a password hash (we never see or store the password itself — it is hashed using a one-way function before it touches our database).

Opening an account means ticking the box that accepts the Terms of Service, so we also record when you accepted them and which published version you were shown, alongside the moment you acknowledged what the tool does. That record is what lets either of us answer "what did this account actually agree to".

If you turn on two-factor authentication, we also store the secret your authenticator app shares with us when you set it up, which is what lets us check the codes it shows you. Turning it off deletes it.

OAuth identity

If you choose to register or sign in with GitHub, GitLab, Bitbucket, or Google, we receive the basic identity attributes those providers expose: typically your provider user ID, display name, email address, and avatar URL. We request the minimum scope needed for sign-in, which does not include access to your repositories.

Connecting a Git provider inside the desktop app — so a run can push a branch or open a pull request — is a separate act. That connection is authorized on your machine and its credentials are stored encrypted there; we never receive them, and what it can reach is between you and the provider.

The security check on sign-up and sign-in

Signing up, signing in with a password, resetting a password and asking for a new code run a check from Cloudflare Turnstile that tells people apart from automated sign-ups. Cloudflare's script runs in your browser on those forms only, and sees what it needs to make that call: your IP address, your browser's user-agent and the way your browser connects. Cloudflare does not use it to identify you, and it is not used for advertising. Cloudflare runs the check on our behalf, and also uses those signals, under its own Turnstile privacy addendum, to improve how it detects bots.

Error reports you send us

When the desktop app hits an error it offers to report it, and nothing is sent unless you accept the offer. A report carries the error line, the error's full text (for a crash, the trace of where in the app it happened and the errors that led to it), the last 40 lines of the app's console log, the app version, your platform, which workflow was running, and your account ID.

There is no automatic crash upload to go with it. A report exists because you chose to send it, and declining sends nothing.

Reports are filed as issues in our own product repository on GitHub, which is private. They carry your account ID rather than being anonymous, which is how one reporter's errors are told apart from another's. A repeat of an error already on file is counted but not filed again, and there is a cap on how many reports one account can send in an hour.

Bug reports and feature requests

When you are signed in, you can send us a bug report or a feature request from this website. What you write (whether it is a bug or a request, its title and its description) is filed with your account ID as an issue in the same private product repository on GitHub, and we log each submission so one account can't send more than a handful an hour.

Payment information

If you subscribe to a paid plan, payment is handled by Stripe. Your card details go to Stripe and stay there. We never see the number, and the only thing kept on our side is the customer reference Stripe hands back — the string that ties your account to your subscription. Closing your account deletes that customer at Stripe, saved card included. Stripe's own privacy notice governs what it holds: stripe.com/privacy.

The machine you sign in from

One account is one active desktop session, so when you sign in from the desktop app we store an identifier for that machine, the name it reports, and when it was last active. You can see all three under Account → Devices and sign the machine out from there, and signing in somewhere else takes the seat from it. It is how the seat is held, and it is used for nothing else.

Where you're signed in

Each sign-in — in a browser or in the desktop app — is a session, and for each one our authentication provider keeps when it signed in, when it was last used, and the IP address and user-agent of its latest request. Account → Devices lists your sessions by the browser and system that user-agent names, with both dates, and lets you sign out of all of them at once. They are used to keep you signed in and to show you where you are, and for nothing else.

Signing the desktop app in

The desktop app signs in through this website. While it does, we keep the identifiers that connect your browser sign-in to the app that started it — a sign-in request, and once you have signed in, your account ID and a one-time approval for the app. We also keep a record linking the app's session to your account, which confirms that the required sign-in checks were completed in your browser. These records hold no password and no authenticator code, and they are used only for signing you in and keeping your account secure.

Desktop app usage counts

The first time you open the desktop app it asks whether to send anonymous usage counts. Nothing is sent, and nothing is kept on your computer for them, unless you say yes. If you do, the app sends them to Aptabase: that it was installed; that it was opened in a given day, week and month; once a day, your plan (or that you are signed out) and whether you are on a trial, and which kinds of coding agent, Git host and ticket source you have set up; and, for each run, whether it is one of the built-in workflows or one of your own, and whether you started it or 24/7 development did. Each count also carries your operating system and its version, the app version and your language setting.

None of it names you or your computer: no name, email address, account ID, connection name, server address, workspace, repository, workflow name, ticket or code. Each count is sent on its own with a random identifier used once, and is stamped only with the hour it happened in, so counts can't be tied to one another or to you. To send each count only once, the app keeps a small record on your computer of what it has already sent.

You can change your answer at any time under Settings → General. Turning the counts off stops them straight away, drops anything still waiting to be sent, and deletes that record from your computer.

Website analytics

This website counts how it is used, through Aptabase. What it records is: which page was opened (the address without anything after the ?); the steps of signing up (whether by email or which sign-in provider, and which plan you were heading for); starting and returning from a checkout, with the plan; a change of plan — which plan an account moved from and to, and whether its free trial was still running; and on the referrals page, generating, copying or claiming a code, whether you had a generated code emailed to someone, and why a claim was turned down; and a step that failed — signing up, signing in, resetting a password, changing your email, turning two-factor on or off, or opening a checkout or the billing portal — with which step it was and the short error code the service gave for it, never the error's own wording. Each event sent from your browser also carries your browser's language and the name and version of your browser and operating system. A change of plan, a sign-in link our server couldn't redeem, and a request to Stripe or an update from it that failed are sent by our server, so they carry none of those and leave nothing from your browser.

None of it names you. No name, email address, account ID or referral code is sent, there is no cookie, and nothing is stored in your browser. Each request reaches Aptabase with your IP address and user-agent, as every web request does, and it turns those into a one-way hash with a secret it replaces every 24 hours — so one day's visits can't be tied to the next, and nothing in the data leads back to you.

Web logs

Like every web service, our servers record the standard request metadata: IP address, user-agent string, the URL requested, and a timestamp. Vercel, which serves this website, keeps them for 1 day; Supabase, which runs the account database and sign-in, keeps them for 7 days. They are used for security and abuse detection, then discarded.

Trial & referral abuse prevention

The free trial and the referral reward are each once per person, and the person is your email address. When a trial is granted or a referral code is claimed, we store a one-way hash of the address, made with a secret of our own — never the address itself, and not reversible back to it. Nothing about your browser or device goes into it.

The record deliberately survives account deletion, because otherwise deleting and re-registering would reset the trial or unlock a second claim, and it is used for nothing else.

We only use the data above for these purposes:

• Run your account — sign you in, hold your single active desktop seat, and authenticate API calls from the desktop app.
• Bill you, if you're on a paid plan.
• Fix what you report, and weigh what you ask for — an error report, bug report or feature request you send is read, worked on, and kept with the issue it describes. We do not sell it and we do not use it to build profiles of individuals.
• Send you operational email — account confirmations, password resets, receipts, and notices about your subscription or your trial. These are part of running your account, so they are not marketing and there is no marketing list to leave.
• See how the website and the app are used — the anonymous counts in § 03 tell us which pages are read, which sign-up, checkout and referral paths people take and, if you said yes, how many people use the app and which kinds of tool they connect it to. They describe the product, not you.
• Keep the service safe — detect abuse and automated sign-ups, prevent fraud, comply with legal obligations.

We do not sell, rent, or trade your personal data, and we do not use it for behavioral advertising.

If you are in the EU, the UK, or another GDPR-aligned jurisdiction, we rely on the following legal bases:

• Contract — to provide the service you signed up for (account, billing, the app itself).
• Consent — for the desktop app's usage counts. They are sent only after you say yes, and you can withdraw that at any time in the app's settings, which stops them from then on.
• Legitimate interest — to diagnose the errors you report, consider the requests you send, detect abuse and automated sign-ups, keep the service secure, and count, anonymously, how the website is used. We've balanced this against your interests and only collect what's needed.
• Legal obligation — when we have to retain or disclose data to comply with applicable law.

We use a small number of third-party services to run Expecto Centum, and each is listed here so you know exactly who is involved. Most of them act only on our instructions, under a data-processing agreement. Three do not, or not entirely, and the distinction matters: Stripe decides for itself what it must keep to run card payments and satisfy its own legal obligations, the OAuth providers you sign in with are your relationship rather than ours, and Cloudflare runs the sign-up check for us but also uses its signals to improve its own bot detection. For those, their own privacy notices govern what they hold — not this one.

This list is current as of the effective date shown at the top of this page. If we add a new sub-processor we'll update this section.

Some of the services above are based in the United States. When personal data is transferred from the EEA, UK, or Switzerland to a country without an EU adequacy decision, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable) as the lawful transfer mechanism. Each service we engage as a processor offers Standard Contractual Clauses and a Data Processing Agreement covering that role, and we rely on those terms for its use. Stripe, the OAuth providers, and Cloudflare for what it uses to improve its bot detection, transfer under their own arrangements.

• Account data — for as long as your account is active. Closing your account deletes it immediately: your Stripe customer goes first, then the account record and everything keyed to it in one cascade. There is no waiting period and nothing kept in a recoverable state. What outlives it is listed below.
• Unfinished signups — an account whose email address is never confirmed is deleted after 30 days.
• Desktop sign-in requests — deleted when the app completes the sign-in, and otherwise within 25 minutes of being made. The record linking the app's session to your account is deleted when that session ends — signing out of the app, or the session being signed out from elsewhere — or with your account.
• Sign-in sessions — deleted when you sign out of that browser or app, or out of everywhere. A session left unused for 30 days is signed out, and deleted within a day after that.
• Backups — encrypted backups are taken daily and kept for 7 days, so a deleted record may persist in a backup for up to that window before it ages out.
• Web logs — 1 day at Vercel and 7 days at Supabase, then discarded.
• Website analytics and app usage counts — Aptabase keeps the counts in § 03 for up to 5 years. Nothing in them names you or can be tied back to you, which is also why there is nothing in them for us to find, show you or delete on request. The record the app keeps on your computer of what it has sent is deleted when you turn the counts off.
• Email we've sent you — we log the recipient, the subject and the time of each account email, so a notice can't go out twice. That log is deleted after 90 days.
• Notices about changes to these documents — when the terms or this policy change we record that we told you, and when. That one stays with your account rather than expiring, because it is the record of what you were told before a change took effect; closing your account deletes it with everything else.
• Error reports — the report log in our database is deleted after 90 days. The issue a report was filed as is part of our bug history and stays in our private repository until we delete it there.
• Bug reports and feature requests — the submission log in our database is deleted after 180 days, or with your account if that comes first. The issue each one was filed as stays in our private repository until we delete it there.
• Abuse-prevention hashes — the one-way hashes of your email address behind the once-per-person trial and referral rules are kept for up to 18 months, then deleted.
• Billing records — retained for 10 years as required by Czech and EU accounting law (this is the one we don't get a choice on).

You have the following rights over your personal data. We honor these for everyone, regardless of where you live — even where the local law doesn't require it.

• Access — ask for a copy of the personal data we hold about you.
• Rectification — correct anything that's wrong.
• Erasure ("right to be forgotten") — ask us to delete your data. We'll do this unless we have a legal obligation to keep something (e.g. tax records).
• Portability — receive your data in a machine-readable format.
• Restriction & objection — limit or object to how we process your data.
• Withdraw consent — for anything you previously consented to, such as the desktop app's usage counts, which you can turn off yourself in the app's settings.
• Lodge a complaint — with your local data protection authority. In the Czech Republic, that's the Úřad pro ochranu osobních údajů (ÚOOÚ).

Three of these don't need us at all. Access and portability: your account page has a download that hands you everything we hold about you as a single machine-readable file — the account itself, your plan, your device, your referral codes and rewards, any promo codes you redeemed, the error reports, bug reports and feature requests you sent, and the emails we sent you. Erasure: the same page closes the account, and closing it deletes it there and then.

For anything else — or if you would simply rather we did it — write to privacy@expectocentum.com. We aim to respond within 14 days; the GDPR allows up to 30. We may need to verify your identity before acting on a request.

We take security seriously, but no system is perfectly secure. Concretely:

• All traffic between your browser/desktop app and our servers is encrypted with TLS.
• Passwords are stored only as bcrypt hashes by our authentication provider — even we cannot recover your password if you forget it.
• You can protect a password sign-in with two-factor authentication from an authenticator app.
• Data at rest is encrypted with AES-256.
• Expecto Centum is run by one person, so production access is one person's, and every account that reaches it carries two-factor authentication.
• The database is closed by default rather than open by default. The tables holding email logs, abuse-prevention hashes and service configuration are readable by no signed-in account at all, and the rest is readable only by the account whose data it is.

If we ever detect a breach affecting your personal data, we will notify the relevant supervisory authority within 72 hours, as the GDPR requires, and tell you without undue delay whenever it is likely to put your rights at high risk.

This site sets one kind of cookie: the one that keeps you signed in. There is no preference cookie, no advertising cookie, and nothing that profiles you. The website analytics described in § 03 set no cookie either. Signed out, this site itself stores nothing in your browser. The security check on the sign-up and sign-in forms runs in a frame of Cloudflare's own, under Cloudflare's terms, and only for that check.

The desktop app keeps your session and your settings on your own machine. It sends the credentials needed to sign you in and to authenticate its requests to our account service; your settings stay on your computer. If you said yes to usage counts, it also keeps a small record there of which counts it has sent, deleted when you turn them off.

Expecto Centum is intended for professional use. We do not knowingly collect personal data from anyone under 16. If you believe a child has registered an account, please email us and we will remove it.

We'll update this policy as the product evolves. A material change — anything affecting what we collect, who we share it with, or your rights — is published here under a new version number and a new effective date, and we email every account holder at least 30 days before that date, so you have time to read it and decide whether you still want to use the service. A correction that changes nothing about what we do — a clearer sentence, a fixed typo — ships without the wait.

The previous version of this policy is always available on request.

For anything related to this policy, your data, or to exercise any of the rights in § 09:

privacy@expectocentum.com

Postal:

Alfonso Cejudo
Re: Privacy
Revoluční 2137/8b
110 00 Prague
Czech Republic