Privacy Policy
This policy covers Uteke Cloud: the website at uteke.app, the API and the MCP endpoint. It is operated by CodeCora Dev (“we”, “us”). The Uteke mobile app has its own policy, linked from its page.
What we collect
- Account data: the email address and the account identifier from your CodeCora ID sign-in. We never see your password.
- API keys: stored only as salted, keyed hashes plus a short prefix so you can tell your keys apart. The full key is shown once and not kept.
- Your memory content: what you or your agents store (memories, documents, tags, rooms, metadata). Storing it and serving it back to you is the purpose of the service.
- Usage counters: per workspace and per day (writes, reads, searches, exports), to enforce plan limits.
- Audit events: an append-only record of changes to your account and data (for example a key created or a code redeemed). Audit events do not contain IP addresses or browser details.
- Trial and voucher records: which email and account identifier started a trial or redeemed a code, so each trial and campaign applies once.
- Portal session cookie: when you sign in to the portal we set one HttpOnly cookie that holds your account id and an expiry (8 hours). It is used only to keep you signed in.
- Site analytics: the public pages use Umami, which we host ourselves. It counts page views without cookies and without recording query strings, and it does not run on the portal.
Where your data lives
Service data is stored in a single-region deployment on a server we rent and operate. Backups are kept separately under our control. If the location of the deployment changes, we will update this policy first.
What we do not do
- We do not sell your data.
- We do not use your memory content to train machine-learning models or to advertise to you.
- We do not read your memory content except to operate, secure, or debug the service, or when you ask us to.
Service providers
- Server hosting provider: runs the machine the service is deployed on.
- CodeCora ID: our sign-in service, operated by us.
- Umami: self-hosted by us, public pages only.
- LLM provider: only for optional features on paid plans (consolidating or extracting memories), and only when you use them. These features are off during the alpha.
- Polar: payment processing, once paid plans launch. Payment details go to Polar; we never store card numbers.
Embeddings for search are computed on our own server, so no embedding provider sees your content.
Retention and deletion
- Memories stay until you delete them. Memories that have not been used for 180 days and are not pinned may be retired from search automatically; pin anything that must stay.
- Account data is kept while your account is active and for up to 12 months after it is closed, limited to what we need for legal, accounting and security purposes.
- Trial and voucher records are kept after an account is deleted, so a trial or campaign cannot be claimed twice.
- Export: you can export all your memories and documents at any time as NDJSON (see Import / Export; 4 exports a month on Free).
- Deletion: email [email protected] from your account address and we delete your account, its memory content, API keys and usage records within 30 days.
Your rights
You can ask us for access to, correction of, or deletion of your personal data at [email protected]. We answer within 30 days.
Security and incidents
Each workspace is isolated at the database level (row-level security), keys are stored only as hashes, and traffic is encrypted in transit with TLS. If a personal data breach affects you, we will notify you without undue delay and no later than 72 hours after we become aware of it, as required by Indonesian Law No. 27 of 2022 on Personal Data Protection (Article 46) and, where it applies, GDPR Article 33.
Changes
If this policy changes materially, we will update the date above and notify account holders by email before the change takes effect.
Contact
Privacy questions: [email protected].
Alpha version of this policy; the final version may be updated before general availability.