Privacy policy

The Contextify CLI installs five Claude Code hook handlers in ~/.claude/settings.json. Each one ships a separate payload to /api/telemetry/ingest when its event fires:

• SessionStart — session id, the cwd, and a project identity derived from the git remote URL (or the folder realpath as a fallback). Used to scope captures and upsert the project row.
• UserPromptSubmit — the verbatim prompt text you submit, along with the timestamp, cwd, and session id. Fires before Claude processes the prompt.
• PostToolUse, scoped via matcher to Bash | Edit | MultiEdit | Write | WebFetch | Task — for each tool invocation, we ship the tool name and a single-line summary of the input (the command string for Bash, the file path for Edit/Write/MultiEdit, the URL for WebFetch, the subagent type + description for Task). Read-only inspections (Read, Grep, Glob, LS, TodoWrite, NotebookRead) are filtered out at the matcher level and never leave your machine.
• Stop — when Claude finishes responding, we ship a single dialog turn envelope: the user prompt that started it, the assistant's final text response, and the sequence of mutating actions executed in between. Deduplicated by the assistant message UUID, so a Stop that re-fires for the same turn ships nothing.
• SessionEnd — session id and the exit reason; clears local CLI state.

Every request also includes the session id, your client IP, and the timestamp the server received it. The API key in the Authorization header is HMAC-hashed before it's looked up — the bearer token itself is never stored.

• File contents — Edit / Write / MultiEdit / Read tool inputs include file paths only; the contents you typed or the bytes on disk never leave your machine.
• Environment variables, .env files, or other secrets on disk
• The output of Bash commands (the command string is captured; stdout is not)
• Read-only tool calls (filtered out before the hook fires)
• Anything outside the Claude Code hook scope

Captured payloads land in a queue table in Postgres in the EU (Hetzner Helsinki by default; we'll update this page if we move). A worker drains the queue, runs the extraction LLM you select (currently DeepSeek, Qwen, or Gemini) against dialog turns, and stores the durable facts it finds — typed rules, patterns, and decisions — as memory entries keyed to your project and embedded for similarity search. Prompt-only and tool-call telemetry rows are visible in the dashboard for transparency but are skipped by the extractor.

Postgres is encrypted at rest by the underlying provider. Every query is scoped to your tenant by the row-level isolation layer — your data is unreadable to other tenants even if a bug slipped past us in the application code.

We rely on these sub-processors to operate the service. We update this list if it changes and notify active customers in advance.

• Hetzner (Postgres hosting, EU)
• One of {DeepSeek, Qwen, Gemini} (embeddings + extraction, configurable per account)

When you delete a memory from the dashboard, it is removed from your account immediately — dashboard listings, exports, prompt generation, and similarity search all stop seeing it from that moment forward. We may retain a restricted backend record for operational purposes such as auditability, abuse prevention, recovery, and service integrity. We do not use deleted memories to personalize the product or surface them back to you.

If you want your account data permanently erased, email [email protected]. We process erasure requests in accordance with applicable privacy laws.

If you're in the EU/UK (and we extend the same rights to everyone):

• Access — request a copy of everything we hold about you
• Rectification — correct anything inaccurate
• Erasure — see "Deletion + retention" above
• Portability — export your memory + prompts as JSON
• Lodge a complaint with your local Data Protection Authority

API keys are HMAC-hashed before storage — even an attacker with full database access can't recover them. You can revoke any key from the dashboard at any time; revocation is effective immediately.

We use a single first-party session cookie set when you log in. No third-party advertising or analytics cookies. We do not sell, share, or rent your data.

When we change this policy materially we update the effective date at the top and notify active customers by email at least 14 days before the change takes effect.