1. Who we are
This policy explains how CodeOnAir (“CodeOnAir”, “we”) handles personal data. It covers three groups of people:
- Customers — people who create an account or use the dashboard, API or CLI. For their data we are the controller (data fiduciary).
- Website visitors — people who visit codeonair.com or send us a form. We are the controller.
- End users — people who tap a link made with CodeOnAir or use an app that includes our SDK. Here we process data on behalf of our customer (the app maker), who is the controller. Questions about an app's use of data are best sent to that app's maker.
2. What we collect
Customers
- Account details: name, email address, a hash of your password (never the password itself), and the sign-in codes we email you.
- Workspace content: apps, links, link previews, CodePush releases, configuration, team members and API keys (stored hashed where possible).
- Billing: plan, invoices and payment status. Card and bank details go straight to our payment partners; we don't store them.
- Usage: which features you use, and technical logs such as IP address and browser, to keep the Service secure and working.
- Messages you send us, such as support emails.
Website visitors
- What you type into our forms — name, email, phone, company, app link and message (Request access), or just your email (newsletter).
- Privacy-friendly page analytics from Vercel Web Analytics, which doesn't use cookies. If we turn on Google Analytics, it may set cookies to count visits.
End users (link taps and apps)
- When a link is tapped: the time, the link, device type and model, operating system and version, language, time zone, the app the link was opened in (for example Instagram), and the country. The IP address is used to work out the country and to match an install to the tap, and is stored only as a one-way hash.
- When an app with our SDK opens for the first time: similar device signals, so the app can receive the link that was tapped before install.
- For CodePush: a random installation ID, the app and update version, and whether an update installed or rolled back.
We don't collect names, contacts, precise location or advertising IDs of end users, and we don't track them across other companies' apps or sites.
3. How we use it
- To run the Service: redirect links, deliver deferred deep links and updates, and show analytics to the app maker.
- To manage accounts, sign you in, bill you, and send emails about your account (such as sign-in codes, receipts and important changes).
- To answer your messages and requests for access.
- To keep the Service secure: stop abuse, phishing and fraud, and fix problems.
- To improve the Service, using aggregated data where we can.
- To send our newsletter, only if you subscribed. Every email has a way to unsubscribe.
4. Why we're allowed to
We process data because we need it to provide the Service you signed up for (contract), because we have a legitimate interest in keeping it secure and improving it, because you gave consent (for example the newsletter, which you can withdraw at any time), or because the law requires it (for example keeping invoices). For end-user data we rely on the app maker's instructions and their own lawful basis.
6. Where it's stored
Our providers may store and process data outside India, including in the United States and the European Union. When data leaves India we use providers with strong security and contracts that protect it, as the law requires.
7. How long we keep it
- Account and workspace data: while your account is open. After you delete it, we delete it within 30 days, apart from backups that expire soon after.
- Link and install records: while the workspace exists, so the app maker can see their analytics. They're deleted with the workspace.
- Sign-in codes: a short time, until they're used or expire.
- Invoices and payment records: as long as tax law requires (in India, up to 8 years).
- Newsletter: until you unsubscribe or ask us to delete your email.
8. How we protect it
Data is encrypted in transit (HTTPS) and at rest by our providers. Passwords, API keys and IP addresses are stored as hashes. Access inside CodeOnAir is limited to people who need it. No system is perfectly secure; if a breach affects you, we'll tell you and the authorities as the law requires.
9. Your rights
Depending on where you live (including under India's Digital Personal Data Protection Act, 2023 and the EU GDPR), you can ask to see the personal data we hold about you, correct it, delete it, get a copy, object to some uses, or withdraw consent. You can also nominate someone to act for you.
Email support@codeonair.com from your account email and we'll respond within 30 days. If you're an end user of an app, we'll pass your request to the app's maker or help them handle it. You may also complain to your data protection authority (in India, the Data Protection Board of India).
11. Children
CodeOnAir accounts are for people aged 18 and over. Apps built with CodeOnAir may be used by anyone; app makers whose apps are for children are responsible for the parental consent the law requires.
12. Grievance officer
For any complaint about how we handle personal data, write to our Grievance Officer at support@codeonair.com with “Grievance” in the subject. We acknowledge complaints within 48 hours and aim to resolve them within 30 days.
13. Changes to this policy
We'll update this page when our practices change and change the date at the top. For important changes we'll email customers before they apply. See also our Terms and Conditions.