Privacy Policy

Effective: 2026-05-02 · Last updated: 2026-05-02

The short version. OffCoder collects the minimum personal information required to run the Service: your email, your name, and the content you choose to put into your projects. We send your AI prompts to the third-party AI provider you select for processing. OffCoder itself does not use your prompts or code to train AI models, and we select the not-for-training setting on our master keys where the provider exposes one. If you Bring Your Own Key (BYOK), training and retention behaviour is governed by your own account settings with that provider — see §4 for the AI-provider details. You can access, correct, export, or delete your data at any time. Disputes are governed by Indian law.

1. Who we are

"OffCoder", "we", "us", and "our" refer to the operator of the OffCoder mobile application (the "App") and the website at offcoder.com (the "Website"; together with the App, the "Service"). We operate from India. OffCoder is presently operated as a sole proprietorship pending incorporation; once OffCoder is incorporated as a registered legal entity, this Policy will be updated to reflect the entity name, registered office address, and any applicable tax registrations.

For the purposes of the Digital Personal Data Protection Act 2023 ("DPDPA"), OffCoder is the Data Fiduciary in relation to the personal data described below. For users in the European Economic Area, the United Kingdom, and Switzerland (together, "EU/EEA users"), OffCoder is the data controller within the meaning of Regulation (EU) 2016/679 ("GDPR") and the UK GDPR.

2. Scope of this Policy

This Policy describes how OffCoder collects, uses, discloses, retains, and protects personal data when you use the Service. It applies to information collected through the App, the Website, our customer-support channels, and any other interaction you have with us.

This Policy does not govern: (a) the privacy practices of third-party websites we link to; (b) the privacy practices of the AI providers (e.g. Anthropic, OpenAI, Google, OpenRouter) you choose to route AI requests to — those providers act independently as their own data fiduciaries / controllers and you should review their policies; or (c) the privacy practices of Razorpay or any other payment processor we engage, in respect of payment information they collect directly from you.

3. Personal data we collect

We collect only what we need. Specifically:

3.1 Information you provide

3.2 Information we collect automatically

3.3 Information we deliberately do NOT collect

4. AI processing — what happens to your prompts

OffCoder is an AI coding tool. When you use an AI feature, the following happens:

  1. Your prompt (and, in some workflows, related code from your project) is sent from the App to our backend over a TLS-encrypted connection.
  2. Our backend forwards the prompt to the AI provider you have selected — either via OffCoder's master API key (Pro subscription) or your stored BYOK key (BYOK subscription).
  3. The AI provider returns a response. Our backend forwards it back to your device.
  4. Token counts are recorded for billing and abuse-detection purposes. The prompt and response themselves are NOT retained at the application level, save for (i) the short-lived operational-log transit window described in §3.2 (up to 72 hours), and (ii) the two narrow exceptions described immediately below.

The exceptions where prompt/output content is retained:

We do not use Your Content to train AI models. Where the AI provider exposes a content-not-for-training setting on their API, we have selected it on our master keys. Note that providers may still retain prompts and outputs for a short trust-and-safety review period (typically up to 30 days) under their published baseline terms; the specific retention posture per provider is set out in the AI provider table of our Sub-processors page. Litigation holds may extend retention beyond the standard window for one or more providers (for example, the court-ordered preservation directive in The New York Times Co. v. Microsoft Corp. and OpenAI currently affects OpenAI API logs); the current particulars are stated in that AI provider table and are updated as the position changes. We do not currently operate a Zero Data Retention ("ZDR") arrangement with any AI provider; if and when we do, this Policy and the Sub-processors page will be updated. For BYOK users, training and retention behaviour is governed by your account's settings with the AI provider you have chosen — review that provider's policy directly.

Cross-border transfer. The AI providers we currently use (Anthropic, OpenAI, Google, OpenRouter) operate servers in jurisdictions outside India and the EEA, including the United States. The transfer mechanisms we apply to AI-prompt relays and to other cross-border flows are described in §8 below.

5. Why we process your data (lawful basis)

Under DPDPA we process your personal data on the basis of your consent, given when you create an account and accept this Policy at sign-up, and — where applicable — on the basis of the legitimate-use grounds in §7 of the DPDPA, in particular §7(a) (the Data Principal voluntarily provides her personal data to the Data Fiduciary for a specified purpose and has not indicated that she does not consent to its use), which is the limb most directly applicable to delivering the Service you have signed up for. Under GDPR we rely on:

6. How we use your data

We use the personal data described in Section 3 to:

We do not sell your personal data, share it with data brokers, or use it for cross-context behavioral advertising.

We do not currently send marketing emails. The communications you receive from us are transactional in nature (sign-up confirmation, payment receipts, refund confirmations, security alerts, sub-processor change notices, renewal reminders, and similar service-administration emails). The reservation of a "consent" lawful basis under §5 above is anticipatory only — it covers the possibility that we offer an opt-in newsletter or product-update email at a later date, in which case opt-in will be explicit, will not be bundled with sign-up consent, and may be withdrawn from the email itself or from your account settings.

6.1 Automated decision-making and profiling

We employ automated processes in two narrow areas, neither of which produces a "decision based solely on automated processing which produces legal effects concerning [you] or similarly significantly affects [you]" within the meaning of Article 22(1) GDPR:

You have the right to obtain human intervention, to express your point of view, and to contest any automated outcome that affects you, by contacting privacy@offcoder.com. We aim to route the matter to a human reviewer (separate from the automated system) within 7 business days, and in any event within the response timelines stated in §10. Where the volume of requests or operational circumstances would otherwise prevent us from meeting the 7-business-day target, we will acknowledge receipt and provide a revised timeline within that period.

7. Who we share your data with

We share personal data only with the parties listed below, only to the extent necessary, and only under contractual or statutory protections.

7.1 Service providers (Data Processors / sub-processors)

The current list of sub-processors with whom we share personal data is maintained at offcoder.com/legal/subprocessors. We commit to providing at least 30 days' notice to registered users — by email and on that page — before adding a new sub-processor that materially changes the categories of personal data shared, the destination, or the purpose. We flow contractual data-protection terms (including, where applicable, Standard Contractual Clauses) down to each sub-processor.

The principal sub-processors as of the effective date above are:

7.2 Legal and regulatory

We may disclose personal data to law-enforcement, regulators, courts, or other government authorities if we are legally required to (subpoena, search warrant, court order, statutory request) or where we have a good-faith belief that disclosure is necessary to: (a) comply with applicable law, (b) enforce our Terms or this Policy, (c) protect the rights, property, or safety of OffCoder, our users, or the public, or (d) detect or prevent fraud or security incidents.

We will, where lawful, attempt to notify you of any such request that materially affects your account before producing data, so that you have an opportunity to challenge it.

7.3 Business transfers

If OffCoder is involved in a merger, acquisition, sale of assets, or insolvency proceeding, your personal data may be transferred to the successor entity. The successor will be bound by terms no less protective than this Policy. We will publish a notice on the Website at least 14 days before any such transfer takes effect.

8. International data transfers

Personal data we collect may be transferred outside India and the EEA in the course of providing the Service — typically to the AI providers' US-based servers, our cloud-hosting regions, and Razorpay's processors. The principal recipient jurisdictions are the United States (AI providers, Sentry), India (Razorpay, AWS Mumbai region, our managed PostgreSQL provider where so configured) and global edge points-of-presence operated by our CDN.

For data originating in the EEA, the United Kingdom, or Switzerland we rely on the following transfer mechanisms, in order of priority: (a) where the recipient is certified under the EU–US Data Privacy Framework (or its UK / Swiss extensions), on that adequacy decision; (b) for all other recipients in non-adequate jurisdictions, on the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, modules 2 (controller-to-processor) and 3 (processor-to-processor)) and, for UK-origin data, on the UK Information Commissioner's International Data Transfer Addendum to those Clauses. We have conducted a Transfer Impact Assessment for the principal recipients identifying the laws of the destination country that may permit access to personal data and the supplementary safeguards we apply (TLS 1.2+ in transit, encryption at rest, application-layer pseudonymization where feasible, contractual obligations to challenge unlawful access requests). The TIA is reviewed at least annually and on any material change.

For data originating in India, transfers proceed in accordance with §16 DPDPA and any restrictions notified by the Central Government from time to time. As of the date above, no destination has been blacklisted by notification under §16(2). We will update this Policy and notify users if a notified restriction subsequently affects an active sub-processor.

A copy of the SCC-based agreement on file with a particular sub-processor can be requested by EEA / UK data subjects at privacy@offcoder.com. To the extent any specific transfer cannot be supported by an adequacy decision or by SCCs (for example, the immediate relay of an AI prompt you submit to a selected AI provider), the transfer is processed in reliance on Article 49(1)(b) GDPR — transfer necessary for the performance of a contract between you and OffCoder, or for the implementation of pre-contractual measures taken at your request. We do not rely on Article 49(1)(a) "explicit consent" as an ordinary basis for cross-border transfer.

9. Retention

We retain personal data only as long as we have a legitimate purpose to do so:

9.1 How account deletion works

When you trigger account deletion (App: Settings → Danger zone → Delete account; Website: Account → Delete account; or by emailing privacy@offcoder.com), the request flows as follows:

You may request a downloadable copy of your data ("Download my data") at any time before initiating deletion; we recommend doing so first.

10. Your rights

Depending on where you live, you have one or more of the following rights with respect to your personal data:

Our response timelines depend on the regime under which you exercise the right:

We may need to verify your identity before acting, typically by sending a confirmation email to the address on file; we will not require disproportionate identification documents. Requests are handled free of charge. The only exceptions are requests that are manifestly unfounded or excessive within the meaning of Article 12(5) GDPR — in particular, where they are repetitive — in which case we may either (a) charge a reasonable fee taking into account the administrative costs of providing the information or taking the action requested, or (b) refuse to act on the request. The burden of demonstrating that a request is manifestly unfounded or excessive rests with us. You may appeal any refusal to legal@offcoder.com and, where applicable, complain to the supervisory authority identified above.

10A. United States — state privacy disclosures

This Section supplements the rights described in Section 10 for residents of California, Virginia, Colorado, Connecticut, and Texas. It is provided in good faith based on those states' privacy statutes; nothing in this Section is intended to grant rights to residents of other jurisdictions beyond those already described above.

10A.1 California — CCPA / CPRA

If you are a California resident, you have the rights to (i) know what personal information we collect, use, disclose and (where applicable) sell or share, (ii) request deletion of your personal information, (iii) request correction of inaccurate personal information, (iv) opt out of "sale" or "sharing" of personal information for cross-context behavioral advertising, and (v) limit the use of "sensitive personal information" to the extent we collect it. We do not "sell" or "share" personal information for cross-context behavioral advertising as those terms are defined in the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act ("CCPA/CPRA"). We do not knowingly collect or process personal information of California residents under 16 years of age. To exercise any CCPA right, use the methods in Section 10 or email privacy@offcoder.com with the subject "CCPA request". We will not discriminate against you for exercising your rights. You may designate an authorized agent to make a request on your behalf, accompanied by signed written permission and identity verification.

10A.2 Virginia, Colorado, Connecticut, Texas

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA) and Texas (TDPSA) have rights of access, correction, deletion, data portability, and opt-out from (a) targeted advertising, (b) sale of personal data, and (c) profiling in furtherance of decisions producing legal or similarly significant effects. As stated above we do not engage in (a), (b), or such (c). Sensitive data — to the extent we collect any — is processed only with your consent. To exercise any of these rights or appeal a denial, email privacy@offcoder.com with the subject "[State] privacy request" or "[State] privacy appeal". We respond within 45 days (extendable by 45 days for complex requests, with notice).

10A.3 Categories of personal information (CCPA-style table)

For the past 12 months we have collected the following CCPA-defined categories from US residents: identifiers (email, name, OAuth provider IDs, IP address); commercial information (purchase history, transaction amounts); internet/network activity (request logs, app version, device/OS version); inferences (usage telemetry tied to entitlements). We do not collect biometric, geolocation (precise), audio, video, sensory, or thermal information; we do not collect health, racial-or-ethnic, religious-or-philosophical, sexual-orientation, citizenship-or-immigration-status, or genetic information.

The business and commercial purposes for which each category above is processed — and the retention period applied — are set out in §6 (How we use your data) and §9 (Retention) of this Policy. The categories of recipients with whom each category may be shared are set out in §7 (Who we share your data with) and on our Sub-processors page. This cross-reference is provided for compliance with Cal. Code Regs. tit. 11, §7011(e).

11. Children

The Service is not directed to, and not available to, persons under 18 years of age, as a uniform product policy. This 18+ floor is consistent with our Terms of Service §1–§2 and our Acceptable Use Policy §5. By creating an account, signing in, or otherwise using the Service, you represent and warrant that you are at least 18 years old (or the age of majority in your jurisdiction, whichever is greater).

For completeness — because some readers will look here for jurisdiction-specific child-protection law — we note that the statutory definitions of "child" or "minor" for data-protection purposes are: India (DPDPA) below 18 years; United States (COPPA) below 13 years; EEA / UK (Article 8 GDPR / UK GDPR) below 16 years (or, where an EEA Member State has set the age between 13 and 16, the Member-State age). OffCoder's 18+ floor is more restrictive than each of these and applies regardless of jurisdiction.

Sign-up requires you to confirm that you are at least 18. We do not currently operate a verifiable-parental-consent flow capable of lawfully on-boarding a person under 18, so a person under 18 cannot lawfully use the Service even with informal parental supervision. If we become aware that an account holder is under 18, we will immediately suspend the account, attempt to contact the registrant (or, where contact information is reasonably available, a parent or guardian) to verify, and if the account-holder's age cannot be lawfully validated within 14 days, delete the account and associated personal data. Deletion under this paragraph is free of charge. To report a suspected under-age account, email privacy@offcoder.com.

The 18+ floor is a hard threshold and OffCoder's current product posture is to keep it so. We are tracking the Rules to be notified by the Central Government under §9(5) DPDPA. We do not commit to opening the Service to persons under 18 once those Rules are notified — any such change would be a deliberate product decision that we would announce in advance, accompanied by a verifiable-parental-consent flow, an updated version of this Policy, and the 14-day material-change notice in §15.

12. Security

We implement reasonable security practices and procedures appropriate to the nature of the personal data we collect, including:

No system is perfectly secure. If we become aware of a personal data breach that materially affects you, we will notify you and the relevant authorities within the timelines required by law:

Notification to affected users will include, at minimum, the nature of the incident, the categories of personal data affected, the likely consequences, and the steps taken or planned in response. Notifications will be sent to the email on file; we may also publish a public advisory at offcoder.com/legal/security where the incident is of broader interest.

13. Cookies and tracking

The Website uses a small set of cookies and equivalent first-party storage (localStorage), all set by OffCoder itself rather than by third-party trackers. The categories we use are:

We do not set analytics, performance, advertising, or behavioral cookies, and we do not embed third-party tracking pixels, fingerprinting libraries, or cross-context behavioral-advertising tags. The full inventory, purposes, and retention periods are listed in our Cookies Policy. If at a future date we introduce any new non-essential cookie category (for example, opt-in product analytics), the consent surface will be expanded to give granular control over each category.

14. Grievance officer (DPDPA & IT Rules)

If you have a grievance regarding the processing of your personal data, contact our Grievance Officer at legal@offcoder.com. We acknowledge grievances within 24 hours of receipt and resolve them within 30 days, in accordance with the DPDPA and Rule 5(9) of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. The Grievance Officer's individual identity will be published on this page once OffCoder is formally registered as a legal entity.

15. Changes to this Policy

We may update this Policy from time to time. The "Last updated" date at the top reflects the most recent change. Material changes (those that meaningfully expand the categories of data we collect, the parties we share it with, or how we use it) will be notified to registered users by email at least 14 days before they take effect. Continuing to use the Service after the effective date constitutes your acceptance of the updated Policy. If you do not agree, delete your account.

16. Contact

Privacy questions, rights requests, or grievances:

This Policy is governed by Indian law and will be construed in accordance with the DPDPA, the Information Technology Act 2000 and Rules thereunder, and applicable provisions of the Indian Consumer Protection Act 2019. For EU/EEA users, additional rights conferred by GDPR apply concurrently.