Privacy Policy

Last updated August 15, 2026

This Privacy Notice for useCIX, Inc., a Delaware C Corporation doing business as cix ("we," "us," "our"), describes how and why we access, collect, store, use, and share ("process") your personal information when you use our services ("Services"), including when you:

• Visit our website at https://usecix.com/ or any related site or subdomain (cloud.usecix.com, api.usecix.com)
• Use cix, the cix CLI, or the cix MCP server
• Connect a source code repository to cix for indexing
• Store plans, designs, research notes, or other workflow content with your cix account
• Engage with us through marketing, events, or support channels

cix is a developer tool that indexes the source code of your software projects and makes that index available to your AI coding assistants (Claude Code, Codex CLI, Gemini CLI, and similar) so the assistants can answer questions about your code, navigate it, and propose changes with better accuracy. cix reads source code from your connected Git host, parses it on our cloud service, and stores a structured index of symbols, files, routes, database schemas, and import relationships. A small client program installed on your machine exposes that index to your AI coding assistant. cix also stores workflow content you choose to create with your account (plans, design graphs, research notes, investigation records) and lets you share indexed repositories with teammates and collaborators you invite.

Company details. useCIX, Inc. is a Delaware C Corporation incorporated on May 18, 2026, with Delaware file number 10628395. Our mailing address is 2803 Philadelphia Pike, Suite B #1631, Claymont, DE 19703, United States.

Questions or concerns? Contact us at contact@usecix.com. Reading this Privacy Notice will help you understand your privacy rights and choices.

Summary

• What we collect: account information you provide (name, email, password, payment data), data automatically generated as you use the Services (IP address, device characteristics, log data), and the source code from any repository you connect for indexing — including, for some tools, the current working-tree contents of files on your machine (which can include uncommitted changes) — plus any workflow content you create (plans, designs, research notes, investigation records).
• What we do with it: provide the indexing service, authenticate you, process payments, send service communications, debug and improve the Services, prevent fraud, and comply with law.
• Where it's stored: on cix-api servers hosted with third-party cloud providers in the United States.
• Who we share it with: a defined list of sub-processors (auth, payment, hosting, database, Git host, website analytics) required to operate the Services. We do not sell your data.
• How long we keep it: indexed source code is deleted within 30 days of you disconnecting the repository or cancelling your subscription. Account and billing records are retained as required by law (typically up to 7 years for tax records).
• Your rights: depending on your jurisdiction (EU/UK, Switzerland, Canada, US states, Mexico), you have rights to access, correct, delete, and port your data, and to object to processing.

Table of Contents

1. What information we collect
2. How we process your information
3. How we process source code
4. Legal bases we rely on (EU/UK/Canada)
5. When and with whom we share your information
6. Cookies and tracking
7. How we handle social logins
8. Data location and international transfers
9. How long we keep your information
10. How we keep your information safe
11. Information from minors
12. Your privacy rights
13. Rights of California and other US state residents
14. Rights of Mexican residents (LFPDPPP / ARCO)
15. Do-Not-Track signals
16. Updates to this notice
17. How to contact us
18. How to review, update, or delete your data

1. What information we collect

Information you provide to us. When you register or use the Services, you may provide:

• Account data: name, email address, password (stored as a hash), and authentication identifiers from third-party sign-in providers (currently GitHub via Clerk).
• Contact data: phone number, mailing address (if you provide them).
• Payment data: payment method details necessary to process subscription charges. Payment instrument numbers and security codes are handled and stored by our payment processor (Stripe); we do not store raw card numbers on our servers. Stripe's privacy policy is at https://stripe.com/privacy.
• Support data: any information you provide in support requests, including emails, screenshots, and reproduction steps.

Information collected automatically. When you use the Services, we automatically collect:

• Log data: IP address, browser type, operating system, language preferences, referring URLs, timestamps, pages and features accessed, search queries, error reports.
• Device data: device type, hardware model, identifiers, Internet service provider, system configuration.
• Usage data: which cix features and MCP tools you use, frequency of use, and aggregate usage patterns for billing and capacity planning.

Information from connected repositories. When you run cix-init or otherwise connect a repository to cix, our cloud service ("cix-api") accesses that repository through your authorized Git host (currently GitHub) and processes:

• Source code, including all files in the repository.
• Repository metadata: branches, commit history, file paths, contributor information.
• Code structure: symbols, function signatures, class declarations, import edges, database schemas, route handlers, and other parsed metadata.

This is described in more detail in Section 3.

Working-tree and client-pushed content. Some cix tools answer from the current state of a file on your machine rather than from the last pushed commit. When you use such a tool on a file with uncommitted or unpushed changes, the cix client uploads that file's current contents to cix-api so the tool can answer accurately. For repositories connected without a Git host, the cix client pushes repository content to cix-api directly from your machine. Content received either way is treated as source code under this Privacy Notice.

Workflow content. If you use the cix workflow tools (plans, designs, research logs, investigation records), we store the content you create — plan steps, notes, decisions, design nodes, research findings, and the links between them — with your account so it is available across your sessions and machines.

Sensitive information. We do not intentionally collect or process sensitive personal information (racial or ethnic origin, religious beliefs, biometric data, etc.). However, please be aware that source code can sometimes contain personal data (developer email addresses in commit history, hard-coded credentials, comments referring to identifiable individuals). We process source code as a whole and do not extract sensitive personal data from it for separate use, but we cannot guarantee that no sensitive information is present in any code you choose to index.

2. How we process your information

We process personal information for the following purposes:

• To provide the Services. Index your code, return symbol and structure information to your AI assistant, validate proposed edits, store and return your workflow content, meter usage against your plan limits, surface dashboards and account information.
• To authenticate you. Create accounts, log you in, manage sessions, identify authorized API tokens and CLI clients.
• To process payments. Charge your subscription, generate invoices, manage cancellations and refunds.
• To communicate with you. Send service notices (billing, security, outages), respond to support requests, send transactional emails. We may send marketing emails about new cix features, but only where permitted by law and where you can unsubscribe.
• To improve and debug the Services. Analyze usage patterns, diagnose errors, run internal research and development, measure feature performance.
• To prevent fraud and abuse. Detect bots, enforce subscription limits, investigate violations of our Terms and Conditions.
• To comply with law. Respond to DMCA notices, lawful requests from authorities, tax record requirements, accounting obligations.
• To protect vital interests. Address emergencies involving threats to a person's safety.

We process your information only when we have a valid legal basis to do so under applicable law (see Section 4).

3. How we process source code

The source code you connect to cix is the most substantial category of data we process, and deserves a dedicated section.

What we do with your code.

• Read. Our cix-api service authenticates to your Git host using OAuth tokens you authorize, and clones the repository. For repositories connected without a Git host, the cix client pushes the repository content directly from your machine, and some tools upload the current working-tree contents of individual files as described in Section 1.
• Parse. We run a structural parser over the code to identify symbols (functions, classes, variables), file relationships, routes, schemas, and import edges.
• Store. The parsed index, along with the file content needed to power read operations (get_lines, get_symbol, get_file_outline), is stored in our database.
• Return. When your AI assistant or your dashboard makes a request, we return the requested portion of the index or file content over an authenticated connection.
• Validate. When your local cix client submits a proposed edit, we parse the modified bytes and return a structural validation result.

What we do not do.

• We do not publicly publish, sell, license to third parties, or otherwise disclose your source code outside of returning it to you and your authorized users.
• We do not use your source code to train machine learning models, and we do not send your source code to AI model providers.
• We do not allow other cix customers to view your code unless you explicitly grant them access, by inviting them to your team or adding them as a collaborator on a specific repository. You control these grants and can revoke them at any time.

How long we retain your code. Indexed source code is retained for the duration of your subscription and for up to 30 days after you disconnect the repository, cancel your subscription, or delete your account. You may request immediate deletion at any time by emailing contact@usecix.com. After deletion, residual copies may persist in backups for up to 90 days before being purged.

Personal data inside source code. Source code can contain personal data (commit metadata, developer names and emails, comments, hard-coded credentials, embedded user data). We process this incidentally as part of processing the code itself. We do not extract such personal data for separate use. You are responsible for ensuring that the code you index does not violate the privacy rights of third parties; see our Terms and Conditions for related obligations.

4. Legal bases we rely on (EU/UK/Canada)

If you are located in the EU, UK, or Switzerland, the General Data Protection Regulation (GDPR) and UK GDPR require us to explain the legal bases on which we process your information. We rely on:

• Performance of a contract. Processing necessary to provide the Services you have signed up for, including indexing your code, authenticating you, and processing payments.
• Legitimate interests. Improving our Services, preventing fraud and abuse, internal analytics, and securing our systems — where these interests are not overridden by your rights.
• Consent. Where we ask for it explicitly (e.g., marketing emails). You can withdraw consent at any time.
• Legal obligations. Where required by law (tax records, lawful requests, DMCA).
• Vital interests. Where necessary to protect the safety of you or another person.

If you are located in Canada, we rely on your express or implied consent. You may withdraw consent at any time, subject to limited exceptions permitted by Canadian law (e.g., investigations, compliance with court orders).

5. When and with whom we share your information

We share information only with the sub-processors and parties listed below, and only as necessary to operate the Services. We do not sell your personal information.

Sub-processors. We rely on the following service providers to deliver cix. Each is contractually bound to process your data only on our instructions and to maintain appropriate security measures.

We may update this list from time to time. If we add or remove sub-processors, we will post the change here.

Other sharing situations.

• Business transfers. If we are involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy notice.
• Legal disclosures. We may disclose your information if required by law, court order, subpoena, or governmental request, or to enforce our legal rights, protect our property, or respond to claims that any content violates the rights of third parties.

6. Cookies and tracking

We use a small number of essential cookies and similar technologies to operate the Services:

• Authentication cookies — set by Clerk to keep you logged in. Without these, you cannot use the Services.
• Preference cookies — store your dashboard preferences (theme, repo selection).
• Security cookies — detect anomalous activity and protect against attacks.
• Analytics cookies — set by Google Analytics on our marketing website (usecix.com) to help us understand aggregate site usage.

We use Google Analytics on our marketing website to measure aggregate site traffic: pages visited, referral sources, approximate location derived from IP address, and device and browser type. Google acts as our service provider for this purpose; Google's privacy policy is at https://policies.google.com/privacy. You can opt out of Google Analytics by blocking cookies in your browser or by installing Google's opt-out browser add-on at https://tools.google.com/dlpage/gaoptout. We do not use third-party advertising trackers, retargeting pixels, or data brokers, and we do not use analytics data to build advertising profiles of individual users.

You can control cookies through your browser settings. Blocking essential cookies will prevent the Services from functioning.

7. How we handle social logins

Our Services let you register and log in using your GitHub account, authenticated through Clerk. When you choose this option, GitHub shares with us:

• Your GitHub username and user ID.
• Your primary email address associated with the GitHub account.
• Your name and profile picture (where you have made them public).
• A list of repositories you have authorized cix to access.

We use this information only to authenticate you and to identify which repositories you have permission to connect to cix. We do not post to your GitHub account, modify any settings, or access information beyond what you have explicitly authorized via the OAuth permissions scope.

Your relationship with GitHub is governed by GitHub's own Terms and Privacy Policy. We recommend reviewing them: https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement.

8. Data location and international transfers

Source code, account data, and metadata are stored on cix-api servers hosted with third-party cloud providers in the United States. We may change the underlying provider or region with reasonable notice.

If you access the Services from outside the United States, your data will be transferred to and processed in the United States. For users in the EU, UK, or Switzerland, this constitutes a cross-border transfer. We rely on appropriate safeguards for such transfers, including Standard Contractual Clauses (SCCs) where applicable, and the GDPR adequacy framework for any onward transfers to countries with adequacy decisions.

By using the Services, you expressly consent to the transfer and processing of your data in the United States and any other jurisdiction where our sub-processors operate.

9. How long we keep your information

We retain personal information only as long as necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law:

• Indexed source code: deleted within 30 days of repository disconnection, subscription cancellation, or account deletion. Backups purged within 90 days.
• Account data (name, email, authentication): retained while your account is active. Deleted within 30 days of account deletion, except where retention is required by law.
• Workflow content (plans, designs, research entries, investigation records): retained while your account is active so it stays available across your sessions and machines. Deleted upon account deletion, with residual backup copies purged within 90 days.
• Billing and tax records: retained for up to 7 years (or longer if required by Mexican tax law) after the last transaction.
• Support and communication records: retained for up to 24 months after resolution.
• Log data: retained for up to 90 days, then aggregated or deleted.

When we no longer have a legitimate business need to process your personal information, we will either delete it or anonymize it. Where deletion is not immediately possible (for example, because information is stored in backup archives), we will isolate the information and prevent further processing until deletion can occur.

10. How we keep your information safe

We implement technical and organizational security measures including:

• Encryption in transit (HTTPS) for all data transmitted between your devices, the cix client, and cix-api.
• Encryption at rest for stored data, provided by our managed database and storage providers.
• Authentication via OAuth and short-lived signed tokens; no plaintext credentials stored on our servers.
• Access controls limiting employee access to production data.
• Regular review of security practices and dependencies.

No system is 100% secure. While we take reasonable measures to protect your information, we cannot guarantee that unauthorized third parties will never defeat our security. You should keep your account credentials confidential and notify us immediately of any suspected unauthorized access.

11. Information from minors

The Services are intended only for users 18 years of age and older. We do not knowingly collect personal information from or market to children under 18. If we learn that we have inadvertently collected personal information from a person under 18, we will deactivate the account and delete the data. If you believe we may have collected information from a minor, please contact us at contact@usecix.com.

12. Your privacy rights

Depending on your jurisdiction, you have rights regarding your personal information, including:

• Right of access — to receive a copy of the personal information we hold about you.
• Right of correction — to correct inaccurate or incomplete information.
• Right of erasure — to request deletion of your personal information.
• Right to restrict processing — to limit how we process your information.
• Right of portability — to receive your information in a structured, machine-readable format.
• Right to object — to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent — where processing is based on consent.
• Right to lodge a complaint with your supervisory authority. In the EU, that is your member-state data protection authority; in the UK, the ICO; in Switzerland, the FDPIC; in Mexico, INAI.

To exercise these rights, email contact@usecix.com. We may need to verify your identity before acting on your request. We will respond within the time period required by applicable law (typically 30 days under GDPR, 45 days under most US state laws).

13. Rights of California and other US state residents

If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have rights under your state's data privacy law, including:

• Right to know whether we are processing your personal data.
• Right to access your personal data.
• Right to correct inaccuracies.
• Right to request deletion.
• Right to obtain a copy of your data in portable format.
• Right to opt out of processing for targeted advertising, sale of personal data, or significant profiling.
• Right to non-discrimination for exercising your rights.

We do not sell or share personal data for targeted advertising, and have not done so in the preceding 12 months.

To exercise these rights, email contact@usecix.com. You may designate an authorized agent to make a request on your behalf, provided they can prove valid authorization. We will verify your identity before acting on the request and will not discriminate against you for exercising your rights.

Appeals. If we decline to act on your request, you may appeal by emailing contact@usecix.com. If your appeal is denied, you may submit a complaint to your state attorney general.

14. Rights of Mexican residents (LFPDPPP / ARCO)

If you are located in Mexico, the Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, "LFPDPPP") grants you the following ARCO rights:

• Acceso (Access) — request information about the personal data we hold about you.
• Rectificación (Rectification) — correct inaccurate or incomplete data.
• Cancelación (Cancellation) — request that we delete your data when it is no longer necessary.
• Oposición (Objection) — object to specific processing of your data.

You may exercise these rights by emailing contact@usecix.com with a clear description of which right you are exercising, sufficient information to verify your identity, and your contact details. We will respond within 20 working days as required by Article 32 of the LFPDPPP.

If you believe your rights have been violated, you may file a complaint with the National Institute of Transparency, Access to Information and Personal Data Protection (INAI) at https://home.inai.org.mx.

15. Do-Not-Track signals

Most browsers and some mobile operating systems include a Do-Not-Track (DNT) feature. At present, no uniform technology standard for recognizing and implementing DNT signals has been finalized. We do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a recognized standard emerges, we will update this Privacy Notice.

16. Updates to this notice

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated "Last updated" date at the top. If we make material changes, we will notify you by posting a prominent notice on the Services or, where appropriate, by emailing you directly. Please review this Privacy Notice periodically.

17. How to contact us

For questions about this Privacy Notice, or to exercise any of your privacy rights:

Email: contact@usecix.com

Mail: useCIX, Inc. 2803 Philadelphia Pike Suite B #1631 Claymont, DE 19703 United States

Phone: (302) 213-8117

18. How to review, update, or delete your data

You may review and update most account information by logging into your account on cloud.usecix.com. To request deletion of your account and associated data, or to exercise any other right described in this Privacy Notice, email contact@usecix.com.

Upon a verified deletion request, we will deactivate your account, delete your indexed source code within 30 days, and delete other personal data within the timeframes set out in Section 9. We may retain certain information where required by law (e.g., tax records, fraud prevention).