Privacy Policy

Effective September 9, 2026

Condux is operated by Riley & Grey Inc., a Delaware corporation, doing business as Condux (“Condux”, “we”, “us”). This policy explains what information we collect when you visit condux.build or use the Condux service, why we collect it, who processes it on our behalf, and how long we keep it. We do not sell personal information and we do not use your code to train models.

Information we collect

Account information

You sign in to Condux with GitHub. We store your GitHub username, GitHub user ID, display name, and email address, and the workspaces you belong to. We do not store your GitHub password. Your sign-in session is held in a cookie that expires after seven days.

Connections you authorize

Condux works by connecting to tools you already use. Each connection is optional and you choose which to make. For each one we store an access token so Condux can act on your behalf, encrypted at rest with a key that is not stored in the database:

• GitHub: the repositories you install the Condux GitHub App on, and short-lived installation tokens minted from it.
• Linear: an OAuth token for your Linear workspace, used to read issues you delegate to Condux and post progress back.
• Slack: an OAuth token for your Slack workspace, used to read messages in conversations where Condux is invited and reply.
• AI providers: an API key or OAuth token for the model provider you choose (OpenAI, Anthropic, or OpenRouter). Condux sends prompts to that provider under your account. Your provider’s own privacy terms govern what it does with those requests.

Codebase secrets

You can store environment variables and credentials that your repository needs to build, test, or deploy (for example a database URL or a deploy token). These are encrypted at rest, injected only into the temporary environment for a run on that codebase, and never written to logs. We keep an audit record of when each secret was created, changed, or removed, but the record does not contain the secret value.

Your code and the work Condux does on it

When you delegate an issue, Condux clones the repository into a temporary environment, runs a coding agent, and opens a pull request. In the course of that we store:

• the issue title, description, comments, and any files attached to the issue, which are given to the agent as context;
• the full transcript of the agent’s work, including the commands it ran, the files it read and changed, and the model’s responses;
• the console output of setup, test, and deploy scripts;
• artifacts the agent uploads, such as screenshots and log files;
• the pull request number and branch, and the review comments and CI results Condux reacts to.

Transcripts and logs necessarily contain excerpts of your source code. They exist so you can see exactly what the agent did and so we can debug failed runs. The temporary environment itself is destroyed when the run ends; nothing persists in it.

Artifacts are publicly readable. Screenshots and files the agent uploads are stored in a public bucket at unguessable URLs so they can be embedded in pull requests and Linear. Anyone with the link can view them. Don’t route secrets through artifacts.

Billing

Payment is handled by Stripe. Stripe collects your card details directly; we never see or store the full card number. We store your Stripe customer and subscription identifiers, your plan, the billing period, and the number of run hours used so we can meter usage and show it to you.

Support conversations

We use Intercom for chat and email support. Intercom sets an anonymous visitor identifier in first-party browser storage. If you are signed in to Condux we share your user ID, name, and email address with Intercom so we can recognize you and keep your support history. Messages you send through the Messenger or by email to hello@condux.build are processed by Intercom.

Operational data

Our servers record request logs, errors, and performance metrics, which may include your IP address, user agent, and the run or workspace involved. We do not use third-party advertising or analytics trackers on the site or in the app.

How we use information

• To provide the service: run agents on your code, open pull requests, post updates to Linear and Slack, and show you what happened.
• To bill you for your plan and metered usage.
• To secure the service, detect abuse, and debug failures.
• To respond to support requests.
• To send service notices, such as a billing problem or a change to these terms. We do not send marketing email without your consent.

We do not use your code, issues, transcripts, or prompts to train models, and we do not permit our model providers to do so on our behalf. If your chosen provider offers a training opt-out, that setting is yours to control on your provider account.

Who processes your information

We use the following providers to run Condux. Each receives only what it needs for its role.

We do not share personal information with anyone else except when required by law, to enforce our terms, or in connection with a merger or acquisition, in which case this policy continues to apply to the transferred information.

Where information is stored

Condux is operated from the United States and our providers store data in the United States. If you use Condux from outside the United States, your information is transferred to and processed there.

How long we keep information

• Account and workspace records: until you ask us to delete your account.
• Connection tokens: until you disconnect the integration or delete your account. You can disconnect an AI provider in the app, uninstall the Condux GitHub App from GitHub, and revoke Linear or Slack access from those workspaces’ settings; each of these stops Condux from using the token.
• Codebase secrets: until you delete the secret or remove the codebase. Removing a codebase deletes its secrets and connections immediately.
• Runs, transcripts, logs, and artifacts: retained so you can review past runs and so we can support you. Removing a codebase does not delete its run history; you can ask us to delete it.
• Temporary environments: destroyed at the end of every run.
• Billing records: as long as required for tax and accounting purposes, typically seven years.
• Server logs and error reports: up to ninety days.

Your rights and choices

You can see your runs, transcripts, and logs in the app at any time. You can disconnect your AI provider, delete any secret, and remove any codebase yourself. To access, correct, export, or delete anything else, including your whole account, email hello@condux.build and we will respond within thirty days. Deleting your account revokes your connections and removes your personal information; we may keep billing records we are legally required to keep.

If you are in the European Economic Area, the United Kingdom, or another jurisdiction that grants specific data rights, you have those rights with respect to the personal information we hold about you, and you can exercise them through the same address. We process your information to perform our contract with you and for our legitimate interests in securing and improving the service.

Security

All traffic is encrypted in transit. Tokens and secrets are encrypted at rest with a key held outside the database. Agents run in isolated temporary environments with short-lived, repository-scoped credentials that expire when the run ends. No security measure is perfect; if you find a vulnerability, please email hello@condux.build.

Children

Condux is a business tool and is not directed to anyone under 18. We do not knowingly collect information from children.

Changes

We will post any changes to this policy here and update the effective date. If a change materially reduces your rights, we will email workspace administrators before it takes effect.

Contact

Riley & Grey Inc., doing business as Condux
1111B S Governors Ave STE 26691
Dover, DE 19904
hello@condux.build