Privacy Policy

Effective from 12 October 2026.

1. Controller and contact

1.1 The controller of your personal data is Mandos s.r.o., Company ID (IČO) 04901258, registered office Žebětínská 883/24a, Kohoutovice, 623 00 Brno, Czech Republic, registered in the Commercial Register kept by the Regional Court in Brno, Section C, Insert 92514 (the "Provider", "we"). CockpitAI is the trade name used by Mandos s.r.o. for the Cockpit service.

1.2 Privacy requests: privacy@cockpitai.dev. We have not appointed a data protection officer; GDPR Article 37 does not require one for our processing (no large-scale monitoring, no special categories of data).

1.3 This policy explains what personal data we process when you use the Cockpit desktop application, the cockpit account and backend, Cockpit Web, the website cockpitai.dev and AWS workers (the "Service"), why, on what legal basis, for how long, who receives it, and what your rights are. Terms written with a capital letter have the meaning of the Terms of Service.

2. Important principles of the design

• We do not read your code, files or agent conversations. Agents run on your own hosts; the proxy that talks to AI providers runs on your host, not in our backend. Our backend relays encrypted traffic for Cockpit Web and synchronises your configuration.
• The vault is end-to-end encrypted. Secrets you put in the vault are encrypted on your device with a key derived from your passphrase (Argon2id, AES-256-GCM); we store only the encrypted blob and cannot read it or recover it.
• AI provider credentials are encrypted at rest in the token manager with a key that is kept outside the database and is not backed up with it; they are delivered to your hosts encrypted end to end (HPKE) and are never visible to the synchronisation service or the web server.
• We do not sell personal data and use no advertising. The apps use no tracking; the website cockpitai.dev uses Google Analytics only if you accept statistics cookies (Section 10). Business metrics are pseudonymised.
• Payments are handled by Paddle. We never see your card number.

3. What data we process, why and on what legal basis

The table lists each category, where it comes from, the purpose and the legal basis under GDPR Article 6(1). "Contract" = Art. 6(1)(b), "Legal obligation" = Art. 6(1)(c), "Legitimate interest" = Art. 6(1)(f) (our interest is stated), "Consent" = Art. 6(1)(a).

| # | Category | Data | Source | Purpose | Legal basis |

| :-- | :-------------------------------------------------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :----------------------------------------------------------------------- | :------------------------------------------------------------------------------------------------ | :--------------------------------------------------------------------------------------------------------- |

| A | Account | e-mail address, name, profile picture, Google subject identifier, account created date, language and theme, tier (Free/Pro), trial and grant state, plan selection (which hosts, AI accounts and projects stay active on Free) | you, via Google sign-in | creating and operating your account, sign-in, applying your tier | Contract |

| B | Devices and sessions | device name and platform, device identifier, last seen, refresh tokens (hashed), browser sessions (identifier, user agent, IP address, created/expires), automation devices | your desktop and browser | signing you in on several devices, letting you review and sign out devices, revoking lost devices | Contract; Legitimate interest (security) |

| C | Synchronised configuration | documents describing your hosts (names, addresses, SSH user, not passwords), projects (name, path, settings), agent definitions, global agent memory (Markdown text you write for your coding agents), layouts, templates, notification settings, notification history (500 entries / 30 days) | your desktop | synchronising your configuration between your devices and Cockpit Web | Contract |

| D | Vault | encrypted blob of your secrets, key-derivation parameters (salt); we cannot read the contents | your desktop | storing your secrets for your own devices | Contract |

| E | AI accounts in the token manager | provider, account label and e-mail at the provider, encrypted refresh tokens or API keys, generation and status, refresh log (time, result, no token), which hosts receive which accounts | you (sign-in at the provider or pasted key) | refreshing your provider credentials and delivering them to your hosts | Contract |

| F | Hosts registered with the token manager | host identifier, name, proxy version, public key, heartbeat (last seen), pinned identity | your desktop and the proxy on your host | delivering credentials to your hosts, showing host status | Contract |

| G | Cockpit Web relay and browser use | relay connection metadata (host, time, bytes), browser session metadata, pane state, push subscriptions (endpoint, keys), attachments you upload through the web (stored temporarily, delivered to your host), web audit (action, time, IP address, user agent) | your browser and host | providing Cockpit Web, push notifications, security and abuse prevention | Contract; Legitimate interest (security, 90-day audit) |

| H | Project sharing | memberships (owner, member, role, times), invitations (e-mail address typed by the owner, state, hashed token), presence, member actions in the owner's audit (name, e-mail, time, IP shortened to /24), prompt ledger (author, display name, owner, host, project, time, SHA-256 hash of the prompt text – never the text) | the owner (invitation e-mail), you (actions) | letting owners share projects, attributing activity and estimating consumption, security | Contract (owner and member); Legitimate interest (owner's oversight of their host; 30-day ledger) |

| I | Billing | subscription state, plan, period, transaction identifiers, invoice links, amounts, currency, country, VAT status, refund and dispute state, wallet ledger (top-ups, consumption, expiry); no card data | Paddle (merchant of record), you (company details in the payment portal) | applying your tier, showing your subscription and invoices, refunds, accounting | Contract; Legal obligation (accounting and tax records) |

| J | AWS workers | worker type, start/stop times, run time, storage and egress consumed, spending cap, budgets; the content of the worker's disk is your host data (we do not read it) | you, our cloud account | providing and charging workers | Contract |

| K | Transactional e-mail | e-mail address, type of message, time, delivery status (e-mail log); invitation e-mails: the address and link are deleted after sending (at most 3 days, 5 attempts) | the Service | sending sign-in, invitation, payment, subscription, deletion and export e-mails | Contract; Legal obligation (payment notices) |

| L | Support | your e-mails to us, their content and attachments, notes of our operators | you | answering your requests | Contract; Legitimate interest (keeping a record of the request) |

| M | Operator audit | actions of our operators on your account (action, time, operator, reason, changed fields without secrets, operator IP and user agent), tamper-evident hash chain | our back office | accountability of our staff, security, your right to know who accessed your account | Legitimate interest (security, accountability); Legal obligation (where an action implements a legal duty) |

| N | Operational logs | server logs with request metadata (time, path, status, IP address, user agent, user identifier), error reports from the desktop sent only when you choose Diagnostics | the Service | operating and securing the Service, debugging | Legitimate interest (security, reliability) |

| O | Business metrics | events such as signed up, trial started, plan changed with the user as an HMAC-SHA256 pseudonym under a secret salt, no e-mail or name | the Service | measuring sign-ups, conversion and churn | Legitimate interest (running the business) |

| P | Trial claim | hash of your Google subject identifier, kept after account deletion | Google sign-in | granting the 14-day trial once per Google account | Legitimate interest (preventing repeated trials) |

| Q | Website statistics (cockpitai.dev, only with consent) | pseudonymous cookie identifier, pages viewed, approximate location, browser and device type, referrer | your browser, through Google Analytics 4 | aggregate statistics of the website (Section 10.5) | Consent |

3.1 No marketing. We do not send newsletters or marketing e-mails and do not profile you for advertising. Should we introduce product news e-mails, they will be opt-in (Consent) with an unsubscribe link in every message. Notices about your own account – such as the end of your trial – are service messages.

3.2 Push notifications are sent only to browser subscriptions you create in Cockpit Web and can be removed there or in your browser at any time; the subscription is processed on the basis of Contract (it is a function you turn on).

3.3 Where legitimate interest is the basis, we have balanced our interest against your rights (short retention, pseudonymisation, no content). You may object (Section 9).

3.4 Data we do not process. Card data (Paddle), the plaintext of your vault, the content of your prompts and agent conversations in the backend (only a hash in shared projects; the one exception is instruction text you save in synchronised configuration yourself – agent definitions and global agent memory, category C), the files on your hosts, your location beyond the country derived from the IP address or billing.

4. Recipients and processors

We share personal data only with the following recipients, each bound by a data processing agreement where it acts as our processor:

We do not use analytics or advertising networks and do not share data with data brokers.

5. Transfers outside the European Economic Area

Our backend and backups are located in the EU (AWS region eu-central-1, Frankfurt, Germany). Transfers outside the EEA can occur to Google (sign-in and, with your consent, website statistics), Paddle (UK and possibly US) and, for AWS support services, to Amazon's affiliates. These are covered by the UK adequacy decision, the EU–US Data Privacy Framework for certified recipients, and the European Commission's Standard Contractual Clauses otherwise. Your prompts and agent traffic go to the AI providers you choose from your own host under your own agreement; where that provider is outside the EEA, that transfer is yours.

6. Retention

7. Your rights

Under the GDPR you have the right to:

• access your data (Art. 15) – the data export in the application contains your profile, devices, all synchronised documents, the vault as an encrypted blob, metadata of your AI accounts, web sessions and audit, agent definitions, billing and wallet records, sharing data, and the operator audit concerning you including notes;
• rectification (Art. 16) – your name and picture come from Google and change there; configuration you edit in the application;
• erasure (Art. 17) – delete your account in the application (Section 8);
• restriction (Art. 18) and objection to processing based on legitimate interest (Art. 21) – write to us; we will stop unless we demonstrate compelling legitimate grounds;
• data portability (Art. 20) – the export is in JSON inside a ZIP;
• withdraw consent where processing is based on consent (website statistics cookies: Cookie settings at the bottom of every page of cockpitai.dev), with effect for the future;
• lodge a complaint with a supervisory authority, in the Czech Republic the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, https://uoou.gov.cz), or with the authority of your country of residence.

How to exercise them: use Account → Export data and Account → Delete account in the application, or write to privacy@cockpitai.dev from the e-mail address of your account. We answer within one month (extendable by two months for complex requests, with notice). We may ask you to confirm your identity through a sign-in. Exercising your rights is free of charge unless requests are manifestly unfounded or excessive.

Automated decisions. We make no decisions with legal or similarly significant effect based solely on automated processing. Technical limits (rate limits, tier enforcement) are applied automatically but have no such effect and can be reviewed by a human on request.

8. Account deletion

8.1 You can delete your account in the application or by e-mail. The deletion is a process: (1) we prepare your data export and e-mail you a one-time link valid for 7 days; (2) a 30-day waiting period starts, during which the account is blocked and you can cancel the deletion by the link in the e-mail; (3) an active subscription is cancelled at the end of its period and an unspent wallet balance is refunded pro rata through the payment provider; (4) after the period, a daily job deletes your documents, vault, devices, sessions, push subscriptions, notifications, AI accounts and host registrations in the token manager, project memberships and invitations (as owner and member), the prompt ledger rows where you are owner or author, and your exports.

8.2 What remains after deletion. Your account row is pseudonymised (e-mail replaced by a placeholder, Google identifier replaced by a hash, name and picture emptied). Billing and wallet records are kept for 10 years with only identifiers, amounts and country. The operator audit is kept for 2 years pseudonymised. The web audit of your actions expires within its 90 days with your identifier replaced by a hash. Back-office notes about you are kept pseudonymised. The hash of your Google identifier remains in the trial register.

8.3 Shared projects. If you were an owner, all memberships and invitations of your projects end and members lose access; if you were a member, you leave the projects and your acceptance of invitations is unlinked from you.

8.4 Legal hold. If a payment dispute, chargeback, investigation or legal obligation requires it, we suspend step (4) for the affected data for as long as the reason lasts and inform you unless the law forbids it. The export is always provided.

8.5 Hosts. Deletion does not touch your hosts. Cockpit's helper components (proxy, hooks, environment file) stay there until you remove them; agent transcripts and files on your hosts are yours.

9. Security

• In transit: TLS for every connection between the desktop, browsers, hosts and our backend; the relay between your host and your browser is encrypted and authenticated per host.
• Vault: end-to-end encryption on your device (Argon2id key derivation from your passphrase, AES-256-GCM); the key is held in your operating system's keychain; we store only ciphertext.
• Token manager: credentials encrypted at rest with AES-256-GCM under a key encryption key kept in a file outside the database, not in environment variables, images, logs or database backups; each blob is bound to your user, account and key version; decrypted values exist only in memory during a refresh or delivery; delivery to your hosts uses end-to-end encryption (HPKE) so that neither the synchronisation service nor the web server can read them.
• Operators: access to the back office requires a passkey (WebAuthn) and a step-up for sensitive actions; the operator audit uses a hash chain that makes silent modification detectable; "four eyes" approval applies to refunds above a limit.
• Isolation: the token manager has its own database, separate from synchronisation; the back office cannot delete data in the user services directly; services run in containers with least privilege on an internal network.
• Updates: desktop updates are signed and verified before installation.
• Backups: encrypted at rest, access restricted to the operator.
• Incident response: we notify the supervisory authority within 72 hours and affected users without undue delay when a breach is likely to result in a high risk to them (GDPR Art. 33, 34).

Members of shared projects should be aware that the owner's agent acts with the owner's rights on the owner's host; what the owner's agent can read, a collaborator's prompt could ask for. Owners decide whom to invite and which role to grant.

10. Cookies and local storage (Cookie Policy)

10.1 Cockpit Web uses only strictly necessary cookies: the session cookie (HttpOnly, Secure, SameSite=Lax) that keeps you signed in, and a short-lived cookie during sign-in. They need no consent under the ePrivacy rules. There are no analytics, advertising or third-party cookies.

10.2 Local storage of the browser app keeps your preferences (language, theme, layout), the current invitation token during sign-in, and cached state for offline display. The desktop application stores your configuration in a local SQLite database, the session in the operating system's keychain, cached entitlement and attachments on your computer; all of this is under your control and is deleted with the application data.

10.3 Paddle's checkout, opened for payment, sets its own cookies under Paddle's policy.

10.4 The website cockpitai.dev. When you visit it, our servers process your IP address, the requested page, the time and your browser's user agent in the operational logs (row N) to deliver the pages and protect the service, on the basis of our legitimate interest; these logs are kept for 30 days. Fonts and all other files of the website are served by us. Without your consent the website sets no cookies.

10.5 Google Analytics 4 (statistics, only with consent). The first time you visit, a banner asks whether you allow statistics cookies; both choices are equally easy and nothing is pre-selected. Until you choose Accept, Google's script is not loaded at all and Google Consent Mode is set to "denied". If you accept, Google Analytics 4 (provided by Google Ireland Ltd. as our processor) measures visits to the website – which pages are viewed, how visitors arrive, an approximate location derived from the IP address (GA4 does not store the IP address), and the type of browser and device – using a pseudonymous identifier in cookies. We use it only for aggregate statistics, with Google signals and advertising features switched off, and keep the event data for 2 months. The legal basis is your consent (GDPR Art. 6(1)(a) and Section 89(3) of the Czech Electronic Communications Act). Google may transfer the data to the United States (Section 5). You can withdraw your consent at any time under Cookie settings at the bottom of every page; we then delete the analytics cookies in your browser. You can also use Google's opt-out add-on (https://tools.google.com/dlpage/gaoptout). Cockpit Web (/app/) and the desktop application never use analytics.

10.6 Cookies and storage of the website:

11. Children

The Service is not directed to children. You must be at least 18 years old to create an account. We do not knowingly process data of younger persons; if you believe a child has created an account, contact us and we will delete it.

12. Changes to this policy

We may update this policy when the Service or the law changes. We publish the new version at https://cockpitai.dev/privacy with its effective date and, for material changes (new purposes, new recipients, longer retention), notify you by e-mail and in the application at least 30 days in advance. Earlier versions are available on request.

13. Contact and supervisory authority

Controller: Mandos s.r.o., Žebětínská 883/24a, Kohoutovice, 623 00 Brno, Czech Republic, Company ID (IČO) 04901258, e-mail privacy@cockpitai.dev.

Supervisory authority: Úřad pro ochranu osobních údajů (Office for Personal Data Protection), Pplk. Sochora 27, 170 00 Praha 7, Czech Republic, https://uoou.gov.cz, posta@uoou.gov.cz.