Privacy policy for dcoder-terminal and dcodertools.com

Version 1.2 - September 15, 2026

Controller: DANIEL HENRIQUE MOURÃO FALCI DESENVOLVIMENTO DE SOFTWARE LTDA., CNPJ 55.073.754/0001-63, Belo Horizonte, Minas Gerais, Brazil (“we”, “us”). Contact for privacy matters (data protection officer / encarregado): contato@dcodertools.com

In short

• We collect the minimum needed to sell you a subscription, run your license and answer you when you write.
• Your code, prompts, terminal contents, file names and project names never reach us. The app sends us only what the license check needs.
• Our website has no analytics, no advertising trackers and sets no cookies of its own. The account area uses one strictly necessary session cookie.
• We send only service e-mails. There is no newsletter and no marketing, and we never sell, rent or share your data for advertising.
• Payment card details are handled by Paddle, our merchant of record, and never reach our systems.

1. What this policy covers

This policy applies to the website www.dcodertools.com, the account area on that website, the dcoder-terminal desktop application (including the companion programs distributed with it) and the e-mails we send about your subscription.

It does not cover the third-party tools and services you run or configure through the application - programming agents, language model providers, version control services, speech services and the like. Those are governed by their own privacy policies (see section 5).

2. What we process, why, and for how long

2.1 When you buy a subscription

Paddle sends us your name, e-mail address, the language you used at checkout, and the identifiers and status of your subscription (subscription id, customer id, status, number of seats, billing period). We use this to create your license key, send it to you, keep your license in step with your subscription, and answer your support requests.

Legal basis: performance of the contract with you. Retention: for as long as your subscription exists and, after cancellation, for as long as legal, tax and accounting obligations require, or until you ask us to delete it (see section 7). We keep your license key and machine registrations after cancellation so that, if you return, you recover the same key and machines; you can ask us to delete them at any time.

Billing address, tax identifiers and payment card details are collected and held by Paddle, not by us.

2.2 When the application checks your license

To enforce the number of seats you paid for, the application talks to our licensing server when it starts and about every ten minutes while it runs. It sends only:

• your license key, once, when you activate a machine;
• a device token, a random value that we store only as a hash;
• a fingerprint of the machine, which is a SHA-256 hash of the identifier your operating system assigns to the computer - never the identifier itself;
• the name of the machine, as your operating system reports it;
• the version of the application;
• the number of the seat it is holding;
• the time of each check.

We use this to lend seats, prevent one license from being shared beyond the seats purchased, and show you which of your machines are registered and which are running. Legal basis: performance of the contract and our legitimate interest in preventing abuse. Retention: seat records expire automatically within days after the application closes; machine registrations are kept while the license exists or until you ask us to remove them.

Nothing about your code, prompts, terminals, files, repositories, projects or task boards is included in these requests.

2.3 When the application checks for updates

Once at start and once a day, the application downloads a small public file (app.dcodertools.com/latest.json) that says which version is current. The request carries no identifier of you or your license. The provider that serves that file may keep standard access logs (network address, time, browser identification) for a limited period for security purposes.

2.4 When you use the account area

When you sign in to your account on our website we create a session cookie (dct_sess). It is strictly necessary to keep you signed in, is not readable by scripts, expires after eight hours without use, and is not used for tracking. While you are signed in, the site also keeps a marker (dct_signed) in your browser’s local storage, used only so the menu can show “My account”; it contains no credential or identifier and is removed when you sign out. With the session we record the network address, browser identification and time of the sign-in, so you can see where your account was used and so we can detect misuse; these records are deleted with the session. To protect sign-in against guessing, we keep counters of attempts per network address and per e-mail address for a few hours. Before a sign-in code is sent, the form checks that you are a person and not a robot (Cloudflare Turnstile). For that check Cloudflare receives your network address, your browser identification and a technical fingerprint of the connection (TLS), and most of the time you see nothing. Cloudflare processes these signals on our behalf to block robots and, as an independent controller, to improve its own bot detection, under the Turnstile privacy policy. We receive only the result of the check. Nicknames you give your machines in the account area are stored with your license.

Legal basis: performance of the contract and our legitimate interest in keeping your account secure.

2.5 When you visit the website

The website is a set of static pages. We use no advertising trackers and no fingerprinting, and we set no cookies of our own. Third-party scripts do load. Every page loads our hosting provider’s aggregate traffic measurement (Cloudflare Web Analytics), which reports page views without cookies and without identifying you. The pricing section and the payment page also load Paddle’s checkout library, so that the checkout can open without a further wait; that library is served from Paddle’s own domain, brings with it a script from Paddle’s retention product (Retain, formerly ProfitWell), and causes Paddle to set one cookie on its own domain (__cf_bm, the bot-protection cookie of Paddle’s content delivery network). That cookie is Paddle’s, not ours: our own pages set no cookie at all, on any page. Paddle is our merchant of record and an independent controller for the purchase, under its own privacy policy, as described in section 3. Pages that do not offer a purchase, such as the download page and these legal pages, load neither of Paddle’s scripts. If you dismiss the language suggestion, the site remembers that choice in your browser’s local storage only. The landing page fetches the number of remaining founding subscriptions from our server; that request carries no identifier. Our hosting provider may keep standard access logs (network address, time, browser identification) for a limited period for security purposes.

2.6 When we exchange e-mail

If you write to contato@dcodertools.com we keep the correspondence to answer you and as a record of the request.

We send only service e-mails: the welcome message with your license key, a notice when a subscription is cancelled, sign-in codes when you use e-mail sign-in, and notices that concern your subscription, the security of your account or changes to our terms. We do not send newsletters or marketing.

3. Who receives your data

We use a small number of service providers, each for a specific purpose:

We do not sell your data and we do not share it with advertising networks or data brokers. We disclose data to authorities only when the law requires it.

4. International transfers

Our own servers are in Brazil. Paddle, Cloudflare and Zoho may process data in other countries, including outside Brazil, the European Union and the United Kingdom, under the contractual safeguards those companies provide. If you are in the European Union or the United Kingdom, such transfers rely on standard contractual clauses or equivalent mechanisms offered by those providers.

5. Third-party tools and services you use through the application

The application runs the command-line agents you install and orchestrates them on your machine. When you use them, your prompts, code and other content go directly from your machine to the provider you configured (for example Anthropic, OpenAI, Google, xAI, GitHub or Groq), under your own account and that provider’s terms and privacy policy. Voice features send audio to the speech provider you chose, with your own API key. The same applies to version control services you connect with your own credentials.

We are not part of that traffic and do not receive it. API keys and tokens you store in the application are kept in your operating system’s credential store or on your disk and are never sent to us.

6. Security

Connections to our servers use TLS. Device tokens and session identifiers are stored only as hashes, so a copy of our database does not reveal working credentials. Session cookies are marked HttpOnly and Secure. Access to our systems follows the principle of least privilege, and no payment data is stored on them. No system is perfectly secure; if a breach affects your data we will inform you and the competent authority as the law requires.

7. Your rights

Under the Brazilian General Data Protection Law (LGPD) and, where it applies, the GDPR and UK GDPR, you may ask us to:

• confirm whether we process your data and give you access to it;
• correct data that is incomplete, inaccurate or out of date;
• anonymise, block or delete data that is unnecessary or processed unlawfully;
• provide your data in a portable format;
• tell you with whom we have shared it;
• stop processing based on consent or object to processing based on legitimate interest.

To exercise these rights, write to contato@dcodertools.com from the e-mail address on your subscription. We may ask you to confirm your identity before acting, and we answer within the period the applicable law sets, normally 15 days. Deleting your license and machine data ends your ability to use the application under that license. Records held by Paddle follow Paddle’s own obligations; we will point you to them where needed.

You may also lodge a complaint with the Brazilian National Data Protection Authority (ANPD) or, if you are in the European Union or the United Kingdom, with your local supervisory authority.

8. Children

The website and the application are intended for professionals and are not directed to anyone under 18. We do not knowingly collect data from children.

9. Automated decisions

We do not profile you or make automated decisions with legal or similarly significant effects. There are two automatic mechanisms: the seat limit, where the licensing server grants or refuses a seat according to the number of seats in your subscription, as described in the license agreement; and the human check on sign-in, which may refuse a request for a sign-in code. If it refuses you by mistake, try again or write to contato@dcodertools.com.

10. Changes to this policy

We may update this policy as the product or the law changes. The current version and its date are always published at www.dcodertools.com/privacy. If a change materially affects how we use your data, we will notify subscribers by e-mail before it takes effect.

11. Contact

DANIEL HENRIQUE MOURÃO FALCI DESENVOLVIMENTO DE SOFTWARE LTDA. CNPJ 55.073.754/0001-63 - Belo Horizonte, Minas Gerais, Brazil contato@dcodertools.com