# CoStrict Privacy Policy

**Last Updated: September 11th, 2025**

CoStrict respects your privacy and is committed to transparency about how we handle your data. Below is a simple breakdown of where key pieces of data go—and, importantly, where they don’t.

### **Where Your Data Goes (And Where It Doesn’t)**

- **Code & Files**: CoStrict accesses files on your local machine when needed for AI-assisted features. When you send commands to CoStrict, relevant files may be transmitted to your chosen AI model provider (e.g., OpenAI, Anthropic, OpenRouter) to generate responses. If you select CoStrict Cloud as the model provider (proxy mode), your code may transit CoStrict servers only to forward it to the upstream provider. We do not store your code; it is deleted immediately after forwarding. Otherwise, your code is sent directly to the provider. AI providers may store data per their privacy policies.
- **Commands**: Any commands executed through CoStrict happen on your local environment. However, when you use AI-powered features, the relevant code and context from your commands may be transmitted to your chosen AI model provider (e.g., OpenAI, Anthropic, OpenRouter) to generate responses. We do not have access to or store this data, but AI providers may process it per their privacy policies.
- **Prompts & AI Requests**: When you use AI-powered features, your prompts and relevant project context are sent to your chosen AI model provider (e.g., OpenAI, Anthropic, OpenRouter) to generate responses. We do not store or process this data. These AI providers have their own privacy policies and may store data per their terms of service. If you choose CoStrict Cloud as the provider (proxy mode), prompts may transit CoStrict servers only to forward them to the upstream model and are not stored.
- **API Keys & Credentials**: If you enter an API key (e.g., to connect an AI model), it is stored locally on your device and never sent to us or any third party, except the provider you have chosen.
- **Telemetry (Usage Data)**: We collect anonymous feature usage and error data to help us improve CoStrict. This telemetry is powered by PostHog and includes your VS Code machine ID, feature usage patterns, and exception reports. This telemetry does **not** collect personally identifiable information, your code, or AI prompts. You can opt out of this telemetry at any time through the settings.
- **Marketplace Requests**: When you browse or search the Marketplace for Model Configuration Profiles (MCPs) or Custom Modes, CoStrict makes a secure API call to CoStrict's backend servers to retrieve listing information. These requests send only the query parameters (e.g., extension version, search term) necessary to fulfill the request and do not include your code, prompts, or personally identifiable information.

### **How We Use Your Data (If Collected)**

- We use telemetry to understand feature usage and improve CoStrict.
- We do **not** sell or share your data.
- We do **not** train any models on your data.

### **Your Choices & Control**

- You can run models locally to prevent data being sent to third-parties.
- Telemetry collection is enabled by default to help us improve CoStrict, but you can opt out at any time through the settings.
- You can delete CoStrict to stop all data collection.

### **Security & Updates**

We take reasonable measures to secure your data, but no system is 100% secure. If our privacy policy changes, we will notify you within the extension.

### **Contact Us**

For any privacy-related questions, reach out to us at zgsm@sangfor.com.cn.com.

---

By using CoStrict, you agree to this Privacy Policy.
