Privacy Policy
Last updated 30 October 2026
Aptivus records what your team does with Claude Code so the team can search it and learn from it. That makes privacy the centre of the product. In short: secrets are redacted on your machine before anything is sent, your organization decides what is captured, members see only their own prompts unless they are owners or admins, every read of prompt text is logged, and we never sell your data or use it to train AI models.
1. Who we are
Aptivus (“Aptivus”, “we”, “us”) makes a web app and a connector that capture AI coding sessions for teams. This policy covers this website (aptivus.io), the Aptivus web app (for example dev.aptivus.io and app.aptivus.io), the ingest service the connector sends to, and the connector published on npm as @aptivus/connector.
Aptivus is in private development, and this policy will change as the product does (see Changes). Questions: hello@aptivus.io.
2. What we collect
Account information
Your name and email address, and a password, which our authentication provider stores only as a hash. If you choose Sign in with Google, we receive your Google name, email address and profile picture instead. We also hold any profile picture you upload, your organization’s name, address, logo and time zone, your role, and the invitations you send or receive.
What the connector sends
The connector sends data only from machines where someone has installed it and signed in to an organization. Redaction runs on that machine first. The connector is the only part of Aptivus that ever sees unredacted text. It sends:
- Per session: the working-directory path, the git remote (host, owner and repository, with any credentials removed) and branch, the Claude Code version, the session title Claude Code generates (redacted), the device name and an install identifier.
- Per prompt: the redacted text and its original length.
- Per response: the redacted visible text, its length, the model name, token usage and the names of the tools used.
- Per tool call: the redacted, size-capped input and the length of the result.
- Only if your organization turns them on: tool results, the model’s reasoning (“thinking”) and images pasted into a session, all redacted the same way.
- In metadata mode (
aptivus config capture_mode metadata): only lengths, counts, token usage and timing. No text at all.
The default redaction rules remove known API-key formats, high-entropy strings, JSON Web Tokens, private-key blocks, .env-style lines and database connection strings. We record which rule matched, never what it matched. No automatic redaction is perfect, so please don’t paste secrets into AI tools.
Using the website and app
Our hosting providers keep standard request logs (IP address, browser user agent, time and the page requested) for security and troubleshooting. We use no advertising trackers and no third-party analytics.
Cookies
Only the cookies the app needs to work: your sign-in session; a short-lived cookie that remembers where to return after Google sign-in; one that holds a pending invitation while you sign in; and one that remembers the last organization you opened. This website, aptivus.io, sets no cookies.
When you contact us
Your email address and whatever you choose to write.
3. How we use it
- To run the service: showing sessions, search results and usage to your organization according to its roles.
- To keep it secure: authentication, abuse prevention and audit logs.
- To support you and tell you about important changes.
- To improve Aptivus, mostly from aggregate measures such as counts and timings.
We don’t sell personal information, don’t show ads, and don’t use your prompts, responses or code to train AI models. Search indexes are built inside our own infrastructure and are used only to answer your organization’s searches.
4. Who in your organization can see what
- Owners and admins: everything captured in the organization, including every member’s prompt text.
- Members: the text of their own sessions, and usage figures for the team.
- Viewers: usage figures only, never prompt text.
Every read of prompt text is recorded: who read it, when and why. That log is kept as an audit trail. Organizations must tell their developers that their sessions are captured; we don’t support deployments where people haven’t been told.
Aptivus staff read customer prompt text only to provide support you ask for, to investigate a security problem, or when the law requires it. Those reads are logged too.
5. Service providers
These companies process data for us, only to provide their service to us:
| Provider | What for | Where |
|---|---|---|
| Supabase | Database, authentication, file storage and search | AWS, Mumbai (India) |
| Vercel | Hosting this website, the web app and the ingest service | Global edge network; servers in India and the United States |
| Sign in with Google, only if you use it | Global | |
| Cloudflare | DNS, and forwarding email sent to aptivus.io | Global |
Your data is stored mainly in India. Our providers may process it in other countries to deliver their services.
6. How long we keep it
| Data | Kept for |
|---|---|
| Prompt and response text, session titles | 90 days, then deleted |
| Usage, token counts, timing, session and project details | As long as the organization exists |
| The log of who read prompt text | 2 years |
| Account information | Until the account is deleted |
While Aptivus is in private development, the automatic 90-day deletion is not switched on yet. Until it is, text is kept until you ask us to delete it, and we delete it on request.
7. Your choices and rights
- Copy, correction or deletion: email hello@aptivus.io. We reply within 2 business days and finish within 30 days, backups included.
- Stop capture at any time:
aptivus uninstallremoves the connector’s hooks,aptivus logoutremoves the device’s token, and metadata mode sends no text. - Organization owners control capture settings and who belongs to the organization.
Depending on where you live, laws such as India’s Digital Personal Data Protection Act or the EU’s GDPR may give you further rights. Write to us to use them.
8. Security
Everything travels over HTTPS and is encrypted at rest by our providers. Organizations are kept apart by row-level security in the database. Device tokens are stored only as hashes. The ingest service connects as a restricted database role that can write captured events but cannot read their text back. Reads of prompt text are audited. No system is perfectly secure. If we learn of a breach affecting your data, we will tell you without undue delay.
9. Children
Aptivus is for professional use and isn’t meant for anyone under 18.
10. Changes
When this policy changes we update the date at the top. For significant changes, we tell account holders by email or in the app before the change takes effect.