Privacy Policy

For the purposes of the DPDP Act, Adyon Technologies is the Data Fiduciary in respect of personal data processed through the Service. Contact details are in Section 11 (Grievance Officer) and Section 13 (Contact).

We collect the following categories of personal data:

• Account identifiers from GitHub OAuth: your GitHub username, GitHub user ID, primary email address on your GitHub account, and your GitHub avatar URL.
• Session data: session cookies set in your browser when you sign in.
• Task metadata: the title, body, repository, lane choice (AI or developer), and status of each task you create or claim, and the pull-request URLs associated with that task.
• Server logs: IP address, user-agent string, and request paths, retained for security and abuse-prevention purposes.
• Payout details (developers only): bank account details or UPI ID submitted for payouts in INR, processed by Razorpay; or payout details collected at the time of manual international payout.

We do not knowingly collect personal data of children. The Service is not directed to anyone under 18.

We process personal data for the following purposes:

• Authentication. Verifying your identity through GitHub OAuth on each sign-in.
• Task routing. Matching tasks to the AI lane or the developer lane and connecting solvers with companies.
• Payouts. Paying solvers and managing platform fees.
• Analytics. Aggregate usage analytics to improve the Service. Where individual-level analytics are used, they are pseudonymized.
• Abuse prevention and security. Detecting and preventing abuse, fraud, scraping, and security incidents.
• Communication. Service notifications (e.g., task updates, payout confirmations, billing notices); product announcements where you opt in.

We process personal data on the basis of your consent (under DPDP s.6) and, where applicable, for the performance of our contract with you and our legitimate interests in operating and securing the Service.

We share personal data with the following Data Processors strictly to operate the Service:

We do not sell personal data. We do not share personal data with advertising networks.

For closed-source or NDA-tagged tasks, we do not share source code or task content with Anthropic or any other AI provider for training, fine-tuning, or evaluation. See the Terms of Service §5 (AI-generated code IP) and the NDA-v1 §7 (Training-data prohibition).

Several of our processors operate outside India (e.g., Supabase, Anthropic, Vercel, Render, PostHog operate in the United States and the European Union). By using the Service, you acknowledge that personal data will be transferred to and processed in these jurisdictions.

The DPDP Act permits cross-border transfer of personal data except to countries notified by the Central Government as restricted; we will not transfer personal data to any country that is so notified, and we will update our processor list accordingly.

Under the DPDP Act, you have the following rights:

• Right to access. Request a summary of personal data we hold about you and how it is processed.
• Right to correction and erasure. Request that we correct inaccurate data, or erase data that is no longer necessary for the purpose for which it was collected (subject to retention obligations in Section 8 and the Terms).
• Right to grievance redressal. Raise a grievance with our Grievance Officer (Section 11).
• Right to nominate. Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.
• Right to withdraw consent. Withdraw your consent at any time; withdrawal does not affect lawful processing that occurred before withdrawal. See Section 9 for the consent-withdrawal mechanism.

To exercise any of these rights, contact us at the address in Section 13.

In compliance with the DPDP Act, the Grievance Officer for Koduo is:

Sushobhith Sharma
Adyon Technologies, Delhi, India
Email: legal@koduo.ai

Grievances will be acknowledged within seven (7) working days and, where reasonably possible, resolved within thirty (30) days.

• Session cookies: thirty (30) days from issue, unless you sign out earlier.
• Task records: retained indefinitely as part of the transactional history of the Service (payments, payouts, audit). On request, identifiable fields can be removed and the record can be anonymized.
• Server logs: ninety (90) days.
• Analytics: aggregated; no individual-level retention beyond pseudonymized event data, which is retained for up to twelve (12) months.

Where retention is required by tax or other law, we retain for the longer of the periods above and the legally required period.

You can withdraw your consent to processing at any time by:

• Revoking the Koduo OAuth app from GitHub: GitHub → Settings → Applications → Authorized OAuth Apps → revoke; and
• Requesting account deletion: email the address in Section 13 from the email address on your account.

We will delete or anonymize personal data within thirty (30) days of an account-deletion request, subject to retention obligations described in Section 8.

We set a session cookie for authentication. We also use PostHog product analytics, which sets analytics cookies and records pseudonymized session replays with all form inputs masked. On your first visit you can decline analytics, and you can opt out at any time — declining stops analytics capture in your browser. A dedicated cookie consent banner for EU traffic will be added as a separate change before significant EU traffic arrives.

We use industry-standard measures to protect personal data, including TLS in transit, encryption at rest where supported by our processors, role-based access controls, and the principle of least privilege for internal access. No system is perfectly secure; we do not guarantee absolute security.

We may update this Privacy Policy from time to time. Material changes will be notified by email to the address on your account at least fifteen (15) days before the change takes effect. Non-material changes take effect on publication.

Adyon Technologies
Delhi, India
Email: legal@koduo.ai