# SpaceCode Privacy Policy

Last updated: 2026-10-12. Operator: Inference LLC (operating as Galactic). Contact: [privacy@g-a-l-a-c-t-i-c.com](mailto:privacy@g-a-l-a-c-t-i-c.com).

## What SpaceCode is

A terminal coding agent (CLI) with optional cloud sandboxes. It processes your source code to do its job.

## Data we process

- Account: organisation/user identifiers and email from sign-in via SaaS Platform; your SpaceCode API key (stored hashed by SaaS Platform).

- Your code and prompts: files, diffs, command output and prompts you send from the CLI or a sandbox. Sent to AI model providers to generate responses (see Subprocessors). We do not use your code to train models and do not instruct providers to.

- Sandbox contents: repositories cloned into a disposable cloud sandbox, and files you sync (settings, plugin config, MCP config). Sandboxes are ephemeral; contents are destroyed on disconnect after a git-safety commit/push to your repo.

- GitHub access: if you provide a GitHub token, it is passed to the sandbox as an environment variable to clone/push; stored credentials are encrypted at rest.

- Operational data: request logs, usage counts (daily limits), error reports and product analytics (PostHog). Website: page views via PostHog; contact/waitlist form entries.

## Why

To provide, secure, rate-limit and improve the service, and to respond to you.

## Subprocessors

Cloudflare (hosting, sandboxes, storage); Neureus / AI model providers routed through it (model inference); PostHog (analytics); Sentry-compatible monitoring where enabled; Stripe (payments, when enabled); GitHub (repository access you authorise).

## Retention and deletion

Sandboxes: destroyed on disconnect. Request/usage logs and analytics: 90 days. Account data: until you ask us to delete it. Email [privacy@g-a-l-a-c-t-i-c.com](mailto:privacy@g-a-l-a-c-t-i-c.com) to access, correct or delete your data.

## Security

Transport encryption, credentials encrypted at rest, per-organisation tenant isolation. No system is perfectly secure; early-access software.

## Your rights, children, changes

Rights depend on your location (GDPR/UK GDPR/CCPA): access, correction, deletion, objection. Not for children under 16. We will post changes here.