Privacy policy
The short version. This website collects only what it needs to handle your trial request or newsletter signup and to stop abuse. We don't sell your data, we run no advertising or analytics trackers, we set no cookies of our own, and we self-host our fonts — so simply loading a page doesn't hand your IP to a third party. The CodeNavi product you install is self-hosted and processes your code entirely on your own machine.
1. Who we are
CodeNavi is a trade name of Cellpex LLC, a limited liability company organized in Ohio, United States ("we", "us"; Ohio trade name registration no. 202620900138). Cellpex LLC is the data controller for personal data collected through this website. We are established in the United States, but we offer this service to people in the EU and EEA, so we handle personal data in line with the EU General Data Protection Regulation (GDPR) as well as applicable US law. Our registered business address is 9435 Waterstone Blvd, Suite 140, Cincinnati, OH 45249, USA. For any privacy question or request below, email [email protected].
2. Scope — the website, not the product
This policy covers personal data processed by the codenavi.com website: the trial
request form and the product-updates newsletter. It does not describe the CodeNavi product
itself, because the product is self-hosted — you run it in your own environment and
it processes your source code locally, on hardware you control. CodeNavi sends us no telemetry about
your code or your usage. The product's own data handling is described in the PRIVACY.md
document shipped inside every CodeNavi package.
One product network call does reach our infrastructure and so is disclosed here: installs set up with the
one-line installer check codenavi.com once a day for a newer build. That check carries the install's trial
token and installed version number (and, like any web request, the requesting IP address) — nothing about
your code, queries, or usage. It exists so ./update.sh and the in-product update notice work.
You can disable it at any time by deleting .update.conf from the install directory;
manually-installed (air-gapped) deployments never make it in the first place.
3. What we collect, and why
| When | What | Why (purpose) | Legal basis |
|---|---|---|---|
| You request a trial | Name, email, company (optional), what you want to use it for (optional), and the referral / campaign parameters of the link you arrived through | To review the request, issue and deliver your signed trial licence, and understand which channels bring interest | Steps taken at your request prior to a contract; our legitimate interest in understanding referral sources |
| You buy a plan | Your account email and name, the plan and its price, the PayPal subscription and customer identifiers PayPal assigns, the dates and amounts of each payment, the licence version you accepted and when, and — if you cancel — the reason you choose to give | To take payment through PayPal, issue and renew your signed licence key, show your billing history on the portal, handle cancellations and refunds, and keep the records tax and accounting law require | Performance of our contract with you; our legal obligations for financial records |
| You subscribe to updates | Email address | To send you the product updates you asked for | Your consent (withdraw any time — see §7) |
| Any form submission | Your IP address (stored both raw and as a keyed one-way hash), your browser's user-agent string, and a coarse country + reverse-DNS lookup derived from the IP | Rate-limiting, spam / abuse prevention, and fraud checks on trial requests | Our legitimate interest in protecting the service from abuse |
The geo-country and reverse-DNS lookups are computed locally on our own server from an offline database — no third-party geolocation service ever sees your IP. We ask for no more than the fields above, and Company is optional.
4. Cookies and tracking
This site sets no cookies of its own, runs no analytics, and embeds no advertising or
social trackers. To remember which link you arrived through for the duration of a single visit, the
trial form uses a per-tab value in your browser's sessionStorage, which is discarded when
you close the tab. Our CDN and security layer, Cloudflare, may set a strictly-necessary cookie
(__cf_bm) to tell humans from bots; this is exempt from consent requirements. Because we
self-host our web fonts, loading a page makes no request to Google or any other
third-party font service.
5. Who we share it with
We do not sell your personal data, and we do not share it with advertisers. We use a small number of processors to run the site:
- Cloudflare — content delivery and DDoS / bot protection. Requests to the site pass through Cloudflare, so it processes request metadata including your IP address on our behalf.
- Our own mail server — trial and newsletter emails are sent from our own infrastructure. We do not use a third-party email-marketing platform.
- PayPal — payment processing for paid plans. When you subscribe, you pay PayPal directly: PayPal processes your payment details under its own privacy statement and tells us the subscription status, the identifiers it assigned, and the amount and date of each payment. We never see or store your card or bank details.
- GitHub, Hugging Face and LinkedIn — optional sign-in providers for the customer portal. If you choose one, that provider tells us your account email, a stable account identifier and (where offered) your name, so we can sign you in without a password; the provider's own privacy terms cover what it records about the sign-in. Signing in by email link involves no third party.
Because Cellpex LLC is established in the United States, personal data collected through this site is processed in the US, and our processors (such as Cloudflare) operate globally. For the personal data of people in the EU/EEA, we rely on appropriate safeguards for these transfers, such as the European Commission's Standard Contractual Clauses. We may also disclose data where required by law.
6. How long we keep it
We keep trial-request and subscriber records for as long as needed for the purpose they were collected — the life of your trial or subscription, plus a reasonable period afterward for abuse-prevention and legal record-keeping — and then delete or anonymise them. Payment and licence-issuance records for paid plans are kept for as long as tax and accounting law requires, even after your account is deleted. You can ask us to delete your data at any time (see §7), and we honour that promptly unless we're legally required to keep a record.
7. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you, and receive a copy;
- have inaccurate data corrected, and incomplete data completed;
- have your data erased ("right to be forgotten");
- restrict or object to our processing, including profiling for abuse prevention;
- receive your data in a portable format;
- withdraw consent to the newsletter at any time (every update email carries an unsubscribe option; you can also just email us);
- lodge a complaint with your local data-protection supervisory authority (in the EU/EEA, the authority for your country).
To exercise any of these, email [email protected]. We'll respond within the timeframe the GDPR requires (normally one month).
8. The customer portal
When you request a trial or sign in to the customer portal at portal.codenavi.com, we create your customer account and store your account email (and, once you sign in, your name), a one-way hash of your sign-in session token, a one-way hash of any email sign-in link we send you, and a one-way hash of the IP address used to sign in. This is used to authenticate you and to show you the trials and licences tied to your account. If you buy a plan, the portal also holds the subscription records described in §3 (PayPal's identifiers, payments, licence keys issued). We keep expired sessions for up to 30 days after they expire, and sign-in links for up to 1 day, before deleting them. To request deletion of your portal account, email [email protected].
9. Changes to this policy
We'll update this page when our practices change and move the "last updated" date above. Material changes affecting people already on our list will be announced by email.