Privacy Policy

1. Introduction

This Privacy Policy (the “Policy”) describes how Cassiel SAS and Be Remote SAS (together, “Thaloz”, “we”, “us”, or “our”) collect, use, and share personal information when you use the Thaloz Code desktop application, the Orpheus mobile apps for iOS and Android (package and bundle identifier com.thaloz.code), the hosted web application at https://code.thaloz.com, or the optional T3 Connect relay service operated by Thaloz at relay.thalozlabs.com (together, the “Services”), or visit the download and legal site at https://t3.thaloz.com (the “Site”).

By using the Site or the Services, you acknowledge the practices described in this Policy. If you do not agree, please do not use them. This Policy does not govern third-party coding agents, artificial-intelligence providers, identity providers, or environments that you choose to connect to Thaloz Code; those third parties process information under their own terms and privacy policies.

2. Personal information we collect

What we collect depends on how you use Thaloz Code and which optional features you enable. You can use local or direct connections without signing in to a Thaloz account.

Information from users of the Services

• Account information. If you create or sign in to a Thaloz account, we receive general identifiers and profile information from our authentication provider (Clerk) and the identity provider you select. This may include your name, email address, profile image, user ID, sign-in method, and authentication credentials or tokens.
• Environment and device information. If you enable T3 Connect, we process information needed to connect and secure your environments and devices, including identifiers, labels you assign, public keys, connection endpoints, credential hashes, connection status, app and operating-system versions, and notification preferences.
• Agent activity and notifications. If you enable notifications, we process push tokens and limited activity information needed to provide them, such as project and thread titles, model name, status, and activity headline. Notifications are delivered through the Apple Push Notification service and Firebase Cloud Messaging.
• Information you provide to us. We collect information you choose to provide when you request support, send feedback, or otherwise communicate with us.

Information from visitors to the Site and the Services

When you visit the Site or use online portions of the Services, we and our service providers may automatically log online identifiers and internet-activity information, including your IP address, device and operating-system type, browser or app type and version, pages viewed, access times, request timestamps, connection events, latency, error details, and diagnostic traces. We use this information to provide, secure, maintain, and troubleshoot the Services, not for targeted advertising.

Information we get from others

We may receive personal information from service providers that help us operate the Services, such as authentication and identity providers, app stores, and device-platform providers. We may combine it with information we collect through the Site and the Services.

Cookies and local storage

The Site is a static site and sets no application cookies of its own. Online portions of the Services, such as sign-in, may use cookies or similar technologies to operate essential features and maintain sessions. Thaloz Code also stores connection settings, credentials, preferences, drafts, and cached thread, file, branch, and server metadata on your device. Credentials and session tokens use platform-provided protected storage where supported. Information stored only on your device is not collected by Thaloz unless it is transmitted as part of a feature you use.

Device permissions

• Camera. Used when you choose to scan a pairing QR code. Camera frames are processed on your device.
• Photos and files. Items you select are accessed only to preview them or attach them to a request you initiate.
• Notifications. Used only if you enable agent-status notifications.
• Local network. Used to discover or connect to Thaloz Code environments accessible from your device over the network.

3. How we use personal information

Subject to this Policy and applicable law, we may use personal information:

• to establish and verify your identity and authenticate your account;
• to link and protect devices and environments and deliver optional notifications;
• to process and fulfill requests you make through the Services;
• to provide customer service and respond to support requests and feedback;
• to communicate with you about the Services and your relationship with us;
• to monitor reliability, prevent abuse, and investigate security incidents;
• to comply with applicable law and enforce the terms governing the Services; and
• to analyze and improve Thaloz Code using aggregated, de-identified, or other anonymous operational information.

Depending on the relationship and applicable law, these activities rely on performance of the Services, our legitimate interests in reliable and secure delivery, legal obligations, or your consent where required.

Training of AI models

We do not use your personal information, source code, prompts, or agent responses to train artificial-intelligence models.

Compliance and protection

We may also use personal information to comply with applicable laws, lawful requests, and legal process; protect the rights, privacy, safety, and property of Thaloz, our users, and others; audit our internal processes for legal, contractual, and policy compliance; enforce the terms that govern the Site and the Services; and prevent, investigate, and deter fraudulent, harmful, unauthorized, or illegal activity, including cyberattacks and identity theft.

4. How we share personal information

Providers you choose

At your direction, prompts, files, and related content are sent to coding agents and artificial-intelligence providers configured in your environment. You bring and configure your own coding-agent harness and provider, so the applicable third parties vary. Those providers process information under their own terms and privacy policies.

Service providers

We use third-party service providers to help provide the Services and operate our business. Depending on the features you use, these include:

• Clerk: account sign-in and session management (clerk.thaloz.com) for Thaloz T3 Connect. See its privacy notice.
• Cloudflare: networking, Thaloz T3 Connect relay infrastructure (relay.thalozlabs.com), and hosting of release files. See its privacy notice.
• Vercel: hosting and deploying the t3.thaloz.com and code.thaloz.com sites. See its privacy notice.
• Axiom: operational diagnostics that help us maintain and troubleshoot the Services. See its privacy notice.
• Apple: app distribution and the Apple Push Notification service (APNs) for Orpheus on iOS. See its privacy notice.
• Google: app distribution and Firebase Cloud Messaging (FCM) for Orpheus on Android. See its privacy notice.

We also use infrastructure providers to host the database that supports Thaloz T3 Connect. These providers process information for us under their own contractual and privacy obligations.

Affiliates and professional advisors

We may share personal information between Cassiel SAS and Be Remote SAS for purposes consistent with this Policy, and with lawyers, accountants, bankers, and other professional advisors in the course of the services they provide to us.

Corporate restructuring

We may share some or all personal information in connection with or during negotiation of a merger, financing, acquisition, reorganization, dissolution, sale of assets, or similar transaction. If another company acquires Thaloz or its assets, that company may possess the personal information collected by us and assume the rights and obligations described in this Policy.

Legal and safety disclosures

We may disclose personal information if we believe in good faith that disclosure is necessary to comply with law or legal process; protect or defend the rights, property, or safety of Thaloz, users, or others; investigate or prevent fraud, abuse, or unlawful activity; or enforce this Policy and the terms governing the Services. We may also share personal information at your direction, with your consent, or as described to you when the information is collected.

No sale of personal information

We do not sell your personal information or share it for cross-context behavioral or targeted advertising.

Third-party websites and services

The Site and the Services may link to third-party websites or services. When you follow a link or connect a third-party service, that third party may collect personal information from you. We do not control and are not responsible for their privacy practices or content.

5. Your choices

Account and connection choices

You may use local or direct connections without signing in to a Thaloz account. You can disconnect environments, sign out, disable optional notifications, and clear local caches from Settings. You can grant or revoke camera, photo, local-network, and notification permissions in your device settings.

Cookies and local data

You can use your browser settings to stop accepting or to delete cookies, although some online portions of the Services may not function correctly as a result. Information stored only on your device remains there until you clear it, remove the relevant connection, or uninstall the app.

Retention and deletion

We retain account, environment-link, device-registration, notification, and security information while your account or the relevant feature is active and for as long as reasonably necessary to provide the Services, protect them from abuse, comply with law, and resolve disputes. Operational diagnostic traces are retained for a limited period. Some records may remain longer in backups or where retention is required for security, fraud prevention, or legal compliance. Hosting, network, download, and email providers retain technical or support records according to their own schedules.

To request deletion of your Thaloz account and associated T3 Connect data, email hello@thaloz.com from the email address associated with your account. We may need to verify your identity. Deleting a Thaloz account does not delete information held by an environment or coding-agent provider you control; contact those providers or delete that information directly.

Your privacy rights

Subject to applicable law, you may request information about and access to your personal data, and ask for its rectification, updating, inclusion, deletion, or suppression, or object to certain processing. Send requests to hello@thaloz.com. We will honor applicable rights after verifying your request, and we may retain data where a legal exception applies. You may also contact the Unidad Reguladora y de Control de Datos Personales (URCDP), or another data-protection authority where you live.

6. Security

We use administrative, technical, and organizational safeguards designed to protect personal information from unauthorized access, use, or disclosure. These include encrypted network transport, scoped and proof-bound access tokens for supported connection flows, protected credential storage, and redaction of authorization headers from relay diagnostics. See our Security Policy.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for securing the environments, coding-agent accounts, credentials, and networks that you connect to Thaloz Code.

7. International users

Thaloz operates from Uruguay. Our service providers operate in other countries, including the United States, so your personal information may be transferred to and processed in countries other than the one where you live. Where required, we use lawful safeguards for international transfers of personal information.

8. Children

The Site and the Services are not intended for children under 13 years of age, and you must be at least 13 years old to use them. We do not knowingly collect, use, or disclose personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us so we can take appropriate action.

9. Do Not Track

We currently do not respond to browser “Do Not Track” signals. Thaloz Code does not use personal information for cross-context behavioral or targeted advertising.

10. Updates to this Policy

We may update this Policy from time to time. If we make material changes, we will post the revised Policy at this URL, update the effective date, and provide any additional notice required by law. Except as otherwise indicated, changes become effective when the revised Policy is posted.

11. Contact us

If you have questions about this Policy or wish to make a privacy or deletion request, contact us at:

Use of the Site and the Services is also governed by our Terms of Service. See Legal for all Thaloz Code policies.