Privacy Policy
What CoherentAI collects, why it holds it, and who else sees it.
Last updated 2 August 2026
1. Who this covers
CoherentAI is a mobile-first AI code editor. This policy explains what the service collects when you sign in and use it, why it holds that information, how long it keeps it, and who else it is shared with. It applies to the CoherentAI web app and the installable PWA built from it.
Accounts are issued by an administrator — there is no public sign-up. The organisation that issued your account is the controller of the data described below, and operates CoherentAI on your behalf.
2. What we collect
Account information
Your username, email address if you have one, display name, role (member or master admin), the tenant your account belongs to, whether the account is active, and the times it was created and last signed in to. Passwords are never stored as text: the service keeps only a salted scrypt hash, which cannot be reversed into your password.
Content you create
Conversation threads and their messages, notebooks, saved memory, durable tasks and the events they emit, artifacts produced by a task, comments on those artifacts, and approval decisions you make. These are stored against your account and scoped to your tenant.
Workspace files
The files you open or create in the editor are held in your browser's own storage (IndexedDB) on the device you are using. They are sent to the server only when you take an action that needs them — asking the assistant a question that includes file context, or running a durable task against a project.
Settings and provider credentials
Your preferences and any model-provider API keys you enter. Keys you supply are cached in your browser so the app works offline, and synced to the server encrypted with AES-256-GCM, bound to your user and tenant so another account's key cannot decrypt them. Server-side provider keys configured by an administrator are never sent to the browser — the app tells the client only whether one is present.
Devices and notifications
If you enable push notifications, the service stores a device record — platform, a display name you choose, a push token, and when the device was last seen — plus your per-project notification preferences. Push tokens are revocable per device rather than per account.
Administrative and technical records
An audit log of account-management and task actions (who did what, when, and to which account or task), and a session cookie named openroutera_session. Standard server and platform logs may record IP addresses, timestamps, and request paths.
3. What we do not do
- No analytics SDKs, advertising pixels, or third-party trackers.
- No selling, renting, or trading of personal data.
- No profiling or automated decisions with legal effects.
- We do not use your conversations, code, or files to train our own models. Whether a model provider does so is governed by your agreement with that provider — see section 5.
4. Why we hold it
- To run the service — authenticate you, render your threads and files, execute the tasks you start, and deliver the notifications you asked for.
- To keep it secure — detect abuse, investigate incidents, and maintain the audit trail administrators rely on.
- To meet obligations — respond to data-subject requests and any legal or regulatory duties of the operator.
Where data-protection law applies, the lawful bases are performance of a contract (running the service for you), legitimate interests (security and integrity), and legal obligation. Optional features such as push notifications rely on your consent, which you can withdraw by revoking the device.
5. Model providers and other recipients
CoherentAI is a client for AI models it does not host. When you send a message or run a task, the prompt — including any file context, selections, or terminal output you attach — is transmitted to the provider selected in Settings, under that provider's own terms and privacy policy. Choosing a provider is choosing who receives your content.
| Recipient | When it receives data | What it receives |
|---|---|---|
| Azure OpenAI / Azure AI Foundry | Default provider for chat and code | Prompts, attached file context, model responses |
| OpenAI, Anthropic, OpenRouter, AWS Bedrock | When selected as your provider | Prompts, attached file context, model responses |
| Google Programmable Search | When the assistant runs a web search | The search query |
| Google NotebookLM / Vertex AI | When you use notebook features | Notebook sources and questions |
| GitHub | When you import or sync a repository | Repository requests made with your or the server's token |
| Database and hosting provider | Continuously | Stored records described in section 2 |
Beyond these, data is disclosed only where the law requires it, or to protect the rights and safety of users and the operator.
6. Cookies
One cookie, openroutera_session. It holds an HMAC-signed session token — not your password — and is set HttpOnly, SameSite=Lax, and Secure in production, so scripts cannot read it and it is not sent on cross-site requests. It lasts up to 30 days and is cleared when you sign out. There are no advertising or analytics cookies, so there is no cookie banner to dismiss.
7. How long we keep it
| Data | Retention |
|---|---|
| Account record | Until the account is deleted by an administrator |
| Threads, notebooks, memory | Until you delete them, or the account is deleted |
| Tasks, events, checkpoints | Kept in full while a task is live; a retention job collects events and expired checkpoints of finished tasks past the configured cutoff |
| Encrypted settings | Until overwritten, or the account is deleted |
| Device and push tokens | Until revoked, or the account is deleted |
| Audit log | Retained for security and accountability |
| Workspace files in your browser | Until you delete them or clear site data |
Deleting an account cascades to the records tied to it — settings, threads, notebooks, memory, devices, and notification preferences. Data already sent to a model provider is subject to that provider's retention policy, not this one.
8. How it is protected
Passwords are hashed with scrypt, session cookies are HMAC-signed and verified on every request, provider credentials are encrypted at rest, every record is scoped to a tenant, and database connections require verified TLS. The Data Protection Policy sets out the full set of technical and organisational measures.
9. Your rights
Depending on where you live, you may have the right to access a copy of your data, correct it, delete it, export it, restrict or object to certain processing, and withdraw consent. Threads, notebooks, and workspace files can be deleted from within the app at any time. For anything else, write to hi@coherenttoday.com — requests are answered within 30 days. If you believe your data has been mishandled, you may complain to your local data-protection authority.
10. Children
CoherentAI is not intended for children under 16, and accounts are not knowingly issued to them. If you believe a child's data has been collected, contact us and it will be deleted.
11. Changes and contact
Material changes to this policy will be reflected in the “last updated” date above, and significant ones will be announced in the app. Questions about this policy go to hi@coherenttoday.com.