Privacy policy
Last updated October 30, 2026.
Who looks after your data
CodeMago is a product of Alpha Developer Services LTDA, Brazilian company registry (CNPJ) 67.106.947/0001-52, based in Mogi das Cruzes, SP, Brasil. It is the controller of the data described here.
To talk about privacy, write to samuc2@gmail.com. That is also the channel for our data protection officer. We answer within 15 days.
What data we keep
From your account: email, name and the language you use. If you pay by Pix, we also keep your Brazilian tax number and mobile phone, because Pagar.me requires them to issue the charge.
From your work: your projects, the chat messages with the AI, the versions of the generated code and the usage record, with the tokens and credits consumed.
From payment: the plan you bought, the billing history and the state of the subscription. Your card number does not stay with us: Stripe processes and stores that.
From the affiliate program, if you take part: your referral code, the Pix key, the account holder name and the Brazilian tax number you give us to receive the payout, plus the commissions and payout requests. About the person who used your code we keep the link to you and the commission amount — never their payment details.
The Pix key and the holder tax number are used to pay the payout and to check that the referral is not the affiliate themselves: that check is what stops the program from becoming a way to take money out of the platform. If the check finds a match, the commission is held for review and you get an email about it.
What we use it for
To create and maintain your account, generate the apps you ask for, publish and serve those apps, charge for the plan, count credits and apply usage limits.
To tell you what matters: payment receipts, notice that a Pix period is about to expire, a price change or a change to these documents. Those emails come from nao-responda@codemago.dev.
To find and fix problems, and to protect the service against abuse and fraud. We do not sell or rent your data, and we do not send you other companies' advertising.
Legal basis
Account, app generation and billing: performance of the contract with you (LGPD art. 7, V; GDPR art. 6(1)(b)).
Tax records and keeping access logs: compliance with a legal obligation (LGPD art. 7, II; GDPR art. 6(1)(c)). Security and fraud prevention: legitimate interests (LGPD art. 7, IX; GDPR art. 6(1)(f)).
Waiting list and product news: your consent (LGPD art. 7, I; GDPR art. 6(1)(a)), which you can withdraw at any time.
What you send to the AI
Your requests and the generated code are sent to third-party AI providers: DeepSeek, Meta and Z.ai.
The default model, called “Balanced”, runs on the Contributor tier of Meta's Muse Spark. On that tier, Meta may use your requests and the responses to train its models. In other words: what you write into that model may end up in training we do not control and cannot undo.
So do not write personal data, sensitive data or confidential information into your requests — not yours, not your clients', not anyone else's. If you do not accept this use, choose another model tier before you write. On the Free plan the only model is Muse Spark Contributor: using another one needs paid credits.
Who we share it with
Only with those needed for the service to work: Hostinger (our server, in Brazil), Cloudflare (CDN, DNS and the generation engine), Stripe (card payments), Pagar.me (Pix), Google (sign-in through Firebase and, measurement through Google Analytics) and the AI providers named above.
Each one receives only what it needs for its part, and may not use the data for any other purpose.
We may also hand data to authorities when a law or a court order requires it.
The site loads its fonts from Google Fonts. In that request, Google receives the IP address of whoever visits the page.
International transfers
Apart from the main server, which is in Brazil, the suppliers above process data outside the country. Part of your data therefore leaves Brazil.
We make that transfer because it is necessary to perform the contract with you. We require contractual protection from suppliers that is compatible with the LGPD and the GDPR.
Data inside the apps you publish
Until you turn the database on, the app keeps everything in the browser of whoever uses it: none of that passes through us.
Once you turn it on under Data, the app starts writing to a database of ours — one per project, at Cloudflare's edge (outside Brazil, therefore). That is where what the app records lives: catalogue items, orders, sign-ups, whatever your app does.
For that data you are the controller and we are the processor: we store and serve it on your behalf, the way you configured it. We do not use your app's content for anything of ours and we do not hand it to anyone, barring a legal order.
Who reads what is your choice, in each collection's mode: catalogue (everyone reads, only you write), inbox (everyone submits, only you read), open (everyone reads and writes), private (each signed-in person sees only their own) and team (only the emails you list). A new collection starts open and the panel warns you — picking the right mode is what protects what your visitors send.
If your app asks visitors to sign in (Google or Firebase), we verify the token at the edge and store, next to each item, the identifier of whoever created it. That is what makes the private mode work.
When your credits run out, the database pauses and the app stays live. The data is kept for 30 days, with two email warnings, and is then deleted.
You are the controller of the data your app collects from other people. Informing those people and complying with the law towards them is your responsibility — including having your own privacy policy where the law requires it.
How long we keep it
Account, projects, AI chats and code versions: for as long as your account exists.
When you delete the account, we erase the personal data — email, name, tax number and phone are anonymised — and the apps go offline. For an affiliate, the Pix key, the holder name and the tax number are erased too and the code stops working; the commission and payout statement stays on record, without your data, as a financial record.
Tax records of the charges: for as long as the law requires, even after deletion. Access logs: for the period set by the Brazilian Internet Civil Framework.
Your rights
You can ask for access to your data, correction of anything wrong, deletion, portability, information about who we share it with, and withdrawal of consent where consent is the legal basis.
Much of this you can do yourself in the dashboard: change your name and language, download your projects and delete your account.
For the rest, write to samuc2@gmail.com from the same email as your account. We answer within 15 days. If you are not satisfied, you can complain to the ANPD, the Brazilian data protection authority.
If you are in Europe or the United Kingdom
The same rights apply under the GDPR: access, correction, erasure, portability, restriction of processing, objection and withdrawal of consent.
The legal bases are those in the section above, and the contact is the same: samuc2@gmail.com.
You can also complain to the data protection authority in your country.
Desktop app measurement
The macOS and Windows application sends usage statistics and we store them with your account. That is how we know how many installs use the app, on which version, and where it breaks.
What leaves your computer: the event name (for example, “the app opened”, “a turn ended with an error”), the app version, the system, the model level used, the duration and an error code. No content: no text from your conversation, project name, file path or e-mail leaves in the event — and our server discards any field outside that list.
Along with the event goes a random install identifier, created inside the app (it is not your e-mail, nor the machine serial number). It counts different installs, not people.
Measurement is on by default and you turn it off whenever you want in Machine, inside the app, on the “Send usage statistics” switch. Turned off, the app stops sending and erases whatever was still queued.
The same events go to our Google Analytics through our server: the write key never lives in the application, and Google receives the install identifier — not your e-mail.
Legal basis: our legitimate interest in understanding and improving the application (LGPD, art. 7, IX; GDPR, art. 6(1)(f)).
Site measurement
We use Google Analytics to count visits and understand which pages and which steps work. Measurement is on by default: the Google tag loads when the page opens.
What Google receives: pages visited, language, approximate country, device and browser type, and a random identifier kept in a cookie. We do not send your name, your email or the contents of your projects.
Legal basis: our legitimate interest in understanding and improving the service (GDPR, art. 6(1)(f); LGPD, art. 7, IX). Measurement does not feed advertising: ad consent always stays denied.
You can object at any time through the “Measurement choice” link in the footer, answering “don’t measure”. From then on no measurement data leaves your browser, and we delete the Analytics cookies from it.
Measurement and badge in the apps you publish
Every published app carries, in the bottom corner, a “Made with CodeMago” badge linking to our site, and the same measurement as our site.
It is the same Google Analytics, in our account, turned on when the app page opens. It tells us how many visits the apps built on the platform get and what works in them.
What Google receives is the same as on the site: page address, language, approximate country, device and browser type, and a random identifier kept in a cookie. Nothing typed inside the app is sent.
We are the ones answerable for this measurement, not you. It does not become a per-app report and does not show up in your panel.
If you ask the AI for your own Google Analytics, it follows the same rule and the visitor’s same choice. For the data measured with YOUR identifier, you are the one answerable — including informing your visitors.
Legal basis: our legitimate interest (GDPR, art. 6(1)(f); LGPD, art. 7, IX). Visitors can object by adding #cm-medicao to the app address and answering “don’t measure”.
Cookies and what stays in your browser
By default, we use only what the service needs to work: keeping you signed in, remembering your language and the light or dark theme, and storing the page's own preferences.
Google Analytics also sets its own cookies (_ga) to recognise repeat visits. They are deleted if you answer “don’t measure”.
To measure OUR advertising on Facebook and Instagram, the Meta Pixel sets its own cookies (_fbp and _fbc) and keeps in this browser, for 90 days, the click code that brought you here (fbclid). If you answer “don't measure”, those cookies are deleted and nothing is sent. When a purchase is confirmed, our server sends Meta the plan's amount and currency, the same browser identifier and your e-mail in scrambled form (a hash, which cannot be read back). Legal basis: our legitimate interest in measuring our own advertising (GDPR, art. 6(1)(f); LGPD, art. 7, IX), with the right to object at any time; in the European Union, the United Kingdom and Switzerland ad measurement only happens after your explicit “yes”. We do not sell profiles or data to anyone.
You can erase this data in your browser settings. If you do, you will have to sign in again and pick the theme again.
Your session is kept in the browser's own storage (localStorage), not in a cookie. Cloudflare, which protects the site, may set its own security cookies.
Security
Access to your account is protected by a password or by Google sign-in. Traffic to the site and to the apps uses an encrypted connection.
No system is completely secure. If there is an incident that could put you at risk, we notify you and the ANPD, as the law requires.
Changes to this policy
We may update this text when the service changes or when the law changes. The date of the last update is at the top of this page.
When a change is significant, we notify you by email before it takes effect.