Privacy Policy
What we collect, why we collect it, who we share it with, how long we keep it, and how to use your rights.
Who we are
Codequiry is operated by CQC Pvt. Ltd., a company organised under the laws of India ("Codequiry", "we", "us"). This policy covers the Codequiry website, dashboard, API, MCP servers, command line tools, integrations and support channels (the "Service"). Payments are collected for us by Code, LLC (Delaware, USA), acting as our payment agent. Words defined in our Terms of Service have the same meaning here.
Data controller
CQC Pvt. Ltd.
US office: Code, LLC, 600 California St, San Francisco, CA 94108, USA
Mailing address: c/o Code, LLC, 18911 Hardy Oak Blvd, Suite 255, San Antonio, TX 78258, USA
How to contact us →
When an instructor or organisation submits work that contains other people's personal data (for example, a student's name in a code comment), we process it on their behalf to produce their results, and they are the controller. We are the controller for account, billing, security and support data, and for the matching corpus and model improvement described in Submitted code.
What we collect
Information you give us
| Category | What it includes |
|---|---|
| Account | Name, email, password (stored only as a hash), institution or company, role, passkeys and connected sign-in providers (such as GitHub or Google), team membership |
| Content | Code, files and documents you submit, their names and metadata, courses, checks and results |
| Payment | Billing name and address, plan, invoices and transaction history. Card numbers are collected and held by Stripe; we see only limited details such as the card brand and last four digits |
| Communications | Contact form tickets, help desk conversations (including answers from its AI assistant), emails and post you send us |
Information collected automatically
| Category | What it includes |
|---|---|
| Usage | Pages and features used, checks started, API and MCP calls, errors |
| Device and network | IP address and approximate location, browser, operating system, and a device signature derived from browser characteristics |
| Cookies | Sign-in, security and preference cookies, and, subject to your choices, analytics and advertising measurement cookies (see Cookies) |
Information from others
Sign-in providers you connect tell us your name and email. Your organisation tells us about you when it invites you to its team. Stripe and fraud-prevention services tell us whether a payment or sign-up looks fraudulent.
How we use it
Running the Service
- Creating and securing accounts
- Running checks and producing results
- Team access and integrations
- Answering support requests
Billing
- Charging subscriptions and add-ons
- Invoices and tax records
- Handling payment disputes
Protecting the Service
- One no-cost account per device
- Detecting fraud, abuse and account farming
- Enforcing our Terms and blocking closed accounts
Improving and telling you about it
- Improving detection and features
- Service and account emails
- Product news and offers (you can opt out)
Legal bases (EEA, UK and Switzerland)
- Contract: running your account, checks, billing and support.
- Legitimate interests: security, fraud prevention, enforcing our Terms, keeping the matching corpus, improving the Service, and service emails. You may object (see Your rights).
- Consent: non-essential cookies and, where the law requires it, marketing emails. You can withdraw consent at any time.
- Legal obligation: tax, accounting and responding to lawful requests.
Automated decisions
Some protections are automatic: a sign-up may be refused because its device already holds a no-cost account or matches a closed account, and payments may be declined by fraud screening. Where the law gives you the right, you can ask for a person to review such a decision by writing to us (see Contact).
Emails
We send emails needed to run your account, such as receipts, security notices and changes to our terms. We also send product news and offers; you can unsubscribe from those at any time from the link in each email or your Privacy Settings.
Submitted code
Matching corpus. To detect plagiarism, code is compared against code seen before. Code submitted on any plan without an active Rapid add-on, including trials, free accounts and paid base plans, is added in anonymised form to our cross-account matching corpus, compared against future submissions from any customer, and kept there indefinitely, including after the account is closed. We also use it to build and improve our detection methods and models. This is a condition of those plans and is set out in Section 5.4 of the Terms.
Public examples. We may show short excerpts of submitted code to illustrate how the Service works. Each excerpt is first stripped of names, identifiers and other personal information, and we never use excerpts from student education records or from code submitted under Rapid.
Rapid keeps code private. Code submitted while your account holds an active Rapid add-on is processed in an environment reserved for your account. Both during and after your subscription, it is never added to the shared corpus, never used to check other customers, and never shown in public examples. This is not retroactive: code uploaded before Rapid was activated entered the shared corpus at upload.
Deleting code requires Rapid. While Rapid is active you can delete submissions, checks and courses on demand, including content uploaded before you activated Rapid, and we stop using deleted content for matching. On every other plan, uploaded code cannot be deleted by you, by our support staff, or by closing your account. For the same reason, self-service account deletion is available only while your account holds no uploaded code, or while Rapid is active: if your account holds uploaded code on another plan, the dashboard will ask you to activate Rapid before the account can be deleted, and our support staff cannot delete the account for you while that code remains. See Section 6.3 of the Terms. Your personal-data rights below are not affected.
Who we share it with
We share it only as described here.
Service providers
These companies process data for us under contracts that limit their use of it:
Sources we check your code against
To find matches on the open web and detect AI-written code, excerpts or fingerprints of submitted code are sent to search and code-source providers (such as Google, Bing, Baidu, GitHub and Stack Overflow), to page-fetching services that retrieve matched pages, and to AI model providers (such as DeepSeek) that power AI detection and match analysis. We send what the check needs. These providers may be located outside your country, including in the United States and China. For Rapid, code is processed in your account's isolated environment, but web and AI checks still need these providers.
Others
- Your organisation: the account holder and team members of the account you belong to can see that account's checks and results.
- Fraud prevention: when we close an account for fraud or abuse, we may report its device, payment and other signals to our payment processor's fraud network and other fraud-prevention services.
- Legal reasons: to comply with law, a court order or a lawful request, to enforce our Terms, to contest a chargeback, or to protect the rights, safety and property of Codequiry, our users or others.
- Business transfers: to a successor in a merger, acquisition or sale of assets, under this policy.
Security
We use administrative, technical and physical measures designed to protect your data, including encryption in transit and, where our hosting providers support it, at rest, hashed passwords, access controls, logging and encrypted backups. No system is perfectly secure, and we cannot guarantee that data will never be accessed without authorisation. If a breach affects your personal data, we will notify you and the authorities as the law requires. Keep your password and API keys private and tell us at once if you think they have been exposed.
Your rights
Depending on where you live (including under India's Digital Personal Data Protection Act and US state laws), you may have the right to:
Get a copy of your personal data
Fix inaccurate or incomplete data
Have your personal data erased, subject to the corpus exception below
Receive your data in a machine-readable format
Object to processing based on legitimate interests, and to marketing
Limit how we use your data
Where we rely on consent, at any time
To your data protection authority
For using any of these rights
Deletion and the matching corpus. Your right to erasure covers the personal data we hold about you, such as your account, profile, billing and contact records. It is not a general right to withdraw uploaded code from the anonymised matching corpus. Code contributed to the corpus on a non-Rapid plan is kept in de-identified form that is no longer linked to you, and is outside an erasure request. Where we can honour a request only in part, we tell you which part and why. If you need to delete uploaded code on demand, use the Rapid add-on.
Closing your account. Because closing an account deletes the code it holds, self-service account deletion is available only while your account holds no uploaded code, or while Rapid is active. While an account holds uploaded code on a plan without Rapid, it cannot be deleted, by you or by our support staff. Activate Rapid first, which makes that code and so the account deletable, or contact us: we will action the personal-data rights above (access, correction and erasure of the personal data in your profile, billing and contact records) without the de-identified corpus content needing to be deleted.
How to use your rights
Download your data and change your cookie and marketing choices yourself in your Privacy Settings. For any other request, use Privacy Settings or write to us at the address in Contact. We may need to verify your identity before acting, and we will not act on a request we cannot verify. An authorised agent may make a request for you with proof of your authorisation. We reply within one month (45 days for California requests), and tell you if we need longer as the law allows. If you are not satisfied, you may complain to your local data protection authority. If you are in India, you may raise a grievance with us in writing at the same address, and then with the Data Protection Board of India.
If your personal data reached us inside work submitted by your school or employer, please contact them first: they control that data, and we will help them respond.
How long we keep it
| Data | How long |
|---|---|
| Account information | While the account exists, plus 30 days |
| Uploaded code (Rapid add-on active) | Until you delete it, or the account is deleted |
| Uploaded code (all other plans, including trials, free accounts and paid base plans without Rapid) | Kept indefinitely in the anonymised matching corpus, including after account deletion, and not deletable on request. See Terms of Service, Section 6.3 |
| Check results and reports | While the account exists, plus 90 days |
| Transaction and tax records | 7 years, or longer where the law requires |
| Support conversations | 3 years from the last message |
| Security logs and device signatures | As long as needed to protect the Service and enforce the one-account-per-device limit |
| Enforcement records for accounts closed for fraud or abuse | Indefinitely, for fraud prevention and legal purposes |
| Backups | Overwritten on our backup schedule |
We may keep data longer where we must for legal reasons, such as a dispute, investigation or legal hold.
International transfers
We are based in India, our payment agent and main hosting are in the United States, and our providers operate in other countries, including China for some AI model providers. Your data may be processed in any of these places. Where data protection law restricts transfers, we rely on appropriate safeguards such as the EU Standard Contractual Clauses and the UK Addendum, or another lawful basis.
Children and students
The Service is not directed at children. Accounts must be created by people aged 18 or over.
Schools and teachers who submit work from children under 13 must first obtain verifiable parental consent, as the US Children's Online Privacy Protection Act requires. If we learn we collected personal information from a child under 13 without that consent, we will delete it as quickly as possible. To tell us about this, write to the address in Contact.
Student education records (FERPA)
- We act as a "school official" with a legitimate educational interest.
- Student personal information is used only to provide the Service to the institution or instructor that submitted it, which includes matching against the corpus.
- It is never used for advertising to students, and never used in public examples.
- Only the account holder and their team can see the results.
- Personal information in education records is deleted on the institution's request, subject to the corpus exception in Your rights and the retention periods above.
California and other US states
In the last 12 months we collected the categories described in What we collect: identifiers, commercial information, internet activity, approximate location, professional or education information contained in submitted work, and inferences used for fraud prevention. We use and disclose them for the purposes and to the recipients described above.
- We do not sell personal information.
- Advertising measurement: where advertising cookies are on, Google may receive device and browsing information, which some state laws call "sharing" for cross-context behavioural advertising. You can opt out by turning off advertising cookies in the cookie settings or your Privacy Settings.
- Sensitive information: we do not use or disclose sensitive personal information for any purpose that would give you a right to limit it.
- Your rights: to know, access, correct and delete (subject to the corpus exception above), to opt out of sharing, and not to be discriminated against for using them. Mark your request "California Privacy Request" and send it as described in Your rights.
Changes
We may update this policy. We change the date at the top when we do, and for material changes we also notify you by email or in the Service at least 30 days before they take effect.
Contact
We reply to privacy requests within one month (45 days for California requests).