This policy describes how Adria (“Adria,” “we,” or “us”), based in Delaware, United States, handles personal information when you visit our website or use our accounts, dashboard, CLI, and SANDBOX sandbox product (together, the “Services”). For privacy questions or requests, email [email protected].
1. Information handled by the Services
The information involved depends on the features you use and the access you grant. It can include:
- Account and workspace information, such as your name, email address, login identity, organization membership, and account preferences.
- Connected repository information, including repository names, branches, commits, files, and other content available through the permissions you grant to an integration.
- Sandbox content, including code, uploaded files, installed packages, configuration, and credentials you provide to run your tools. Terminal output and activity may also be processed when terminal capture is enabled.
- Operational information, such as IP addresses, browser and device information, request logs, errors, sandbox status, and compute usage.
- Messages and attachments you send when asking for support or providing feedback. If you purchase a paid service, billing details and payment status may be handled by us and the payment provider used for that purchase.
Information comes from you, your use of the Services, and integrations you authorize. Only connect repositories and submit content that you are entitled to use. Avoid putting unnecessary personal information or secrets into terminal output, support messages, or shared previews.
2. Why we process information
We use account information to authenticate you and manage workspace access. We use repository content, configuration, and sandbox data to prepare and operate the remote computers you request, connect your tools, and preserve files when you pause work.
Operational logs and usage records help us diagnose failures, protect accounts, prevent abuse, manage capacity, and administer purchased services. Support communications help us answer requests. We also process information when required for accounting, legal obligations, or resolving disputes.
Where a legal basis is required, we rely on performing our agreement with you, legitimate interests in operating and securing the Services, legal obligations, or consent for activities that require it. Consent can be withdrawn without affecting processing that was lawful before withdrawal.
3. Connected agents and external services
SANDBOX provides sandboxes in which you can run coding agents such as Codex, Claude Code, or Pi using your own credentials. Those tools can send prompts, code, files, and other content to the model providers and services you configure. Their terms, retention settings, and privacy policies govern their processing. An Adria subscription does not override those settings or provide a model-provider zero-retention guarantee.
A forwarded port or app preview can expose whatever your running application serves to someone with access to it. Review the application’s authentication and content before sharing a preview. You can also revoke an integration’s authorization through the connected provider.
4. When information is shared
Operating the Services involves providers for hosting, storage, authentication, and related infrastructure. They process information needed to perform their services for Adria. Connected services receive information when you authorize them or run tools that communicate with them. Workspace members can access shared information as permitted by their roles.
Information may also be disclosed when legally required, to investigate security incidents or protect legal rights, or to professional advisers who need it for their work. A merger or transfer of the business may involve transferring relevant records, subject to applicable privacy obligations. Adria does not sell personal information or share it for cross-context behavioral advertising.
5. Cookies and browser storage
The dashboard uses cookies and related storage to support sign-in and account sessions. Your browser lets you remove or block cookies, although blocking essential cookies can prevent authenticated features from working. The marketing website currently has no advertising or optional analytics trackers. If we introduce technologies that require consent, we will provide the relevant information and choice before using them.
6. Storage, retention, and security
Sandbox files are kept to support your work, including pause and resume. Pausing a sandbox does not delete its files. Account records, logs, and backups can have different retention needs based on the purpose of the record, security requirements, and applicable legal obligations. We do not promise immediate deletion from every backup when you remove a sandbox or request account deletion.
We use access controls and credential protection to help safeguard the Services. You should also protect your login, limit integration permissions, rotate exposed credentials, and maintain independent backups of important work. No internet service can guarantee complete security.
7. International processing
Adria operates from the United States. Infrastructure and connected services may process information in other countries, whose laws may differ from those where you live. Where applicable law requires a transfer safeguard, the relevant transfer must have an appropriate legal basis, such as an adequacy decision or contractual safeguards. Contact us for information about the arrangements relevant to your account.
8. Your rights and choices
Depending on the law that applies to you, you may request access to, correction of, deletion of, or a portable copy of your personal information. You may also have rights to object to processing, restrict processing, withdraw consent, limit certain uses of sensitive information, opt out of sale, targeted advertising, or certain profiling, or appeal a declined request. These rights are subject to the conditions and exceptions in applicable law.
Send requests to [email protected]. We may need to verify your identity or an authorized agent’s authority before releasing information or changing an account. We will respond within the period required by applicable law and will not discriminate against you for exercising protected privacy rights. If an organization controls the workspace data concerned, we may direct the request to its administrator.
To appeal a declined request, email [email protected] with the subject “Privacy appeal” and explain which decision you would like us to review. We will explain the outcome and any further complaint options available under applicable law.
Residents of the European Economic Area or United Kingdom may also lodge a complaint with their local data protection authority. Residents of US states with applicable privacy laws may exercise the rights those laws provide. Our current practices do not involve selling personal information or sharing it for cross-context behavioral advertising.
9. Children
Adria’s Services are intended for adults aged 18 or older. If you believe a child has provided personal information to us, contact us so we can investigate and address it.
10. Updates and contact
We will update this page when the policy changes and revise the date at the top. Material changes will be communicated as required by applicable law. For questions about this policy or how Adria handles your information, contact [email protected]. Our Terms of Use describe the conditions for using the Services.