Privacy Policy

This Privacy Policy explains how the Devora Service handles information when you use the Devora website, create or use a Devora account, or run the Devora desktop application. It also describes the role of third-party processors, including AI model providers and our payment processor.

Devora, the operator of the Service, is the data controller for the personal information described in this policy. Privacy questions, requests, and complaints can be sent through the support page, and we will respond within the timeframe required by applicable law.

• Account information: your email address, name (if provided), password (stored only in hashed form by the account system), and account settings.
• Website session data: a signed, HttpOnly session cookie that keeps you signed in on this website. It contains your session identifiers and an upstream access token; it is not readable by scripts in your browser.
• Desktop enrollment data: identifiers for the devices you enroll, used to enforce device limits and licensing for your plan.
• Workspace content: files and context from your projects that you explicitly include in an Ask, Plan, or Build request, so AI features can ground their output in your code.
• Support communications: the content you submit through the support form, kept so we can respond and follow up.
• Operational diagnostics: request IDs, rate-limiting metadata (such as IP address), and security logs needed to run and protect the Service.
• Billing data: handled by our payment processor. We receive subscription status (such as active, canceled, or past due) and limited billing metadata — never your full payment-card number.

• To provide the Service: authenticate you, sync your plan and entitlements, enforce device limits, and operate AI features.
• To keep the Service secure: detect abuse, apply rate limits, investigate incidents, and protect accounts.
• To communicate with you: transactional messages about your account, subscription, and support requests.
• To improve the Service: understand feature usage in aggregate, where permitted.

We do not sell your personal information, and we do not use your workspace content to advertise to you.

AI features are delivered through model providers configured and operated by Devora. To generate a response, the relevant parts of your workspace are transmitted — together with your request — to the provider serving that request. Providers process this content solely to generate and deliver responses to you; it is not used to advertise to you, and Devora does not sell it to anyone. Providers’ own privacy commitments apply to the content they process, and their documentation identifies which models are available to your account.

Only content needed for the task is included. Devora does not upload your entire disk or projects you have not opened in the app, and changes proposed by AI are applied locally with your review.

This website uses a strictly necessary session cookie to keep you signed in (signed, HttpOnly, SameSite=Lax). We do not use advertising cookies, cross-site trackers, or third-party analytics beacons on this website. If optional analytics are ever added, this policy and your consent choices will be updated first.

• AI model providers: to generate responses to your requests, as described in section 4.
• Payment processor (Paddle): to process subscriptions, invoices, and refunds.
• Infrastructure and security providers: hosting, delivery, and abuse-prevention services that operate the Service.
• Legal requirements: where disclosure is required by law or necessary to protect rights, safety, and security.

We do not otherwise share personal information except with your direction or consent.

We keep personal information only as long as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements. Account information is kept while your account is active. Support messages are kept for up to 12 months after a request is closed. Operational diagnostics — such as rate-limiting metadata and security logs — are kept for up to 90 days. When you delete your account, associated personal information is removed within 30 days, except where a longer period is required by law.

The Service applies defense-in-depth measures: HTTPS-only traffic, signed HttpOnly session cookies, host-restricted server-side API calls, secret redaction in logs, server-side validation, and enforced device and entitlement limits. No system is perfectly secure; if a data incident affects you, we will notify you as required by applicable law.

Depending on your jurisdiction, you may have rights to access, correct, export, or delete your personal information, to object to or restrict certain processing, and to lodge a complaint with a supervisory authority. You can exercise most choices directly: update account details in your dashboard, unenroll devices, cancel a subscription, or delete your account. For anything else, contact us through the support page and we will respond within the timeframe required by applicable law.

The Service is not directed to children under 16 (or the applicable minimum age in your jurisdiction), and we do not knowingly collect their personal information. If you believe a child has created an account, contact us so we can remove it.

We may update this Privacy Policy as the Service evolves. The current version is always published on this page with its last-updated date. Material changes will be announced through the Service before they take effect.