MobileCodeAI, Inc. ("we", "us") operates the MobileCode iOS app and the account management site at mobilecode.ai. This policy explains what data we collect and how we use it.
Data We Collect
GitHub access token - a short-lived credential used to read and write to your repositories on your behalf. Our backend obtains it from your refresh token when needed and holds it only temporarily in memory; we do not save it in our database. It is also used on your device to call GitHub directly.
GitHub refresh token - a longer-lived credential stored encrypted on our backend, used to silently renew your GitHub access without requiring you to log in again.
GitHub profile info - username, email, and avatar fetched at login to identify your account.
Usage data - AI model usage (input/output token counts) used to calculate and deduct billing credits.
Chat sessions and code changes - your messages and relevant code segments are sent to the AI provider you select (Anthropic, OpenAI, or Google) to generate a response, and stored on our backend to sync across sessions and devices.
Billing information - if you subscribe to a paid plan, Stripe (our payment processor) handles your payment details directly; we never see or store your card number. We store your Stripe customer ID and subscription plan to know what you're entitled to.
Your own AI provider keys (optional, paid plans) - if you add an Anthropic or OpenAI API key, we store it encrypted on our backend and use it only to send your requests to that provider. The app shows only its last four characters, and you can remove it anytime in Settings. We log usage on your key (model and token counts) but do not charge it to your credits.
Cloud sandbox - when you run commands in the sandbox, a copy of your project files is placed in an isolated cloud environment run by our infrastructure provider, E2B, along with internal identifiers for your account and session. Command output is returned to you, and we record run time to calculate credit usage. Sandboxes stop after a short idle period.
Shared projects - only if you choose to share a project, we store a snapshot of its text files on our backend and create a link (mobilecode.ai/p/...) that anyone who has it can open to view those files. Nothing is shared unless you tap Share. We skip common dependency and build folders and block files that match common secret names or key patterns, but this is not a guarantee, so don't share anything sensitive. Revoking a share disables its link. Deployed sites - if you deploy, your site is published publicly through GitHub Pages from your repository; deploying does not create a share link.
Push notification token - if you allow notifications, we store your device's Apple push token to notify you when a task finishes. You can turn this off in iOS Settings.
Web search - when the assistant searches the web, the search query is sent to our search provider, Brave.
How We Use It
GitHub tokens are used solely to access repositories you authorize.
Usage data is used to calculate billing credits consumed per session.
Your chat messages and code segments are sent to the AI provider you select (Anthropic, OpenAI, or Google) solely to generate a response to your request. We use each provider's paid commercial API; under each provider's terms, data sent through their paid API is not used to train their models by default.
Stripe processes payment information as described above.
Service providers that process data for us: Anthropic, OpenAI and Google (AI responses), E2B (cloud sandbox), Supabase (database), Render (hosting), Brave (web search), Apple (sign-in and push notifications), Google (sign-in), GitHub (repositories and sign-in), and Stripe (payments).
We do not sell your data, and we do not share it with third parties for advertising or marketing purposes.
Subscriptions
Paid plans are billed through Stripe on the account management site (mobilecode.ai/account), not through Apple's in-app purchase system. Subscriptions are monthly and auto-renew until cancelled. See our Terms of Service for billing and cancellation details.
Data Retention
Your data is retained as long as your account is active. You can request deletion by emailing us and we will remove your data within 30 days.
Security
All data is transmitted over HTTPS and stored encrypted.