Privacy Policy

NuDox provides compiler-backed, source-of-truth knowledge about codebases so AI agents and developers can query accurate, version-specific facts. This policy explains what information we collect when you use our website, dashboard, APIs, and MCP integrations, and how we use and protect it.

By using NuDox, you agree to the practices described in this policy.

• Account information — name, email address, and organization details you provide when creating an account.
• Repository data — source code and metadata from public or private repositories you connect for scanning and indexing.
• Query data — the symbols, libraries, and versions requested through our API and MCP integrations.
• Usage and technical data — API key activity, request volumes, device and browser information, IP address, and log data.
• Billing information — payment details handled by our payment providers; we never store full card numbers.

• Provide, operate, and improve the NuDox query engine and dashboard.
• Build and maintain versioned knowledge graphs from the repositories you connect.
• Monitor usage, enforce rate limits, and bill usage-based plans.
• Produce aggregated, de-identified analytics such as failure hotspots and symbol query patterns.
• Communicate with you about updates, security notices, and support.

Your code stays yours. Repositories you connect are scanned to derive a structured representation of symbols and their relationships, and the resulting graph is used only to serve your queries.

Private repository graphs are isolated to your account or enterprise installation. They are never shared with other customers, used to train models, or included in any public dataset.

We generate aggregated, de-identified insights from query activity, such as which symbols are queried most often or where agents hit mismatches. These insights never contain your source code, personal information, or anything that could identify you or your organization.

We do not sell your personal information. We share data only with:

• Service providers that help us operate the platform (hosting, payments, email), bound by confidentiality obligations.
• Legal authorities, when required by applicable law.
• A successor entity in the event of a merger or acquisition, under the same protections described here.

We retain personal data for as long as your account is active or as needed to provide the service, after which it is deleted or anonymized. Graphs built from disconnected repositories are removed on request.

Data is encrypted in transit and at rest, and access is restricted to authorized personnel.

Depending on your location, you may have the right to:

• Access, correct, or delete your personal data.
• Export your data in a portable format.
• Object to or restrict certain processing.
• Withdraw consent at any time.

To exercise any of these rights, reach out through our contact page.

We may update this policy from time to time. Material changes will be posted on this page with a revised date above. If you have questions about this policy or how we handle your data, please contact us.