Privacy Policy

1. Introduction

KandD Labs ("we", "us", "our") makes V3Code, an AI code editor available at v3code.dev. You bring your own AI provider keys; V3Code connects to those providers on your behalf. This Privacy Policy explains how we collect, use, store, and protect your information when you use V3Code and your V3Code account.

2. Information We Collect

Account Information

• Email address (for authentication and communication)
• Password (hashed, never stored in plaintext)
• Account creation date and subscription status

Your Country

• Nock's plans and own AI services are not offered in every country (see theTerms). To check, our servers look up the country of the internet address a request comes from, at the moment of the request; the address is not stored for this
• When a request is refused for this reason, we log only the country code and which service was refused
• The country lookup usesIP Geolocation by DB-IP, a database kept on our own servers; no address is sent to anyone else for it

API Keys

• Third-party API keys you provide (encrypted with AES-256-GCM at rest)
• Keys are only decrypted in memory when establishing connections to AI providers

Usage Data

• Session activity (login times, feature usage)
• Approval queue actions (approve/reject decisions)
• Theme and configuration preferences
• We record first-party page views and button clicks with a session-only id; no IP address and no cookie that lasts beyond the browser session

What We Do NOT Collect

• We do not read, log, or store your AI conversations, except the words listed under Words Shared With Us (Nock) below, and requests our abuse check flags
• We do not track your AI prompts or responses
• We do not use cookies for advertising or tracking

Pictures of Your Screen (Nock)

• While See your screen is on (Settings → Agent → Actions; it is on until you turn it off), one picture of the screen your pointer is on goes with each request you make to Nock's agent, so it knows what you are looking at. When you circle something while holding the agent keys, a closer picture of that part goes too
• The picture is part of that request. It goes to the AI that answers it: Nock's AI service and the model provider it uses, or your own provider when you use your own key or sign-in (see section 6). Dictation never looks at your screen
• On the Free plan a picture goes only when you circle or point at something
• Turn See your screen off and no picture of your screen is taken; only something you circle yourself is sent, and Show the agent what I circle turns that off too

Words Shared With Us (Nock)

While Nock is new, the reports and shared chats below are how problems get found and fixed quickly, and they let us improve Nock much faster than one person could alone. You can turn sharing off at any time.

• Thumbs up or down under an answer, then Send: that one request and its answer go to the Nock team
• A problem report you send (Settings → About → Report a problem, or one you ask Nock to send): your summary and details and, unless you untick diagnostics, the app's version, system, models and log, and that chat's last few requests and answers. You see all of it before you send. Kept 180 days
• Help improve Nock: Nock is built by a single developer. When 'Help improve Nock' is on, the text of your finished chats is sent to Nock's server so I can see when something broke for you. It is used only for that, never to train any model or for anything else, and you can turn it off in Settings. I'd really appreciate it if you left it on. A request that failed is shared the same way. While Nock is new, it is on for new installs outside Europe, and Nock says so at the end of setup; in Europe it stays off until you turn it on. Once it is off, sharing stops at once; after that we only see a problem you report
• Shared words are cleaned first: keys, emails, paths, file names and long ids are removed. Pictures, screenshots and files are never shared
• Abuse checks: your requests pass through the Nock service, which checks them for abuse and may keep a flagged request, encrypted, for up to 180 days for review

The Editor Is Local-First

• Your code lives on your machine — the editor does not upload your codebase to us
• The semantic index and persistent memory are built and stored locally by default
• The editor sends no telemetry to us by default
• Keys you add in the editor are stored on your machine, not on our servers

Optional Cloud Index (Paid Plans, Opt-In)

• Paid plans can choose cloud indexing to offload local resources — it is off unless you turn it on
• When enabled, code chunks and their embeddings for that workspace are stored on our infrastructure (Cloudflare), isolated per workspace
• Cloud index data is never used to train models and is never shared or sold
• Turn cloud indexing off at any time — its stored data is deleted; deleting your account deletes it too

Nock Browser (Chrome Extension)

• Nock Browser is a Chrome extension. It lets Nock on your computer, and AI agents you connect with a link, use your Chrome. They work only in tabs you share and tabs they open, and you can stop them at any time
• With Nock on your computer, what an agent reads in a tab (the page's text and pictures of the page) goes from Chrome to the Nock app on the same computer and becomes part of that agent's request to its AI, as described in section 6
• If you sign a Chrome in so agents can use it from anywhere, it connects to our relay on Cloudflare. What an agent you connected reads in a tab, and its questions and your answers, pass through the relay to that agent and are not stored
• For that, the relay keeps for your account: your signed-in browsers (a name such as “Chrome on Mac” and when each was last used); your agent links (their name, what they may do, when they end and which app used them, with each link's code kept only as a one-way hash); the sites you blocked; and a log of what agents did (which agent, which action, the site's address, when, and whether it was allowed), never what was on the page. While an agent has tabs open in your Chrome, the relay also keeps the address and title of each one; they are cleared when you press Stop or disconnect that link
• Signing a Chrome in hands Nock Browser your session's access token once; it keeps only a key for that browser, in Chrome's own storage. Nock Browser never hands your cookies or saved passwords to anyone, agents never read or type into password or card fields, and it never works on Chrome's own pages or the Chrome Web Store
• Dictation in Nock Browser uses Chrome's own speech recognition: on this computer when Chrome has your language there, otherwise Google's speech service. Choose “Only on this computer” and your voice never leaves your computer. Nock Browser never records or keeps your voice.
• Its settings, its pairing with the Nock app, your answers about sites and its short log of what Nock did on this computer stay in Chrome on your computer. Remove Nock Browser from Chrome, or press Forget this browser in it, and they are gone
• In Nock Browser you can end things yourself at any time: disconnect a link and it stops working at once; sign a browser out, or remove it from Your browsers, and its key stops working at once; clear the sites you blocked. A signed-out browser and a disconnected or expired link still keep a record (its name and dates) in the relay. The log of what agents did deletes itself after 30 days. To have everything the relay keeps for your account deleted, write to kanddlabs@v3code.dev and we delete it
• This data is used only to run Nock Browser. It is never sold, never used for advertising and never used to train models. Nock Browser's use of it follows the Chrome Web Store User Data Policy, including its Limited Use requirements

3. How We Use Your Information

• To provide and maintain the Service
• To authenticate your identity and manage your account
• To process payments through Stripe
• To send essential service communications (billing, security alerts)
• To improve the Service based on aggregate usage patterns

4. Data Storage and Security

User Isolation

Each user receives a dedicated, isolated data directory. Path traversal protection prevents any user from accessing another user's data.

Encryption

• API keys are encrypted with AES-256-GCM before storage
• All connections use HTTPS/TLS encryption in transit
• Passwords are hashed using industry-standard algorithms via Supabase Auth

Infrastructure

Our service runs on Railway with persistent encrypted storage. Authentication is handled by Supabase with enterprise-grade security.

5. Third-Party Services

We use the following third-party services:

• Supabase — Authentication and user database
• Stripe — Payment processing (we never see or store your full card number)
• Railway — Infrastructure hosting
• Cloudflare — Downloads, updates, the optional cloud index, and Nock Browser's relay

These services have their own privacy policies. We do not sell or share your data with any other third parties.

6. AI Provider Data

With your own keys (BYOK): your AI interactions are sent directly to your chosen AI provider (OpenAI, Anthropic, Google, etc.) using your own API keys. We do not store, log, or analyze the content of these interactions. Each provider's own privacy policy governs how they handle your data.

On hosted plans: requests to our hosted models are processed by our backend and forwarded to the underlying provider. We record usage metrics (such as token counts) to meter your plan, and we do not use your content to train models or retain prompt content beyond what is needed to serve the request.

Nock's spoken replies: when Nock speaks with its cloud voice, including in the tour before you sign up, the words it is about to say (which can include the name you gave it) go through our backend to a voice provider that turns them into speech. Our backend passes those words on without keeping them: we record at most how many characters were spoken and what they cost, to meter the tour and your plan.

Dictation: Nock turns your voice into text on this computer first, with the Mac's own recogniser in its on-device mode or with Nock's downloaded speech model. Nock's cloud dictation is used only on a plan that includes it (the paid plans), and only when you choose Cloud in Settings → Dictation, or, on Automatic, when no on-device engine can take that dictation (Nock's model is not downloaded yet, cannot keep up on this computer, or is not loaded while the computer is busy). Then the audio, with a short list of hint words (words you added to your vocabulary, your bots' names, and names in the box you are typing in, never its ordinary words), goes through our backend to a speech provider, and the text comes back. Our backend passes the audio and the text on without keeping them: we record how many seconds were dictated and what they cost. With Polished clean-up, the words it heard then go to an AI to be tidied (Nock's, or your own key's), like any request above. Choose On this computer, or turn on Never send my voice off this computer, and your voice never leaves your computer. The Free plan and Nock Own dictate on this computer, or with your own speech key, which sends your voice straight to that key's provider (as with your own keys above). In the tour before you sign up, dictation runs on this computer.

We aim for US-based providers. When servers are busy or prices are high and not cost efficient, we use all routes, including outside the US, to keep pricing fair for users.

7. Data Retention

• Account data is retained while your account is active
• Cloud index data (if you enabled cloud indexing) is deleted when you disable it, and with your account
• Nock Browser's log of what agents did deletes itself after 30 days. Its records of your signed-in browsers and agent links stay in the relay, also after you sign a browser out or disconnect a link (which stops it working at once), until you ask us to delete them at kanddlabs@v3code.dev, including when you delete your account
• Upon account deletion, all other user data is permanently removed within 30 days
• Payment records are retained as required by law and Stripe's policies

8. Your Rights

You have the right to:

• Access your personal data
• Correct inaccurate personal data
• Delete your account and associated data
• Export your data
• Opt out of non-essential communications

To exercise these rights, contact us at kanddlabs@v3code.dev.

10. Children's Privacy

The Service is not intended for users under 18 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child, we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or a notice on the Service. The "Last updated" date at the top reflects when the latest changes were made.

12. Contact

For questions or concerns about this Privacy Policy, contact us at kanddlabs@v3code.dev.

KandD Labs — Ledyard, Connecticut, USA.