CommandChain

Last updated October 30, 2026

Privacy notice

This notice covers everything we run under the CommandChain name: this website and its documentation, the signed-in CommandChain application, the CommandChain app you install on your own computer, and preview links. The controller of your personal data is StackJive, LLC, an Illinois limited liability company ("StackJive", "we", "us"). Our Terms of service describe the agreement under which you use CommandChain.

The short version

  • CommandChain lets you watch, answer and approve coding agents running on your own computer, from your phone. To do that, our servers keep a copy of each session's conversation so you can read it from any device.
  • We do not use your content to train AI models, and we do not sell your personal data.
  • Ad measurement cookies are set only after you accept. Google Analytics is off on this website until you accept if you are in the European Economic Area, the United Kingdom or Switzerland; elsewhere it runs by default until you decline. In the signed-in application, analytics runs only after you accept. You can decline or change your choice on this page at any time.
  • You can delete your account yourself from the app. That deletes your sessions, notes and account details.

What we collect and store

Your account. Your email address, a hashed form of your password (bcrypt; we never hold the password itself), your name if you give one, and the date you signed up.

Your sessions. Our servers store a copy of each session: the messages you send, the agent's replies, the questions and approval requests it raises and the text of your answers, artifacts it publishes, its activity, the title we generate for the session, the project folder path, the name of the computer it ran on, and the repository branch and changed files it reports. We store this so a session you started in a terminal is readable on your phone, and a session you steered from your phone is still there when you open a laptop. Commands you send that have not yet reached your computer are held until they are delivered.

Images you attach. Pictures you send into a session (up to 3 MB each) are stored on our servers with the session.

Notes. Notes you write about a project or a computer are stored until you delete them.

Your computers. For each computer running the CommandChain app: the name you gave it, the app version, and whether it is online. When you ask for it, the app also reports folder listings and current memory, CPU and disk readings. Those are kept for minutes, not stored.

Your devices and notifications. The browsers and phones you sign in from, and the push subscription for each one you turn notifications on in. Push notifications themselves are generic: they carry the session label you typed and the kind of event (a question, an approval, an artifact), never the content. We keep the list of notifications you were sent for 30 days.

Billing. If you buy Pro, Stripe handles the payment and holds your card details. We hold your Stripe customer id, your plan, and when it renews or ends. We never see your full card number.

Technical data. Our servers keep operational logs (timestamps, the endpoint involved, errors and status events) to run and protect the service. Your IP address is held briefly in memory for rate limiting and for pairing a new computer; it is not written to our database. Nightly backups of our database are kept for 30 days.

Website and app usage. We use Google Analytics 4 to understand how the site and the app are used in aggregate: which pages people read, which links they follow, roughly where in the world they are, and what kind of device and browser they used. On this website it runs after you accept in the European Economic Area, the United Kingdom and Switzerland, and by default elsewhere until you decline; in the signed-in application it runs only after you accept. IP addresses are truncated before they are stored and we keep analytics data for no more than 14 months. Where ad measurement is switched on, and only after you accept a notice that names it, we also record which campaign brought you here and report sign-ups and purchases to the ad platforms. The cookies and ad measurement sections explain exactly what that involves.

Support. If you email us, we keep the email and our reply so we can help you and recognise a repeat problem.

Why we use it, and the legal basis

Where European or UK data protection law applies, we need a legal basis for each use. Where other laws apply, the purposes are the same.

  • To provide CommandChain (the contract with you): relaying your messages and approvals to your computer, storing sessions so every device shows the same thing, sending the notifications you turned on, taking payment, and answering support requests.
  • To keep the service working and safe (our legitimate interests): rate limiting, logs, backups, preventing abuse and fraud, and time-limited read-only access by our staff when you ask for help or when a safety or abuse report requires it. Every such access is logged.
  • To measure ads (your consent): the attribution cookie, the ad measurement tags, and reporting sign-ups and purchases to the ad platforms. The same basis covers analytics in the signed-in application everywhere, and analytics on this website for visitors in the European Economic Area, the United Kingdom and Switzerland. You can withdraw at any time using the control on this page.
  • To understand how this website is used (our legitimate interests), for visitors elsewhere: aggregate analytics about which pages are read and which links are followed, with IP addresses truncated. You can object by declining on this page, which switches it off.
  • To meet legal duties (legal obligation): tax and accounting records for payments, and responding to lawful requests.

Cookies and your choice

Where you are decides what happens before you choose. In the European Economic Area, the United Kingdom and Switzerland, analytics on this website is switched off until you accept: no analytics cookie is stored and no identifier follows you between visits, and Google receives only a record that a page was viewed, without a cookie and without anything that links it to your other visits. Elsewhere, analytics on this website is on by default, so Google Analytics sets its cookies on your first visit, until you decline. Declining switches it off and removes the analytics cookies; you can do that with the button below, or with Decline on the notice at the bottom of the page.

Ad measurement is different: it runs nowhere until you accept a notice that names it. In the signed-in application, analytics also runs only after you accept.

Your choice is one choice for the whole of CommandChain: it is recorded once and applies on this website, in the documentation and in the signed-in application. If we later ask for something broader than you agreed to (for example ad measurement, when the notice you answered mentioned only analytics), we ask again rather than assume.

Your current choice

Loading

Decline records a no for the whole of CommandChain, switches analytics off, and removes the analytics, ad measurement and attribution cookies. Change my choice clears the recorded choice and asks again. Withdrawing is as easy as giving.

Cookies used

Name Set by Purpose Lifetime
cc_analytics_consent Us Records whether you accepted or declined, and which notice you answered, so we stop asking. 6 months
cc_attribution Us Remembers which campaign or ad brought you here (campaign tags and ad click ids from the address you arrived on). Written only after you accept. 90 days
_ga Google Analytics Tells one browser from another. 2 years
_ga_* Google Analytics Holds the state of the current visit. 2 years
_gcl_aw, _gcl_gb Google Ads Stores a Google Ads click id so a later sign-up or purchase can be matched to the ad. Only after you accept a notice that names ad measurement. 90 days
_fbp, _fbc Meta Tells one browser from another and stores a Meta ad click id, for the same matching. Only after you accept a notice that names ad measurement. 90 days

The first two are ours. The Google Analytics cookies appear once analytics is running: after you accept in the European Economic Area, the United Kingdom and Switzerland, and from your first visit elsewhere until you decline. The ad measurement cookies appear only where ad measurement is switched on and you accepted a notice that named it. The OpenAI ads pixel, where used, may store its own identifier in your browser on the same terms.

Ad measurement

We advertise CommandChain. To learn whether an ad worked, we need to know when someone who clicked it later signs up or buys Pro. This is measurement, not profiling: ad personalisation is switched off, Google signals are off, and we do not build advertising audiences from your activity.

Only after you accept a notice that names ad measurement, the following happens. The campaign tags and ad click ids in the address you arrived on are kept in the cc_attribution cookie for 90 days. Google Ads, Meta and OpenAI tags load in your browser and report a sign-up, a first connected computer, the start of a checkout, and a purchase (with the price) back to that platform, each with a one-time event id. For sign-ups and Pro purchases, our server also sends the same event to OpenAI directly, so the two copies are counted once. That copy carries the event id, the time, the page it happened on, the OpenAI ad click id if you arrived from an OpenAI ad, and for a purchase the plan and price. It never includes your email, name, IP address or account id. The server only sends it when your browser reported that you accepted.

Before you accept, none of the ad measurement runs. Links from this site into the application carry the campaign tags from the address you arrived on, which stores nothing on your device and tells no third party anything.

Who else sees it

We use the following companies to run CommandChain. Each one processes data on our instructions under a contract, except where noted. We do not sell personal data to anyone.

  • Amazon. Hosting and storage, in the United States (Ohio). Email delivery through Amazon SES.
  • Stripe. Payments. Stripe holds your card details; we hold a Stripe customer id and your plan.
  • Google. Google Analytics for site and app usage. Google Ads conversion measurement, after consent.
  • Meta. Ad conversion measurement (Meta Pixel), after consent.
  • OpenAI. Ad conversion measurement for ads placed with OpenAI, after consent.
  • Apple, Google and Mozilla push services. Deliver notifications to the browsers and devices you turned them on in.
  • Google Workspace. Runs our support and privacy mailboxes, so an email you send us is stored there.

Stripe acts as an independent controller for the payment itself, under its own privacy policy. The coding agents you run (Claude Code, Codex, GitHub Copilot, OpenCode and Cursor) are separate products from separate companies: what you type into them goes to their providers under your own account with them, and that is governed by their privacy policies, not this one.

We may also disclose data when the law requires it, to protect someone's safety, or as part of a merger, acquisition or sale of assets, in which case this notice continues to apply to it.

How long we keep it

  • Account, sessions, images, notes, computers and devices: until you delete them, or until you delete your account.
  • Notifications list: 30 days.
  • Pending commands: until delivered to your computer.
  • Folder listings and machine readings: minutes.
  • Backups: 30 days. Data you delete leaves the backups on that schedule.
  • Billing records: as long as tax and accounting law requires, which can be several years after the payment.
  • Analytics data: no more than 14 months.
  • Support email: as long as the mailbox keeps it.

When you delete your account, your sessions, images, notes, computers, devices, notifications and account details are deleted. A Stripe customer record and invoices remain with Stripe for as long as payment law requires.

Your rights

Depending on where you live, you have some or all of these rights:

  • Access: ask what we hold about you and get a copy.
  • Deletion: use the Delete account button in the app, or email us.
  • Correction: ask us to correct anything that is wrong.
  • Portability: receive the data you gave us in a machine-readable form.
  • Objection and restriction: object to a use based on our legitimate interests, or ask us to restrict it while we check.
  • Withdraw consent: for analytics and ad measurement, using the control on this page, at any time.
  • Complain: to a data protection authority. In the EU that is the authority in the country where you live; in the UK it is the Information Commissioner's Office.

To exercise a right, email privacy@commandchain.ai from the address on your account. We answer within 30 days, or tell you why we need longer. We may ask you to confirm it is your account before we act. We will not treat you differently for exercising a right.

You can also block analytics entirely with a browser setting or an extension, and Google offers an opt-out add-on for its own analytics. Those work regardless of what you choose here.

California residents

Under the California Consumer Privacy Act (CCPA, as amended by the CPRA), you have the right to know what we collect, to delete it, to correct it, to opt out of its sale or sharing, and not to be discriminated against for exercising those rights. The categories of personal information we collect are: identifiers (email, name, Stripe customer id, device and push identifiers, cookie identifiers); commercial information (your plan and payment history); internet activity (session content, usage and analytics data, operational logs); and geolocation at the level of a country or region from analytics. The sections above say where each comes from, why we use it, who receives it and how long we keep it.

We do not sell personal information. Reporting a sign-up or purchase to Google, Meta or OpenAI so an ad can be measured may count as "sharing" for cross-context behavioral advertising under California law, even though we switch personalisation off. We only do it after you accept, and you can opt out at any time with the Decline analytics and ad measurement button on this page, which is our "Do Not Sell or Share My Personal Information" control. The "Your privacy choices" link in the footer of every page brings you here. We do not knowingly share the personal information of anyone under 16.

Our website and application do not currently respond to Do Not Track or Global Privacy Control browser signals. Use the control on this page instead; it has the same effect and is honoured across the whole of CommandChain.

We do not use or disclose sensitive personal information for anything beyond providing the service. To make a request, email privacy@commandchain.ai. An authorised agent may make a request for you with your written permission.

Children

CommandChain is for adults. You must be 18 or older to create an account. We do not knowingly collect personal data from anyone under 18; if you believe we have, email us and we will delete it.

Where your data is stored

Our servers are in the United States. If you use CommandChain from elsewhere, your data is transferred to and stored in the United States. For transfers from the European Economic Area, the United Kingdom and Switzerland, we rely on the European Commission's Standard Contractual Clauses, with the UK International Data Transfer Addendum where it applies, in our contracts with the providers listed above, together with their own published safeguards.

Security

Data travels between your devices, our servers and your computer over encrypted connections (TLS). Passwords are stored as bcrypt hashes. Each account's data is kept separate from every other account's at the database level. Access to production systems is limited to the people who run them, and staff access to a customer's account is time-limited and logged. No system is perfectly secure; if we learn of a breach that affects you, we will tell you and any authority the law requires, without undue delay.

Previews

A preview is a public web address that forwards to a development server running on your computer. It stays open for up to 4 hours, and anyone who has the link can open it during that time. Our servers relay the traffic and keep the usual operational logs; they do not store the pages served. You choose what runs behind a preview and who gets the link, so share links only with people you want to see your work.

Access by our staff

Our staff do not read your sessions in the course of running the service. A member of staff may view an account read-only when you ask for help with it, or when a safety or abuse report requires it. That access is time-limited and every instance is logged.

Changes to this notice

If we change what we collect or why, we update this page and the date at the top. For a change that matters to you, such as a new purpose or a new category of recipient, we email the address on your account before it takes effect, and where the change needs your consent we ask for it again.

Contact

Questions about this notice, or a request about your data, can go to privacy@commandchain.ai. StackJive, LLC, Illinois, USA.