Privacy & Terms

Privacy policy & terms of use

This page explains what personal data AI Commander processes when you use the relay at aicommander.dev, who else is involved, how long it is kept and how to exercise your rights — and the terms for using Free or buying Pro.

1. Who is responsible

The operator responsible for the AI Commander service, and the controller for the processing described here, is:

• Legal entity: 2Dynamic Games sp. z o.o. (operator of the AI Commander service, trading as “Coder AI”)
• Registered address: ul. Wadowicka 7, 30-347 Kraków, Poland (European Union)
• Contact email: support@coderai.dev

The same company operates Coder AI and other services. 2Dynamic Games is the operator and seller of Pro; Stripe processes payments but is not the seller or merchant of record.

2. What data we process

AI Commander is built to hold as little as possible. By default you can drive a machine without any account — you simply quote its session code — so for anonymous use we hold no identity data at all. The data we do process is:

• Account email (only if you sign in) — used for passwordless sign-in (an email magic-link, or a passkey once you enrol one) and to bind machines you link to your account. It is encrypted at rest (a dedicated EMAIL_SECRET root key); a separate keyed lookup HMAC is used to find your record without ever storing the address in plaintext.
• Passkey credentials (only if you enrol one) — if you choose a passkey for sign-in, we store its public key and a signature counter, bound to your account. A passkey's private key never leaves your device and is never sent to us.
• Session codes (AIC-XXXX-XXXX-XXXX) — the credential for a machine. The plaintext code is never stored; every record is keyed by a one-way, salted (peppered) HMAC hash, so a database leak contains no usable codes — except that, if you link a machine to your account, we store the first two characters of that code as a label to tell your machines apart in the dashboard; this two-character fragment cannot be used to reconstruct or use the code.
• API keys and agent tokens — stored only as salted hashes, never in plaintext, and revocable.
• Minimal operational metadata — magic-link tokens, OAuth state, web-session records, and per-IP / per-email rate-limit counters needed to run the service and resist abuse. Connection-time data (such as IP address) is processed transiently at the edge for rate limiting and is not retained as a profile.
• Files you transfer — when you use the file-transfer feature to copy a file off one of your machines (or onto one), the file's bytes pass through and are stored temporarily on our infrastructure so they can be collected. Each stored copy becomes inaccessible 24 hours after it is created, whether or not anyone downloaded it, and the download link stops working after one hour. An hourly cleanup sweep retries failed deletions, so physical bytes may remain as an inaccessible object until a later successful sweep. There is no way to list, rename or renew a stored file, and this is not a backup service. We do not store the file's name or path — only its bytes, its size, and which account it belongs to — and we do not read, scan, or index the contents. Files you never transfer are never touched: the feature only moves what you explicitly ask it to.
• Usage counters — so we can tell whether the service is being used and which parts of it, we keep a plain tally: for each account (or a single shared “anonymous” bucket for people using a session code without an account), a count of calls per UTC day per surface — commands run, jobs started, status checks, screenshots, file transfers — plus the number of bytes transferred. That is the whole record. It contains no command, no path, no filename, no machine identity, no IP address, and no time more precise than the day, so it cannot show when you were at a machine or what you did with it. Counters are deleted after 180 days.
• Billing data (only if you open Checkout or use Pro) — the Worker creates an opaque Stripe Customer linked to your internal user id and stores only its Stripe customer identifier plus your local plan (free or pro). Stripe-hosted Checkout collects billing/contact details, tax information and payment-method details directly from your browser as needed for the methods you choose. Stripe sends the Worker signed customer/subscription events and current subscription status so it can update the plan; those event payloads are processed for reconciliation, not copied into our account database. The Worker never receives or stores your full card number, security code, or payment credentials.
• Public-site feedback — public AI Commander pages load the CoderAI feedback widget from coderai.dev. Loading it discloses ordinary web-request data, such as your IP address, user agent, and the referring site origin, to that service. If you send feedback, the widget also sends your message, any email address you choose to enter, the AI Commander hostname, the full URL of the page from which you submitted it, the time between opening and submitting the form, and an empty anti-spam honeypot field. This integration does not pre-fill or send your AI Commander account email. The authenticated dashboard does not load the widget; its feedback links return you to the public site.
• Cookies — only strictly necessary SameSite=Lax cookies: a 24-hour session cookie set after you sign in (absolute — using the dashboard does not extend it), a 15-minute dashboard magic-link binding cookie (so an emailed URL works only in the browser that requested it), and a short-lived OAuth authorization binding cookie. All are HttpOnly and Secure; the raw magic-link binding stays only in the browser, while D1 stores its peppered hash. There are no advertising or cross-site tracking cookies.

3. How we use it

• Running the service — registering agents, routing commands to the right machine by session code, and (for signed-in users) resolving machine aliases. Legal basis: performance of the service you request, GDPR Art. 6(1)(b).
• Sign-in & account features — delivering magic-link emails and keeping you signed in. Legal basis: Art. 6(1)(b).
• Abuse prevention — per-IP and per-email rate limiting, an optional bot gate (Cloudflare Turnstile) on the OAuth page, and security hardening. Legal basis: our legitimate interest in keeping the service available and free of fraud, Art. 6(1)(f).
• Transferring files you ask us to — carrying a file between your machine and you, with access limited to the 24 hours available for collection and cleanup afterward. Legal basis: performance of the service you request, GDPR Art. 6(1)(b).
• Understanding usage — the aggregate counters described in section 2, used to see whether the service is used at all, which surfaces matter, and what a paid tier should measure. They are aggregated by day at the moment they are written, so no per-event history exists to analyse. Legal basis: our legitimate interest in operating and improving the service, Art. 6(1)(f).
• Receiving feedback and support requests — presenting the public feedback form, delivering what you submit to the team, preventing automated spam, and replying if you provide an email address. Legal basis: our legitimate interest in supporting and improving the service, GDPR Art. 6(1)(f), and taking steps at your request where your message concerns the service contract, Art. 6(1)(b).
• Providing Pro and administering payments — opening Stripe Checkout/Portal, reconciling subscription state, providing invoices and handling billing support. Legal basis: taking steps at your request and performing the subscription contract, GDPR Art. 6(1)(b), and compliance with accounting/consumer-law obligations where applicable, Art. 6(1)(c).

We do not sell personal data, and we do not use your data to build advertising profiles.

4. Recipients and subprocessors

AI Commander relies on the following infrastructure and external services, each for a narrow, defined purpose:

• Cloudflare — hosting and infrastructure: the Workers runtime that powers the relay, Durable Objects for live sessions, the KV stores, the D1 account database, R2 for download distribution and for temporarily holding files you transfer, and the edge/CDN. Cloudflare processes TLS-terminated request data in transit. It does not receive a persisted copy of your commands or their output.
• Cloudflare Turnstile — an optional bot challenge on the OAuth authorize page.
• Mailgun — delivery of sign-in (magic-link) emails. Mailgun receives the recipient email address and the link. AI Commander uses Mailgun's EU region (api.eu.mailgun.net).
• Stripe — payment processor and hosted billing provider. Checkout collects payment and billing details directly; Customer Portal lets you manage payment methods, invoices, and cancellation. Stripe can act as our processor for payment transactions and as an independent controller for some of its own legal, fraud-prevention, and service purposes. See Stripe's Privacy Policy and Privacy Center.
• CoderAI feedback service — the feedback SDK and submission endpoint at coderai.dev, operated by 2Dynamic Games sp. z o.o., receive the public-site request and feedback data described in section 2 so the team can collect feature requests and bug reports, prevent spam, and respond when requested. It is loaded only on public pages, not in the authenticated dashboard.

We do not add a subprocessor that receives command payloads, because no command payload is ever stored or forwarded to anyone but the agent that runs it. Files you explicitly transfer are the one exception to “nothing is stored”: they are held temporarily in Cloudflare R2, become inaccessible after 24 hours, and are then deleted by an hourly, retrying cleanup sweep.

5. Retention

• Commands and output — not retained at all (see section 2).
• Magic links, web sessions, WebAuthn (passkey) sign-in challenges and old revoked API keys — short-lived; a scheduled hourly cleanup job purges them once they expire so the tables do not grow unbounded.
• Account data (your encrypted email, machine aliases, API-key hashes) — kept while your account exists; removed when you delete your account.
• Session-code records — keyed by hash and tied to an agent registration; cleared when the code is changed or the agent uninstalled.
• Transferred files — access ends 24 hours after creation, downloaded or not. The deadline is checked on every read, so a stored copy stops being reachable the moment it turns 24 hours old rather than whenever cleanup next runs. An hourly job then attempts to erase the bytes and retries failures; physical bytes can therefore remain as an inaccessible object until a later successful sweep. The one-hour download link expires sooner on the same terms, and its spent or expired token is removed by the same retrying cleanup process.
• Usage counters — 180 days, then purged by the same hourly cleanup job. You can see your own counters any time in the dashboard under Usage.
• Billing — the Stripe customer identifier and current local plan are retained with the account. Stripe retains transaction, invoice, payment-method, and compliance records under its terms and legal obligations. We retain accounting or dispute records only for the period required by applicable law or needed to establish, exercise, or defend claims.

6. Access model & anonymous use

A session code is the credential for its machine: anyone who knows a current code can act on it until the owner resets the code or blocks their account. Linking an account is optional: signing in lets you save machines under friendly aliases and reach them with a personal API key. Free includes up to 10 usable saved devices and no new file transfer. Pro enables every saved device up to the technical 100-record ceiling and upload/download. If Pro ends while more than 10 records exist, nothing is deleted: the 10 oldest remain usable and the rest stay saved but plan-restricted. Anonymous command/status onboarding remains available during a code's first hour, but anonymous file transfer is not. Full detail is in Security.

7. Pro subscription, cancellation, payments & consumer rights

• Seller and purchase information. You buy Pro from 2Dynamic Games sp. z o.o.; Stripe processes the payment. The recurring price, currency, billing frequency and any applicable tax are shown in Stripe Checkout before you confirm. If no Pro Price is configured, purchase is unavailable rather than priced by this page.
• Renewal. Pro renews automatically at the interval shown at Checkout until cancelled. Charges use the payment method managed through Stripe.
• Manage or cancel. Open Manage subscription in the dashboard to enter Stripe Customer Portal. The Portal shows whether cancellation is immediate or takes effect at the end of the current billing period; that confirmation controls the effective date. When Pro ends, the account returns to Free: saved devices are not deleted, but only the 10 oldest remain usable and no new file transfers can start. Existing temporary blobs/links expire on their original deadlines.
• Payment problems and refunds. Contact support@coderai.dev for an incorrect charge, refund request, or billing complaint. Refunds are assessed under the purchase terms, mandatory consumer law, and the facts of the transaction; Stripe executes payment/refund processing but does not replace the seller.
• Statutory rights. If you are an EU/Polish consumer buying at a distance, you may have a 14-day statutory right to withdraw from a service contract, subject to the statutory rules for performance begun at your request and services already performed. Mandatory conformity, complaint, refund, and withdrawal rights are not limited by these terms. To exercise a right or ask for the applicable form, email support@coderai.dev with enough purchase information to identify the subscription. Official guidance: UOKiK — withdrawal from a distance contract and Your Europe — 14-day cooling-off period and exceptions.

8. Your rights

Subject to the conditions in the GDPR, you have the right to access your personal data, rectify inaccurate data, erase it, restrict or object to processing, and data portability. To exercise any of these — or to delete your account — contact support@coderai.dev. Because most processing is keyed by hashes and accounts are minimal, you may need to provide enough information to identify the account concerned. You also have the right to lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warszawa.

9. The service is provided “as is”

AI Commander is a relay plus an agent that, once installed by the user, can execute shell commands — by default as root — on the user's machine. It is remote shell access, not a sandbox. Because of that, the following terms apply to everyone who uses the service:

• Authorization. You warrant that you own, or are explicitly authorized to control, any machine on which you install the agent, and any machine you connect to via a session code. Installing or using AI Commander on machines you do not own or are not authorized to control is prohibited and is entirely your responsibility.
• Safeguarding credentials. You are responsible for protecting your session codes and API keys. Anyone who knows a current session code (no account needed in its first hour, or via a linked account at any time) can request commands on the corresponding machine — guard them like an SSH private key.
• “As is” / “as available”. The service is provided “AS IS” and “AS AVAILABLE”, without warranties of any kind, whether express or implied, including (without limitation) the implied warranties of merchantability, fitness for a particular purpose, availability, uninterrupted or error-free operation, and non-infringement. We do not warrant that the relay will be available at any given time.
• No liability. To the maximum extent permitted by law, the operator (2Dynamic Games sp. z o.o.) shall not be liable for any direct, indirect, incidental, consequential, special, exemplary or punitive damages — including, without limitation, data loss, downtime, business interruption, security incidents, unauthorized access, or damage to systems or devices — arising out of or relating to your use of, or inability to use, the service, even if advised of the possibility of such damages.
• Indemnity. You agree to indemnify and hold harmless the operator against any claims, losses, liabilities, damages, costs and expenses arising from your use of the service, the commands you (or an AI acting on your behalf) run through it, or your breach of these terms.

Nothing in this section limits liability that cannot be limited or excluded under applicable mandatory law.

10. Report a bug or feature, and contact

Found a bug or have a feature request? On public pages, the feedback button loads the CoderAI widget from coderai.dev. The authenticated dashboard does not load the widget; its feedback links return you to the public site to open it. You can also reach the team directly for any matter — including privacy requests and security reports — at support@coderai.dev.

11. Licensing

Three different regimes apply, so it is worth stating which is which. The desktop application (AI Commander for macOS and Windows) and the relay service are proprietary: this notice grants no licence to their source, and no right to copy, modify or redistribute them. @aicommander/agent, the on-machine agent published on npm, is licensed under the Elastic License 2.0 from version 1.1.0 onward — version 1.0.56 and every release before it were published under the MIT licence, and that grant is irrevocable for those versions. @aicommander/mcp, the MCP server you install beside your AI client, is MIT.

The agent’s source is public at github.com/AICommander-dev/aicommander-agent. Third-party components carry their own terms: each npm package ships its licence file in its own tarball, and the desktop application installs a THIRD-PARTY-NOTICES.txt naming the components compiled into it and where the remaining texts live.

12. Changes to this notice

We may update this notice as the service evolves. The current version is always published at this URL; the date below reflects the last revision.

Last updated: 2026-08-19