Privacy Policy

1. Introduction

Atlarix is a native desktop application for AI-assisted software development. This policy applies to the Atlarix application and the website atlarix.dev. Atlarix is provided by NorahLabs. Atlarix is intended for users aged 13 and older. Users in the EU must be at least 16.

For privacy-related questions or requests, contact us at support@atlarix.dev.

2. Authentication

You sign in to Atlarix via GitHub OAuth, Google OAuth or Discord OAuth, all handled through Supabase Auth. We receive:

• Email address
• Name
• Profile picture

We use this data for account identification, workspace management, profile display, support, and legal compliance. You can revoke Atlarix's access at any time in your GitHub, Google or Discord account settings.

3. Analytics

Desktop app and CLI: the Atlarix desktop app and CLI use PostHog for product analytics (user actions, feature usage, session data) and device information. Events include your approximate location (country and city), which PostHog works out from your connection's IP address; the IP address itself is discarded and not stored. Data is processed on PostHog's servers in the EU. Analytics collection is optional and opt-in — we ask for your consent on first launch, and you can opt out at any time in Settings (or with /analytics in the CLI). The same choice covers Atlarix in your editor: the VS Code extension asks once, and other editors (Zed, JetBrains) send analytics only if you opted in in the app or the CLI. Events say which of these you used (and which editor). The Chrome extension sends no analytics of its own.

Usage records: when you use Atlarix Core or Atlarix Auto, our server keeps a daily count per account of the requests it served: which part of Atlarix sent them (desktop app, CLI, an editor), how they were paid for, their size in tokens, their cost and whether they failed. Never their content. We need these to run and bill the service, so they do not depend on the analytics choice above. When you are signed in, the app, the CLI and the editor extensions also send a daily count of their agent turns for your account, whatever model they ran on, including your own API keys and local models: which part of Atlarix (and which editor), how the turn was paid for, the provider type (a built-in provider, or “custom” with its API format, never the name or address of a provider you added), the model, how many turns and how many failed (with a short fixed reason), their size in tokens, and when the day's first and last turn were. Never what you or the model said, your code, or your keys. It is sent at most every 15 minutes and when you quit, not per message, and it is not covered by the analytics choice either. In VS Code, turning off VS Code's own telemetry stops it. The requests themselves still go straight from your device to your provider. When you sign in (in the app, the CLI, an editor or on this website), your account also keeps where you first signed in, that version of Atlarix and your operating system, and the version and operating system of your latest sign-in, so we can see where people start and help when something goes wrong. This is kept with your account and is not covered by the analytics choice either.

Website: the Atlarix website (atlarix.dev) counts visits with PostHog, without cookies or any other storage on your device: which pages are viewed, where visitors came from (the referring site and campaign tags in the link), and whether they downloaded Atlarix or signed in. Your IP address is discarded, a visit is not linked to you or to your account, and nothing is collected when your browser sends Do Not Track or Global Privacy Control. Google Tag Manager and Google Analytics were removed in September 2026 and are not used.

4. Error Monitoring

We use Sentry for crash reporting and error monitoring. Sentry may collect device info, OS version, app version, and error stack traces. When an agent turn fails on your own provider or model, the report says how it failed in a short fixed word (for example a server error at the provider) and which provider type, model and part of Atlarix it ran on, never the error's text, your prompt or your key. We do not intentionally collect code content in error reports, and keys are removed before a report is sent; reports from the CLI and the editor extensions also have your home folder path and email addresses removed. When you are signed in, a report carries your account's ID (never your email or name), so a crash can be matched to your account when you ask us for help. Crash reports are sent whatever your analytics choice; in VS Code, turning off VS Code's own telemetry stops them.

5. Workspace and Code Data

Atlarix Core: Unless you set up your own models, Atlarix runs on Atlarix Core. Your request passes through our authenticated proxy, which verifies your account before anything is sent — we don't log or retain the request. From there it goes directly to the model provider that serves it, who processes it under their own data policy. We don't have zero-retention agreements with these providers, so we can't guarantee what they keep. See our Models page for how models are connected in Atlarix.

Atlarix Auto (default): Atlarix Auto picks the Atlarix Core model for each step, and it is where new installs start. With Atlarix Pro or credit, Auto is paid and handled exactly like any other Atlarix Core request — it is never shared for model training. In the desktop app only, an account with no credit can use Auto for free: free Auto runs on OpenAI models under OpenAI's data-sharing program and on free models reached through OpenRouter and Requesty, so the prompts, code and replies it handles are shared with the provider that serves each request, which may use them to improve its models. Some free Auto requests are instead served by open-weight models (such as MiniMax and Kimi) that Atlarix runs on Amazon Bedrock (Amazon Web Services); AWS processes those requests on our behalf, does not use them to train models, and does not share them with the model makers. Atlarix Reviewer's free requests go only to OpenAI. You are asked to accept this before any free use, and you can avoid it at any time with Pro, credit, your own API key or a local model. The Chrome extension never uses free Auto. Atlarix Reviewer uses free Auto only for public repositories, on an account with no credit.

Local models (you set up): Run a local model — for example through Ollama — and your code and prompts never leave your machine. Nothing is sent, stored, or logged — by us or anyone.

Your own API key (you set up): Add your own provider key and requests go directly to the provider you chose. Atlarix acts as a local client — we never see the traffic.

Training: Atlarix never trains on your code, in any mode. The one case where a model provider may use what you send to improve its models is free Atlarix Auto, described above — opt-in, in the desktop app (and Reviewer on public repositories) only.

6. Account Data

Account data is stored securely in Supabase (servers in the US and EU). This includes:

• Email, name, profile picture
• Subscription tier
• Atlarix Core prepaid credit balance and top-up / usage history
• Onboarding state and connected extensions

7. Payments

Payments are handled entirely by LemonSqueezy. We do not store payment card data. LemonSqueezy is subject to its own privacy policy.

8. Agent Integrations

You can connect services such as Slack, Jira, Linear, Sentry, Notion, and Google Calendar by configuring MCP servers in the app. Credentials you supply (including tokens for third-party APIs) follow each server's configuration and the app's local storage model for MCP settings—they are not outsourced to a separate hosted credential service.

Atlarix agents access these services on your behalf with your explicit consent and scoped permissions.

The Atlarix app for Slack

When a workspace adds the Atlarix app, it reads only messages addressed to it: direct messages to Atlarix, and messages that mention @Atlarix, and the files attached to those messages. It does not read other channel messages or channel history. It replies in the thread it was asked in, keeping one status message there up to date. When a request tags teammates, it creates a private channel for that task with the requester and them in it, and archives it when the task is merged or closed.

• Per workspace: its Slack ID and name, the app's bot user ID, and the bot token, encrypted before it is stored.
• Per person who connects: their Slack user ID, the Atlarix account they connected on atlarix.dev, and an optional default repository.
• Per task: the request text, the repository, the channel and thread to reply in, the Slack user IDs of the person who asked and anyone they tagged, the names and IDs of attached files (not their contents), its status and recent steps, the pull request it opened, pages it published, its summary and what it cost.

A task's text and attached files are sent to the AI model that does the work and to the GitHub Actions run in your repository; the files are fetched from Slack for that run and are not stored by Atlarix. We do not use Slack messages or task content to train models, and we do not sell them.

Removing the app from a workspace deletes that workspace's stored data and every person's connection. You can disconnect yourself at any time from your account page on atlarix.dev. Task records stay in your account's job history, like work started on atlarix.dev, until you ask support@atlarix.dev to delete them.

9. Your Rights

You can request access to, correction of, or deletion of your personal data by emailing support@atlarix.dev. We will process deletion requests within 30 days in line with applicable law.

You may export your workspace configuration via the .atlarix folder at any time. You may opt out of analytics at any time in Settings (or with /analytics in the CLI). Crash reports are not covered by that setting (see Error Monitoring).

You can revoke GitHub, Google or Discord OAuth access at any time in your respective account settings.

10. Cookies

The Atlarix website (atlarix.dev) sets no analytics cookies: its visit counting (see Analytics) stores nothing on your device. The only browser storage the site uses is what signing in requires — your session, kept so you are not asked to log in on every page.

You can clear that storage at any time in your browser's settings; you are then signed out of the site.

11. Data Retention

PostHog analytics data is retained for 12 months. Sentry error data is retained for 90 days. Account data is retained until you request deletion.

Upon a deletion request, we remove personal data within 30 days.

12. Legal Basis

Our data processing is based on contract performance (to provide the service) and legitimate interest (security, error monitoring, product improvement).

Where applicable under GDPR, our legal bases are contract performance (Article 6(1)(b)) and legitimate interests (Article 6(1)(f)). We comply with GDPR, CCPA, and other applicable data protection laws where relevant.

13. Security

We use encryption in transit (TLS) and at rest via Supabase, and follow least-privilege access principles. We do not store payment card data or raw OAuth tokens.

14. Policy Changes

We may update this policy from time to time. We will notify you of significant changes via the app or website. Continued use of Atlarix after changes constitutes acceptance of the updated policy.

15. Infrastructure and service providers

Running Atlarix means other companies process some of your data on our behalf. The full list, with what each one holds, is on our Data Use page. In short: Supabase stores your account, LemonSqueezy handles payments, PostHog and Sentry receive analytics and crash reports, Resend sends account email, Railway runs our proxy and the cloud agent's server, OpenAI and Z.ai serve the Atlarix Core models, and Vercel hosts this website.

Cloudflare provides our DNS and stores our encrypted database backups. DNS resolution does not proxy or inspect traffic to atlarix.dev. The backups include account records and are encrypted before they leave our infrastructure — Cloudflare cannot read them.

16. Contact

For privacy questions or requests, contact us at support@atlarix.dev.

Privacy disputes are subject to the laws of Kenya.