Privacy Policy

Version 1.5 · Takes effect on the date it is published

This Privacy Policy explains how Pathrule ("Pathrule", "we", "us", "our") collects, uses, discloses, and safeguards information when you use the Pathrule CLI, the Pathrule VS Code extension, the local and hosted MCP servers, the Pathrule cloud service (Pathrule Cloud), or the website at pathrule.io (together, the "Service").

This Policy also covers information retained from discontinued features. Those features no longer collect new data. Historical records remain subject to the retention, access and deletion rights described here; a retained record does not mean the feature is offered today.

If you do not agree with this Policy, please do not use the Service.

About Pathrule. Pathrule is the intelligence layer for coding agents. The CLI, VS Code extension and local MCP server connect the agents you already use. The Local Console works with local knowledge in your browser. Local mode needs no account and stores knowledge on your device. In Cloud mode, Pathrule Cloud stores shared knowledge and related workspace records on Cloudflare, with a separate management console and OAuth-scoped Remote MCP.

0. At a glance

• Operator: Pathrule
• Registered address: 30 Ağustos Zafer Mah. 73. Sok. No:3, Bursa/Nilüfer, Türkiye
• Privacy contact: privacy@pathrule.io
• Website: pathrule.io
• Jurisdictions: European Union and EEA (GDPR), United Kingdom (UK GDPR), Türkiye (KVKK), United States (California CCPA / CPRA and other state privacy laws), Canada (PIPEDA and Québec's Law 25); regional details in Section 15
• Managed knowledge indexing and retrieval: Cloudflare Workers AI
• Naming knowledge topics in Pathrule Cloud: Anthropic (Claude), which receives topic keywords, folder paths and at most six item titles per topic, never item bodies
• Optional product telemetry: PostHog (EU ingestion)
• Sale of data: We do not sell or share personal data for cross-context behavioural advertising
• Minimum age: 16

1. Information we collect

We collect only what is necessary to operate the Service and to comply with the law.

1.1 Information you provide directly

• Account information. Your email address and how you sign in: a one-time code sent by email, a password you set (stored only as a hash), a passkey you register (we keep its public key; your fingerprint, face or device PIN never leave your device), or the basic profile returned by the identity provider you choose (GitHub or Google).
• Profile and workspace settings. Workspace names, display preferences, locale.
• User-authored content. Memories, rules, skills, working preferences, code-backed findings, and activity-log task summaries that you, or your AI agent acting on your behalf, write into Pathrule. This is the core knowledge graph the Service exists to manage.
• Support communications. When you email us or report an issue, we keep the message and any attachments.

1.2 Information collected automatically

• Workspace metadata. Node paths in your workspace tree, the workspace-relative file paths your AI agent reports as "touched" in an activity log, and timestamps. We do not receive the contents of those files unless you (or your agent) explicitly paste them into a memory, rule, or skill, or run pathrule snapshot as described below.
• Prompt text for ranking (Cloud mode). When a hook that Pathrule installed in your coding agent runs while you are signed in, the beginning of your prompt (about the first 1,000 characters) is sent to the Service so it can rank which memories, rules, and skills to deliver.
• Project snapshots. When you or your AI agent run pathrule snapshot, the CLI uploads a project overview to your workspace: the file tree, manifest files, short samples of documentation files, and recent git metadata (such as the current branch and a summary of recent commits).
• CLI usage telemetry. The standalone local CLI sends none. A signed-in managed CLI sends anonymous usage events only after you opt in with pathrule telemetry enable. They use a random install id and contain command or feature names, result, duration, version and OS family, never code, paths, prompts, knowledge, email, account or workspace ids. pathrule telemetry disable, NO_TELEMETRY=1, DO_NOT_TRACK=1 and CI keep it off.
• Context and activity evidence. Delivery receipts, consulted knowledge ids, tool outcome metadata and activity summaries help explain what guidance reached an agent. Your coding agent’s full conversation remains governed by that agent’s provider; Pathrule does not proxy it.
• Product analytics. Operational events help us run and improve the Service. Optional managed CLI and console telemetry is opt-in and sent to PostHog’s EU ingestion service. Website analytics uses the separate cookie consent described in Section 9. Cloudflare Web Analytics counts page views on pathrule.io without cookies or identifiers.
• Account milestones (optional). If you turn on "Share account milestones" on your account page, Pathrule's servers send a few account events (a workspace created, an invitation accepted, a trial or a subscription started or changed) with the plan, billing cycle and a seat range to PostHog's EU ingestion service. They carry a pseudonym derived from your account with a key only Pathrule holds, never your e-mail address, name, organization or workspace names, or content; turning the setting off stops them and drops any not yet sent.
• Usage meters. Counters we need to enforce plan limits and bill correctly: AI Credit usage, managed feature usage and subscription limits.
• Runtime signals (Signals). If you enable Pathrule Signals for a workspace, runtime errors and events your instrumented application reports are stored and linked to their code path, flow, environment and release. Standalone collectors are operated by you; Local Signals stays on your machine. Signals is opt-in and is not a web-analytics product: it does not track end users, sessions, or funnels. You decide which points in your own code emit a signal, and you are responsible for not putting personal data into a signal payload.
• Device and connection data. Operating system, app version, device model, IP address, coarse geolocation derived from IP, language, time zone, crash reports, and diagnostic logs.
• Cookies and similar technologies. The website uses cookies described in Section 9. The Pathrule CLI does not set HTTP cookies; it stores its settings locally in its own data directory on your device.

1.3 Information from third parties

• Identity providers. The OAuth provider you sign in with returns your email and basic profile.
• Stripe. When you purchase a subscription, Stripe shares with us a customer ID, subscription status, the last 4 digits and brand of the card, billing country, and invoice metadata. We never receive or store full card numbers, CVC, or full bank details; those are handled exclusively by Stripe. If you cancel a subscription in Pathrule Web or in Stripe's customer portal, the reason you choose and any comment you write are stored with the subscription in Stripe, together with whether a one-time retention discount was offered and accepted.

1.4 Sensitive content you may write into Pathrule

Pathrule is not designed to receive special-category data (health, biometric, political, religious, racial or ethnic origin, trade-union membership, sexual orientation, criminal records) or developer secrets such as API keys, access tokens, or customer data. If you choose to paste such content into a memory, rule, or skill, you do so at your own risk and you remain solely responsible for ensuring you have a lawful basis to process it. Cloud requests are checked against the current session, workspace membership and permissions, but Pathrule disclaims liability for content the user voluntarily inserts. We strongly recommend not storing secrets or special-category data in Pathrule.

2. How we collect information

• Directly from you. When you sign up, configure a workspace, write memories, rules, or skills, install third-party skills, or contact support.
• Automatically from the CLI, the VS Code extension and the MCP server. When the local hook supervisor records your AI agent's tool calls and forwards activity logs to the cloud, and when context retrieval or project-learning features record the evidence they need.
• Automatically from the website, through cookies and analytics described in Section 9.
• From third parties: identity providers (OAuth sign-in), Stripe (billing), and the service providers listed in Section 5.

3. How we use information

We use information for the following specific purposes:

1. Provide the Service. Authenticate you, store and retrieve your memories, rules, and skills, deliver path-scoped context to your AI agent, and sync activity logs.
2. Operate knowledge retrieval and MCP. Select relevant workspace knowledge, deliver context, keep content versions and validate authorized reads and writes.
3. Billing. Manage subscriptions, process payments via Stripe, issue invoices, and comply with applicable tax law.
4. Improve the product. Analyse aggregated usage patterns (which features people use, which routing decisions correlate with successful AI outcomes, where users hit errors) so we can prioritise fixes and new features.
5. Cost and quality monitoring. Track per-user, per-model, per-feature LLM cost and latency to detect regressions and prevent abuse.
6. Support and communication. Reply to your support emails and send transactional emails such as account confirmation, billing receipts, and security alerts.
7. Security and abuse prevention. Detect fraudulent sign-ups, rate-limit abusive callers, and investigate suspected misuse of the Service.
8. Legal compliance. Respond to lawful requests and retain records that tax or commercial law requires us to keep.
9. Marketing communications. If you opt in, we send product update emails and a product newsletter via Resend. You can unsubscribe at any time using the link in every marketing email.

We will not use your data for materially different purposes without first updating this Policy and, where required, obtaining your consent.

4. Legal basis for processing (GDPR / KVKK)

We rely on the following legal bases:

You can withdraw consent at any time without affecting processing carried out before the withdrawal.

5. Data sharing and sub-processors

We share information only with the categories of recipients listed below, and only as needed for the purposes in Section 3.

We do not sell personal data, and we do not share personal data for cross-context behavioural advertising as defined by CCPA / CPRA. We do not engage in targeted advertising of any kind.

AI model providers. Cloudflare Workers AI indexes and retrieves Cloud knowledge, and Anthropic names knowledge topics; both are listed above. If you connect your own model provider to a local installation, that provider processes what you send it under your own agreement with it; it is not Pathrule's sub-processor.

6. International data transfers

Pathrule uses providers listed in Section 5, which may process information outside Türkiye and the EU/EEA, including in the United States and on global infrastructure. The optional PostHog product telemetry destination uses EU ingestion.

For these transfers we rely on the following safeguards:

• EU/EEA users: for Cloudflare, Stripe, Resend and Anthropic, the EU Standard Contractual Clauses (Module 2 / Module 3 as applicable) that each provider's data processing terms incorporate; for PostHog, the EU Standard Contractual Clauses (Module 2) in our signed data processing agreement with it; for Google Analytics, which runs only after you consent, Google's Ads Data Processing Terms, accepted for our account, and the transfer safeguards they include. All of this is supplemented by encryption in transit and at rest, strict access controls, and contractual confidentiality obligations.
• UK users: the UK International Data Transfer Addendum or the UK Extension, where a provider's data processing terms include one.
• KVKK transfers (Türkiye): açık rıza (KVKK m. 9) ve sektörel olarak uygun olduğu hallerde KVK Kurulu tarafından onaylanmış taahhütname mekanizmaları.

7. Data retention

We keep personal data only as long as needed for the purpose it was collected for, after which it is deleted or irreversibly anonymised. Scheduled maintenance removes expired Cloud activity and authentication state. Workspace deletion uses a separately reviewed retention policy.

7.1 Activity logs

Cloud activity evidence is retained for up to 180 days and removed by scheduled maintenance after that window. Local records remain on your machine under local controls.

7.2 Work episodes

Cloud work-episode recall is assembled from retained activity evidence.

7.3 Workspaces, memories, rules, skills

Archiving a workspace preserves its data and removes active access. Deleting a workspace removes access and revokes its grants; permanent cleanup follows a reviewed retention policy, including any applicable legal hold.

Deleted knowledge entries remain restorable while retained, unless permanently deleted. Contact privacy@pathrule.io for an access, deletion or retention request, including records from the earlier service.

Closing an organisation. An owner can close an organisation from Pathrule Web after signing in again and typing the organisation's name. An organisation with a subscription that is still active cannot be closed until the subscription is cancelled. When an organisation is closed, every member loses access at once, its workspaces are deleted together with their access grants and keys, and pending invitations expire. The records of a closed organisation and its deleted workspaces are kept only as long as needed for legal, security and billing obligations.

7.4 Billing lifecycle

• If a payment for a paid subscription fails, the paid plan stays active for a 7-day grace period from the first failed payment we verify, and Pathrule Web shows a notice. If it is still unpaid when the period ends, the organisation moves to the Solo plan. Moving to Solo deletes nothing: workspaces, memories, rules and skills stay under the rules in Section 7.3.
• Invoices and payment records are kept for the period required by applicable tax and commercial law (currently 10 years under Turkish law).

7.5 Account deletion

You can delete your Pathrule Cloud account yourself from its account page, which Pathrule Web links to, after signing in again and typing the account's e-mail address. An account cannot be deleted while it is the only owner of an open organisation: close that organisation, or make another member an owner, first.

• When you ask, every session and every Remote MCP authorisation of the account ends immediately, and we e-mail the account's address.
• The deletion completes 30 days after the request. Signing in again before then cancels it, and we tell you by e-mail.
• When it completes, your sign-in identity and personal data are removed: your e-mail address and name are replaced, and your sign-in methods, sessions, memberships, preferences and personal intelligence data are deleted. Records you contributed to shared workspaces, such as knowledge versions and activity, stay with the workspace under an anonymous identifier. We e-mail the former address that the deletion is complete.
• Billing records may remain where the law requires us to keep them (Section 7.4).

You can also ask for deletion at privacy@pathrule.io from the address associated with your account. We verify the request and handle it under the rights and response periods in Section 8.

7.6 Signals and historical records

• Local runtime signals. Follow the retention described in the Signals documentation. Standalone collector retention is controlled by you. Pathrule Cloud keeps Signals records on the retention described on the Cloud Signals page.
• Historical records from discontinued features. Retained records remain Your Content and are subject to applicable deletion and retention obligations. Where a record was stored encrypted, it remains encrypted; retaining it does not enable the discontinued feature. Contact privacy@pathrule.io to request access or deletion.

7.7 Other retention windows

• Support email correspondence: 24 months after the ticket is closed.
• Database backups: retention follows the storage service and the applicable deletion policy. Contact privacy@pathrule.io for the current backup window for your records.
• Security and abuse logs: 12 months.

8. Your rights

Subject to local law, you have the right to:

• Access the personal data we hold about you and receive a copy.
• Rectify inaccurate or incomplete data.
• Erase your data ("right to be forgotten"), subject to legal retention obligations.
• Restrict processing in certain situations.
• Object to processing that is based on our legitimate interests, including profiling.
• Data portability. Receive your data in a structured, machine-readable format and ask us to transmit it to another controller where technically feasible.
• Withdraw consent at any time, without affecting prior lawful processing.
• Not be discriminated against for exercising your privacy rights (CCPA / CPRA).
• Opt out of "sale" or "sharing" of personal data. We do not sell or share, but we will still honour the signal.
• Lodge a complaint with a supervisory authority such as the Kişisel Verileri Koruma Kurumu (Türkiye), your local Data Protection Authority (EU/EEA), or the California Privacy Protection Agency / California Attorney General.

How to exercise your rights. Email privacy@pathrule.io from the address associated with your account, or delete your Cloud account yourself as described in Section 7.5. We respond within 30 days for GDPR / KVKK requests (extendable by 60 days where the request is complex) and within 45 days for CCPA requests. We may ask you to verify your identity before fulfilling a request.

9. Cookies and tracking

The website at pathrule.io uses the following categories of cookies:

Cloudflare Web Analytics counts page views on pathrule.io without cookies or identifiers. You can change your choice at any time from Cookie settings or Your Privacy Choices in the footer of every page, or through your browser settings. Disabling strictly-necessary storage will break the site. For the full list of cookies and storage we use, their purposes, durations and providers, see our Cookie Policy (/cookie-policy).

The Pathrule CLI does not use HTTP cookies. Its settings and credentials are stored in its own user-only data directory on your device.

10. Security

We implement reasonable technical and organisational measures to protect your data, including:

• Encryption in transit (TLS 1.2 or higher) and encryption at rest at the database and object-storage layers.
• Strict access controls: least-privilege role-based access for our team and authenticated server-side workspace access checks.
• Current session, membership, permission and workspace-state checks on Cloud requests.
• Remote MCP grants bound to one approved workspace and scopes, with revocation and rotating refresh tokens.
• Service credentials kept in server-side secret stores; never shipped as client admin keys.
• Regular dependency updates, code review, and a documented incident response process.
• Logged and audited administrative access.

10.1 Historical encrypted content

Some discontinued features stored content encrypted on your device before upload. Where we still retain those records, we retain ciphertext and cannot read it without its decryption key. An explicit share that was stored workspace-readable remains subject to workspace access controls and your deletion rights. This describes retained data, not a current conversation or design-sharing feature.

10.2 Breach notification

If we become aware of a personal-data breach, we will notify the relevant supervisory authority within 72 hours where required, and notify affected users without undue delay where the breach is likely to result in a high risk to their rights.

No system is 100% secure, and we cannot guarantee absolute security.

11. Children's privacy

Pathrule is intended for professional developers and is not directed to children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us personal data, please contact privacy@pathrule.io and we will delete it.

12. Contact

• Operator: Pathrule
• Registered address: 30 Ağustos Zafer Mah. 73. Sok. No:3, Bursa/Nilüfer, Türkiye
• Privacy contact: privacy@pathrule.io
• Data Protection & KVKK contact person: Sertan Helvacı, sertan@pathrule.io
• Response time: we aim to respond to all rights requests within 30 days (GDPR / KVKK) or 45 days (CCPA).

13. Changes to this Policy

We may update this Policy from time to time. When we make material changes we will:

• Update the version and effective date shown at the top of this page.
• Notify registered users by email and via an in-app banner at least 14 days before the changes take effect (30 days where the changes involve new categories of processing).
• For changes that require consent, request fresh consent before the change applies to you.

If you disagree with material changes you may close your account before they take effect.

14. Additional provisions

• No sale of data. We do not sell your personal data, and we do not share it for cross-context behavioural advertising. We share it only with the recipients in Section 5, for the purposes in Section 3.
• Third-party links. The Service may link to or interoperate with third-party services such as GitHub and the Stripe customer portal. Their privacy practices are governed by their own policies.
• Governing law. This Policy is governed by the laws of the Republic of Türkiye, without prejudice to the mandatory protections that GDPR, UK GDPR, US state privacy laws or Canadian privacy law give to users in those jurisdictions.
• Language. This Policy is published in English. Where translations are provided for convenience, the English version prevails in case of inconsistency.
• Version. The version and effective date of this Policy are shown at the top of this page.

15. Regional information

15.1 European Economic Area and United Kingdom

• Controller. Pathrule, 30 Ağustos Zafer Mah. 73. Sok. No:3, Bursa/Nilüfer, Türkiye, privacy@pathrule.io. Our data protection contact is named in Section 12.
• Legal bases. Each purpose and its legal basis are listed in Section 4. Where we rely on legitimate interests you can object (Section 8); where we rely on consent you can withdraw it at any time, for website analytics through Cookie settings in the footer.
• Your rights are listed in Section 8, and international transfers and their safeguards in Section 6.
• Complaints. You can complain to the data protection authority of your country of residence, place of work or the place of an alleged infringement, or, in the United Kingdom, to the Information Commissioner's Office.

15.2 United States

This section applies to residents of US states with consumer privacy laws, such as California (the CCPA as amended by the CPRA), Colorado, Connecticut, Oregon, Texas, Utah and Virginia, to the extent those laws apply to Pathrule.

• Categories we collect. Identifiers (email address, account and workspace identifiers, IP address, the random install id of opt-in telemetry); customer records and commercial information (plan, billing country, invoice and payment status from Stripe, cancellation reasons); internet or other electronic network activity (Service and activity logs, and website analytics only with your consent); approximate location derived from IP; the content you write into the Service; and, as sensitive personal information, account log-in credentials (a password hash or a passkey's public key). We do not collect precise geolocation or biometric data: a passkey's biometric check stays on your device.
• Sources and purposes. We collect this information from you, from your devices and agents, from your identity provider and from Stripe (Sections 1 and 2), for the purposes in Section 3, and keep it as described in Section 7.
• Disclosures. We disclose personal information for business purposes only to the service providers and recipients in Section 5. We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use it for targeted advertising or for profiling that produces legal or similarly significant effects. We use sensitive personal information only to provide the Service and keep it secure. We have no actual knowledge of selling or sharing the personal information of consumers under 16.
• Your rights. Depending on your state, you can ask to know and access the personal information we hold about you, to delete it, to correct it, to receive a portable copy, and to opt out of sale, sharing or targeted advertising (we do none of these). We will not discriminate against you for exercising a right.
• How to exercise them. Email privacy@pathrule.io, or delete your Cloud account yourself (Section 7.5). An authorised agent may act for you with your signed permission. We verify requests and answer within 45 days, extendable where the law allows.
• Appeals. If we decline your request, you can appeal by replying to our decision. We answer appeals within the period your state's law sets; if we deny an appeal, you can contact your state's Attorney General.
• Your Privacy Choices and Global Privacy Control. The Your Privacy Choices link in the footer of pathrule.io opens the site's privacy settings. The site treats a Global Privacy Control signal from your browser as an opt-out: analytics stays off.

15.3 Canada

This section applies to individuals in Canada under the Personal Information Protection and Electronic Documents Act (PIPEDA) and provincial private-sector privacy laws, including Québec's Act respecting the protection of personal information in the private sector (Law 25).

• Accountability. The person responsible for the protection of personal information at Pathrule is Sertan Helvacı, our data protection contact, reachable at privacy@pathrule.io.
• Purposes and consent. We collect, use and disclose personal information for the purposes in Section 3. Using the Service you sign up for relies on your consent to the processing needed to provide it; optional processing (website analytics, opt-in telemetry, account milestones and marketing email) relies on your express consent and is off until you turn it on. You can withdraw consent at any time, subject to legal or contractual restrictions; withdrawing may mean we cannot provide part of the Service.
• Processing outside Canada. Personal information is stored and processed outside Canada, in Türkiye, the European Union, the United States and on Cloudflare's global network (Sections 5 and 6), and may be accessible to the courts, law enforcement and national security authorities of those jurisdictions.
• Your rights. You can ask to access and correct your personal information and withdraw consent. In Québec you can also ask for your computerised personal information in a structured, commonly used technological format, ask us to stop disseminating it or to de-index it where the law provides, and be informed when a decision about you is based exclusively on automated processing.
• Requests and complaints. Email privacy@pathrule.io; we answer within 30 days. You can complain to the Office of the Privacy Commissioner of Canada or, in Québec, to the Commission d'accès à l'information.
• Marketing email. We send marketing email only with your express consent, identify ourselves in every message and include an unsubscribe link (Canada's Anti-Spam Legislation).

Questions about this Policy? Email privacy@pathrule.io.