Privacy Policy & Security Architecture
Our comprehensive commitment to local-first computation, code confidentiality, uncompromising data protection, and transparent developer privacy.
The Phide Local-First Promise
Zero Telemetry On CodeYour proprietary source code, AST graphs, files, and Git branches remain on your physical machine. Phide executes indexing, topological dependency analysis, diff generation, and notebook computations locally. We never upload, index, or inspect your source code on remote servers.
1. Overview & Core Principles
Koda ("we", "our", or "us") develops high-performance developer software, including Koda Softwares, visual project graphs, notebook runtime engines, and package integration workflows. We believe privacy is an architectural requirement, not an afterthought.
This Privacy and Security Policy describes how personal data and technical telemetry are handled when you visit our website (koda.dev), download our desktop software, or utilize our integrated developer services.
Clear notice of all collected metrics with zero deceptive trackers.
Source code and AST graphs are parsed entirely on your workstation.
2. Local-First Code Confidentiality
When working in Koda Softwares, your source code, configuration files (e.g. .env, config.php), secret tokens, and repository histories remain your exclusive intellectual property.
- Zero Remote Code Indexing: The visual dependency graph, symbol resolution, and live search indexes operate using a local SQLite/in-memory engine located directly on your computer.
- Visual Git Diff Inspection: Branch comparisons, hunk staging, and commit drafting run through your local Git CLI binary without routing diffs through Koda servers.
- Package Manager Downloads: Pip, npm, and Composer requests connect directly to their official public or private package registries without third-party interception.
3. Data We Collect
We minimize data collection to what is strictly required to deliver, maintain, and secure our software products.
A. Web & Portal Information
When you access our website or download installers, we log standard web server logs (anonymized IP addresses, browser user agent, referral URL, and requested file path) for DDoS mitigation, capacity planning, and regional CDN routing.
B. Application Diagnostics (Strictly Opt-In)
If crash reporting is voluntarily enabled in your preferences, Phide generates an anonymized stack trace detailing the crash error code, operating system version, and IDE build number. Stack traces are automatically scrubbed of local file paths and variable contents before transmission.
C. Support & Community Communications
If you contact us via email (tribrix23@gmail.com), GitHub Issues, or our Discord server, we retain your communication history solely to answer technical inquiries and provide troubleshooting support.
4. AI & Model Training Safeguards
Our Irrevocable AI Commitment:
Koda does NOT sell, license, or utilize your private codebase, repository contents, computational notebook queries, or local edits to train public machine learning or Large Language Models (LLMs).
When utilizing optional developer integrations, requests are executed either via local on-device processing or routed strictly to your explicitly configured provider endpoints under your direct agreement.
5. Security Architecture & Encryption Standards
We employ defense-in-depth security engineering to safeguard developer infrastructure:
TLS 1.3 Encryption
All website, documentation, and download network traffic is enforced via HTTPS with TLS 1.3 and HSTS preloading.
Code Signing Verification
Phide Windows executables (.exe) are cryptographically signed with trusted digital certificates to guarantee binary integrity.
Process Sandboxing
Notebook execution cells run under isolated child processes with restricted privilege boundaries.
Zero Third-Party Ad Brokers
We never sell personal information to data brokers, advertising networks, or monetization consortiums.
7. Your Global Privacy Rights (Philippines DPA, GDPR, CCPA, & Worldwide)
Regardless of your citizenship or geographic location, Koda is committed to upholding the highest international standards of data protection, personal dignity, and algorithmic transparency. We afford enforceable statutory rights aligned with leading global privacy frameworks:
Philippines: Data Privacy Act of 2012 (Republic Act No. 10173)
As Koda’s core engineering and leadership originate in the Philippines under the stewardship of John David L. Perez (Tribrix23), we strictly adhere to the provisions of Republic Act No. 10173, its Implementing Rules and Regulations (IRR), and all circulars promulgated by the National Privacy Commission (NPC). Under Philippine law, every data subject is entitled to the following statutory rights:
European Union & United Kingdom (EU GDPR & UK Data Protection Act 2018)
Articles 15-22 GDPRResidents of the EEA and United Kingdom benefit from full statutory rights under Articles 12 through 23 of the GDPR:
- Right of Access (Art. 15): Obtain confirmation as to whether your personal data is being processed, and receive a free export.
- Right to Rectification (Art. 16): Correct inaccurate personal data without undue delay.
- Right to Erasure / Forgotten (Art. 17): Request deletion when data is no longer necessary or consent is withdrawn.
- Right to Restriction of Processing (Art. 18): Restrict the processing of your data under contested circumstances.
- Right to Data Portability (Art. 20): Transmit your records to another controller in a structured JSON format.
- Right to Object & Automated Decisions (Art. 21 & 22): Right not to be subject to decisions based solely on automated profiling.
- Right to Lodge a Complaint (Art. 77): Escalate issues to your national EU Data Protection Authority or the UK ICO (ico.org.uk).
United States: California (CCPA/CPRA) & State Privacy Acts
Cal. Civ. Code § 1798.100+For users residing in California, Virginia, Colorado, Connecticut, Utah, and other US jurisdictions:
- Right to Know & Access: Learn what categories of personal information we collect, sources, commercial purposes, and third parties.
- Right to Delete: Request permanent deletion of personal data collected directly from you.
- Right to Correct: Direct us to correct inaccurate personal information.
- Do Not Sell or Share: We do not sell or share personal information for cross-context behavioral advertising.
- Right to Non-Discrimination: We never charge different rates or deny features for exercising legal rights.
Other International Jurisdictions (Asia-Pacific, Americas, Global)
How to Exercise Your Rights
To exercise any of the statutory rights described above, contact our designated Data Protection Officer at tribrix23@gmail.com with the subject line "Privacy Rights Request". We verify identity through your account credentials and respond within 30 days without imposing any processing fee.
8. Third-Party Services & Git Remotes
Phide interacts with external developer platforms only upon your explicit direction:
- Git Remotes (GitHub, GitLab, Bitbucket): When you perform
git pushorgit pull, credentials are exchanged directly with the target host via SSH or personal access tokens securely stored in your OS credential vault. - Public Registries (PyPI, npm, Packagist): Direct SSL connections are opened to fetch package metadata and tarballs.
9. Data Retention & Deletion Process
Diagnostic logs are automatically rotated and permanently purged within 30 days. Web server access logs are retained for a maximum of 90 days for network abuse defense. To request manual account deletion or verified data removal, contact our data protection officer directly.
10. Contact & Security Reporting
If you have questions regarding this policy or wish to report a security vulnerability, please reach out to our team:
John David L. Perez (Tribrix23)
Lead Developer & Security Administrator