Privacy Policy

The Service collects only the following categories of personal data:

• Account email — provided when you create an account, stored in Supabase auth, used to identify your account and to send transactional emails (sign-in links, billing receipts, security notifications).
• Beta invite code — the redeemed invite code is recorded against your profile so we can attribute beta cohorts and revoke access if necessary.
• Local diagnostics — when you opt in at first launch, the desktop app writes structured event logs to ~/.rada/diagnostics/rada-events.jsonl. These logs stay on your device and are never uploaded by Rada unless you explicitly attach them to a support ticket.
• cloud_request_completed events — for authenticated users who have opted into cloud telemetry, metadata about completed cloud LLM requests (model id, token counts, timestamp, latency, opaque request id) is synced to Supabase to support quota accounting and billing reconciliation. Prompt and response content are not included.
• Sentry crash and error events — application stack traces, breadcrumbs, OS and app version metadata, and an anonymous installation id, transmitted to Sentry (EU region) for defect diagnosis.
• Billing data — handled by Creem; we receive only a customer reference, subscription tier, and invoice metadata.

We have designed the Service so that the following categories of information do not leave your device through any Rada-operated channel:

• The text of your prompts.
• The contents of your source code or repositories.
• The contents of any file Rada reads from your filesystem.
• The text of any model output (cloud or local) generated for you.

Cloud requests forwarded through OpenRouter are subject to OpenRouter's own terms, but Rada does not retain a copy of the prompt or output content after the request completes.

We rely on the following sub-processors. Each processes personal data only on documented instructions from Rada and is bound by a data-processing agreement.

• Account records are retained for the lifetime of your account and for up to ninety (90) days after closure to handle billing reversals and legal obligations.
• cloud_request_completed events are retained for thirteen (13) months from the date of the event, then aggregated and deleted.
• Sentry events are retained for ninety (90) days under our Sentry plan and then automatically purged.
• Local diagnostics remain on your device and are rotated according to your local disk policy; you can delete them at any time.
• Billing records retained by Creem are kept according to applicable tax and accounting law (typically seven years in Estonia).

Because Rada is operated by an Estonian entity and offers its Service to individuals in the European Economic Area, the General Data Protection Regulation applies. You have the right to:

• Access the personal data we hold about you and obtain a copy.
• Rectify inaccurate or incomplete personal data.
• Erasure ("right to be forgotten") of personal data, subject to legal retention obligations.
• Data portability — receive your data in a structured, commonly used, machine-readable format.
• Object to processing based on our legitimate interests, including telemetry processing.
• Withdraw consent for any processing that relies on consent (e.g. opted-in cloud telemetry), at any time and without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, contact privacy@userada.dev. We will respond within thirty (30) days.

If you believe we have not handled your personal data in accordance with applicable law, you have the right to lodge a complaint with your local supervisory authority. Rada's lead supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), aki.ee/en.

We may update this Privacy Policy from time to time. Material changes will be communicated by email to active accounts at least thirty (30) days before they take effect. The "Last updated" date at the top of this page indicates when the policy was most recently revised.