Privacy Policy & Data Processing Invariant
Effective Date: October 10, 2026 • Domain: www.maskcode.qd.je • Entity: MaskCode AI Inc.
1. Core Privacy Invariant: Zero Data Retention
At MaskCode AI Inc. ("MaskCode", "we", "us", or "our"), our foundational technical principle is Zero Data Custody. We believe developers should never be forced to choose between the cutting-edge reasoning of Anthropic Claude 5.5 frontier models and the privacy of their proprietary source code, credentials, and customer data.
Summary of Our Core Guarantees:
- We do NOT store or train on your source code: Your code is sanitized locally via Tree-Sitter AST WebAssembly parsers on your own workstation.
- Zero Secret Transmission: Plaintext API keys, passwords, database URIs, and PII are replaced with synthetic deterministic tokens prior to upstream transmission.
- Anthropic Commercial API Zero Retention: All requests to Anthropic models enforce
X-Anthropic-Data-Retention: zero. Anthropic does not train foundation models on your prompts or completions. - Ephemeral Local Rehydration: Mapping dictionaries reside exclusively in ephemeral local memory and are discarded upon completion.
2. Information We Collect
Because of our client-side architecture, we collect minimal operational information:
- Account & Registration Details: When you request an enterprise pilot or register for a team account, we collect your work email address, company name, and team size.
- Telemetry & Usage Aggregates: Anonymized count of tokens processed and high-level execution latencies to monitor system uptime and health. No source code or AST nodes are included in telemetry.
- Web Traffic & Cookies: Standard Cloudflare edge telemetry (IP address, user-agent, country code) strictly for DDoS mitigation and performance optimization.
3. European Union GDPR Compliance (Articles 13, 14, and 28)
Under GDPR, MaskCode AI acts as a Data Processor on behalf of the customer (Data Controller). Because personal identifiable data (PII) is masked locally before any external transmission occurs, no personal data crosses international borders without explicit tokenized pseudonymization. Customers may execute our standard Data Processing Addendum (DPA) with Standard Contractual Clauses (SCCs).
4. Sub-processors and Cloudflare Infrastructure
Our public portal and edge proxy are hosted via Cloudflare Pages and Workers. Upstream model inferences are dispatched directly to:
- Anthropic, PBC: Frontier LLM inference (Claude 5.5 Sonnet, Claude 5.5 Haiku) under zero-retention commercial terms.
- Cloudflare Inc.: Global Edge CDN, DDoS protection, and SSL termination.
5. Data Subject Rights & Contact
You maintain full rights to access, rectify, or erase your account data under applicable global privacy legislation. For inquiries or data deletion requests, contact our Data Protection Officer at:
Email: privacy@maskcode.qd.je
Official Domain: https://www.maskcode.qd.je