Privacy Policy

This Privacy Policy applies to the Azemax Studio web application (the "Service"), an AI-assisted code editor and development environment, and to any related pages we operate. It describes how we handle personal information when you visit the Service, create an account, write and run code, use AI features, or contact us.

Effective date: October 18, 2026. Last updated: October 18, 2026. This policy replaces any earlier version.

By using the Service you acknowledge this policy. If you do not agree with it, do not use the Service. This policy does not create contractual rights beyond those described here, and it should be read together with our Terms of Service.

"Azemax Studio", "we", "us", and "our" refer to the independent developer project that builds and operates the Service. The Service is published at https://www.azemax.com. For the personal information described in this policy, we act as the data controller (or the equivalent role under applicable law).

We are currently an independent project rather than a registered company, and we do not publish a corporate registration number or postal address. We deliberately do not state a country of establishment here because none is asserted by this document. If that changes, this policy will be updated.

For any privacy question, request, or complaint, contact azemaxhq@gmail.com. This is the fastest route and the only contact channel we currently operate.

We collect only the categories the Service actually uses. In broad terms these are: account information, the content you create in the workspace, the input you send to AI features, and limited technical information needed to run and protect the Service.

• Account information: your email address, an optional display name, an optional profile photo URL, your account identifier, the sign-in method you used, whether your email is verified, and account timestamps (created, updated, last sign-in).
• Workspace content: the projects, folders, files, and file contents you create or open in the editor, together with project and activity timestamps.
• AI feature input: the prompts, questions, code snippets, selected text, filenames, and project context you submit to AI features.
• Chat history: the AI conversations you conduct in the Service, including your messages and the responses you receive.
• Technical information: request metadata such as the HTTP method, path, response status, and latency; error diagnostics; and, transiently, your IP address, which we use only as an in-memory key for abuse and rate limiting.
• Support correspondence: anything you choose to send us by email, including your email address and the content of your message.

We do not ask for, and do not intend to collect, special categories of personal data, payment card data, government identifiers, biometric data, or precise location data. Please do not send us this information.

You may create an account or sign in with Google. Google sign-in is optional: an email and password account is always available as an alternative. If you use Google, we receive your basic profile information through that sign-in.

• What we receive: your email address, your name (display name), your Google profile picture URL, an assertion that Google has verified your email address, and a unique account identifier used to link your account.
• What we do not receive: we request only the basic "profile" and "email" sign-in scopes. We do not request or receive access to your Gmail messages, Google Drive files, Google Contacts, Google Calendar, Google Photos, or any other Google service data.

We use this information only to create and authenticate your account, to display your name and avatar in the interface, to confirm that your email is verified so the workspace can open, and to keep your account secure. We do not use Google profile information for advertising or profiling, and we do not sell it. Because Google has verified the address, a Google sign-in does not require a separate email verification step.

Google's own handling of your information is governed by Google's privacy policy and the permissions you grant on the Google account screen. We receive information from Google only after you grant it, and you can revoke the app's access at any time in your Google Account permissions.

If you register with an email address and password, the credentials are created and verified by our authentication provider, Firebase Authentication (a Google service).

• We do not store or see your password. Password creation, hashing, verification, and storage are handled by Firebase, not by the Service.
• We store your email address, an optional display name, and account status fields (email verified, sign-in provider, timestamps) in our own database.
• We receive a short-lived identity token from Firebase that we use to authorise your requests. On the Service, this token is held in memory in your browser and is not written to a cookie or to browser storage by us. It is presented to our API in an HTTP header.
• Email verification: until a signed-up email address is verified, the workspace and the product APIs remain locked. You can resend the verification email or confirm verification in the interface.
• Password reset and account recovery are handled through Firebase by email.

The Service offers AI-assisted features such as chat, code generation, explanation, fixing, refactoring, and inline suggestions. To produce a response, these features send your input to an external AI provider.

• What may be transmitted: your prompt or question, the code you select or reference, the contents of the file or files in context, file names, a description of your file tree, and relevant parts of the current conversation.
• Why: this information is necessary to generate, explain, or modify code and to keep the conversation coherent. It is the substance of the request.
• Limits: context is trimmed to fit the provider request; for example, the number of messages, the characters per file, and the total context size are capped by the application.

Your workspace content belongs to you. This section explains what happens to it technically, not who owns it.

• While you are signed in, your workspace file tree and file contents are stored in your browser (browser storage) so the editor survives a reload, and are also synced to our servers so your workspace can follow you between devices.
• AI-generated code and other AI output are added to your workspace only when you apply or accept them. Once applied, they are treated as part of your content.
• Code you run through the execution feature may be transmitted to a third-party execution sandbox (see "How code execution works" below).
• AI conversations are stored in your browser and, when you are signed in, synced to our servers as part of your account state.

We do not use your source code or prompts to train our own AI models, and we do not operate our own model-training pipeline. We cannot state what a third-party AI provider does with data it receives; that is governed by the provider's own terms (see "Third-party AI providers").

• Server request logs: each API request is logged with the method, path, response status, latency, and (when signed in) an internal user identifier. We do not log request bodies, the content of your prompts, or your source code in these access logs.
• IP addresses: your IP address is used in memory to rate-limit abusive traffic and to cap concurrent sessions. It is not written to our application logs and is not retained as a stored identifier by the Service.
• Error diagnostics: when a request fails, we may record the route, status, and error message (not the payload) to diagnose the fault.
• Browser storage: the Service uses browser local storage for your workspace, settings, chat history, terminal metadata, layout preferences, and analysis history. Most of this is namespaced per account. It stays in your browser until you clear it or the Service overwrites it.
• Cookies: the Service does not set its own cookies for tracking or analytics. Our authentication provider (Firebase) may use its own browser storage to keep you signed in; that mechanism is provided by Firebase.
• Third-party scripts: the code editor component and web fonts may be loaded from a public content delivery network, which necessarily receives your IP address and user agent as part of serving those files.

Details of cookie-equivalent technologies and how to clear them are in "Cookies and similar technologies" near the end of this policy.

• To create your account, authenticate you, verify your email, and keep you signed in.
• To provide the core features: editing, file and project management, AI assistance, code execution, and the terminal.
• To sync your workspace, settings, and conversations across your devices when you are signed in.
• To keep the Service secure and available, including rate limiting, abuse prevention, and fault diagnosis.
• To respond to your support requests and to send you service and account messages.
• To understand aggregate usage (such as counts of AI requests and executions per day) in order to apply fair-use limits and operate the Service.

We do not sell your personal information, we do not use it for behavioural advertising, and we do not build advertising profiles.

When you use an AI feature, the Service constructs a request on our server and forwards it to a configured AI provider. The API keys for these providers are held on our server and are never sent to your browser.

• The Service may select a provider and may fall back to another configured provider if the first is unavailable, rate-limited, or errors.
• We do not log the full contents of AI requests or responses in our server logs; we log provider, model, latency, and token/usage counters.
• We do not operate a separate archive of your raw AI requests beyond the conversation history that is part of your account state and browser storage.
• Whether a provider retains, reviews, or trains on a request is governed by that provider. We cannot promise a particular provider behaviour, so we do not.

The Service can route AI requests to one or more of the providers below. Which of them are active depends on how a given deployment is configured: a provider is only used if the operator has supplied credentials for it. When several are configured, requests are attempted in a priority order and may fall back.

• NVIDIA (build.nvidia.com): primary configured provider for AI requests.
• Groq (groq.com): configured fallback provider.
• OpenRouter (openrouter.ai): configured fallback provider, which itself routes to underlying model hosts.
• Hugging Face (huggingface.co): configured fallback inference provider.
• Kilo Code (kilocode.ai): configured fallback provider.

Each of these providers is an independent controller of the data it receives and applies its own privacy and retention terms. OpenRouter in particular may forward requests to further model providers. If you need certainty about a specific provider's retention or training practices, review that provider's current terms before submitting sensitive content, or avoid using AI features for that content.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In practice this means:

• We request only the basic profile and email scopes needed to identify you and to confirm your email address.
• We use that information only to provide and improve user-facing features (sign-in, account creation, and displaying your account), and to keep the Service secure.
• We do not sell Google user data, we do not use it for advertising, and we do not use it to train AI models.
• We do not transfer Google user data to third parties except as necessary to provide the Service, to comply with the law, or as part of a merger or acquisition, and never for the purposes just listed.
• We do not allow humans to read your Google data except with your explicit consent, where necessary for security or to comply with law, or where the data has been aggregated and anonymised.

You can revoke Azemax Studio's access to your Google account at any time from your Google Account's third-party app permissions. Revoking access prevents future Google sign-ins; it does not by itself delete your Azemax Studio account. To delete your account, see the next section.

We keep information only as long as it is needed for the purposes described above. Where the Service has a clear deletion control, we describe it. Where a fixed retention period is not configured, we say so rather than inventing one.

• Account and authentication records: retained while your account is active, and until a deletion request is completed. There is no automatic expiry timer. See "Account and data deletion".
• Projects and workspaces: retained until you delete the project in the Service or delete your account. Deleting a project removes it from your account.
• AI conversations and settings: retained locally in your browser, and on our servers while you are signed in, until you delete the conversation or clear your chat history in the Service, or delete your account.
• Aggregate usage counters: per-day counters of AI requests, tokens, and executions are retained to enforce fair-use limits.
• Access and error logs: kept on the hosting platform for operational and security purposes. We do not currently configure a fixed log-retention schedule; retention is subject to the hosting provider’s defaults.
• Browser storage: remains on your device until you clear site data. Signing out does not necessarily erase it.
• Third-party and provider records: any copies held by Firebase, an AI provider, the execution sandbox, or the hosting provider are governed by that provider’s retention policy, which we do not control.

You can delete individual content at any time: delete projects and files in the workspace, delete conversations in the assistant, and clear your chat history. You can also clear the data stored in your browser by clearing site data for the Service.

Full account deletion. Self-service account deletion is not yet implemented in the Service. Until it is, you can request deletion by emailing azemaxhq@gmail.com from the address associated with your account, with the subject "Account deletion". We will verify the request and delete your account record and associated server-side content from our active database.

• Please allow a reasonable period for us to action a request; deletion is currently performed manually.
• Deleting your Azemax Studio account does not automatically delete your Firebase authentication record. Ask us in the same email if you want that removed too, or use your Google account settings to revoke access.
• Copies held by third-party providers (AI providers, the execution sandbox, hosting platform) are subject to those providers’ own deletion processes.
• Records we must keep to comply with a legal obligation, or to resolve a dispute, may be retained for as long as required.

We apply reasonable technical measures, including: authentication through Firebase with server-side verification of every identity token; verification that a user owns the projects and account state they request; server-side API keys that are never exposed to the browser; size and rate limits on requests; and running user programs with a restricted environment rather than the application's own credentials.

No service is perfectly secure, and we make no guarantee that unauthorised access, loss, or disclosure cannot occur. In particular:

• Data you intentionally submit to an AI feature is transmitted to a third party by design; this is an inherent disclosure, not a breach.
• Interactive shell and local execution features, when enabled by a deployment operator, run code on that operator’s host with limited isolation. This is disabled by default in production.
• You are responsible for the security of your own device, browser, and credentials.

We do not hold any security certification (for example ISO 27001 or SOC 2) and we do not claim compliance with any standard we have not independently verified.

We do not sell your personal information. We share it only as needed to run the Service, and only in the following circumstances:

• AI providers: the input described in "Information you submit to AI features" is sent to the selected provider to produce a result.
• Execution sandbox: code and input you choose to run may be sent to a third-party sandbox service, which executes and returns the result.
• Authentication and hosting: Firebase processes authentication, and our hosting provider processes requests on our behalf.
• Content delivery: a public content delivery network serves the editor component and fonts, receiving your IP address to deliver the files.
• Legal and safety: we may disclose information if required by law, to enforce our terms, or to protect the rights, safety, and security of users or the public.
• Business transfer: if the project is transferred to a successor, information may transfer as part of that transition, subject to this policy.

We do not share Google sign-in data with advertisers or data brokers.

The Service and its providers may process and store information in countries other than the one you live in, including the United States, where many AI and cloud providers operate. This means your information may be transferred to, and processed in, a jurisdiction with different data-protection rules than your own.

Where we are required to do so, we rely on appropriate safeguards for such transfers, such as the provider's contractual commitments and standard data-protection terms. Because we do not currently assert a specific establishment or a specific transfer mechanism for every provider, you should treat this section as a description of how the Service is built rather than as a certification of any particular adequacy mechanism.

The Service is a developer tool and is not directed to children. You must be at least 13 years old to use it. Where the law of your country requires a higher age for you to consent to online services on your own behalf (for example, some countries require parental consent up to a higher age), that higher age applies and you may only use the Service with the involvement of a parent or guardian.

We do not knowingly collect personal information from children below the applicable minimum age. If you believe a child has provided us with personal information, contact azemaxhq@gmail.com and we will take steps to delete it.

Depending on where you live, you may have rights over your personal information, which can include the right to:

• access the personal information we hold about you;
• correct information that is inaccurate;
• delete your information (see "Account and data deletion");
• restrict or object to certain processing;
• receive a portable copy of information you provided; and
• withdraw consent where processing is based on consent.

You can exercise many of these directly in the Service (edit your profile, delete projects, delete conversations, clear chat history). For anything else, contact azemaxhq@gmail.com. We will respond within the time required by applicable law. We will not discriminate against you for exercising a privacy right.

To the extent that our legal basis is legitimate interests, you may object; to the extent it is consent, you may withdraw it at any time without affecting processing already carried out.

Where you live may give you specific rights under local law. This section summarises how the general rights above apply in commonly relevant frameworks. It is a good-faith summary, not legal advice, and it does not override any mandatory rights you have.

• EEA, UK, and Switzerland (GDPR / UK GDPR): you have the rights listed above, plus the right to lodge a complaint with your local supervisory authority. Our legal bases are performance of a contract (providing the Service), legitimate interests (security, abuse prevention, service operation), and consent where required.
• California (CCPA/CPRA): you have rights to know, delete, correct, and opt out of the "sale" or "sharing" of personal information. We do not sell personal information and we do not share it for cross-context behavioural advertising. We do not use or disclose sensitive personal information for purposes requiring a limitation right.
• Other US state privacy laws: where a state privacy law applies, we honour the equivalent rights to access, delete, correct, and opt out of targeted advertising and profiling. We do not conduct targeted advertising or profiling.
• Brazil, Canada, Australia, and others: we will honour access, correction, and deletion requests in line with the local framework that applies.

If you are unsure which framework applies to you, contact azemaxhq@gmail.com and describe your request; we will treat it as broadly as we reasonably can.

We send transactional and service emails that are part of operating your account, for example: email verification, password reset, and important notices about the Service or these policies. These are not marketing and are not sent unless they are needed for your account or required by law.

We do not currently operate a marketing newsletter. If we introduce optional product emails, we will ask for consent where required and provide a way to opt out. You can always contact azemaxhq@gmail.com to ask about the messages you have received.

The Service does not set tracking cookies and does not use cookie-based third-party analytics. It relies on browser local storage to remember your workspace, settings, chat history, terminal state, and layout, most of which is scoped to your signed-in account.

• Our authentication provider may store a small amount of data in your browser to keep you signed in; this is a functional, first-party-to-your-session use, not advertising.
• Loading the code editor component and fonts from a public content delivery network may set nothing in your browser but does disclose your IP address to that network.
• You can clear all browser storage for the Service at any time through your browser settings. Doing so removes your locally cached workspace and conversations and may sign you out.

Because there are no advertising or analytics cookies, we do not operate a cookie consent banner for them. If that changes, we will update this section and, where required, ask for consent first.

We may update this policy as the Service changes or as the law requires. When we do, we will revise the effective date and the "last updated" date at the top, and, for material changes, we will take reasonable steps to notify you (for example, in-app or by email).

Continued use of the Service after an update means you accept the revised policy. If you do not agree, stop using the Service and, if you wish, request account deletion.

For any privacy question, request, or complaint, contact azemaxhq@gmail.com. We aim to respond promptly and within any period required by applicable law.

You can also reach us for security reports at the same address. See our Terms of Service for the rules that govern use of the Service.