Privacy Policy.
Effective date: 15 September 2026
This Privacy Policy explains how Gaja AI Private Limited (“Gaja AI,” “we,” “us”) handles personal data in connection with the SuperBased software (the “Software”), the website at superbased.app, the optional hosted Cloud Intelligence service at cloud.superbased.app, and any optional Teams & Enterprise services (collectively the “Services”).
- The Software is local by default and stays that way. Installing and running it sends us nothing.
- If you choose to sign in to the optional hosted Cloud Intelligence service, we receive your account identity (email, name). Nothing about your coding sessions is sent unless you separately choose to upload a specific, previewed piece of evidence.
- The website uses cookieless, first-party web analytics (section 4) - off entirely if your browser sends Do Not Track or Global Privacy Control. The hosted portal runs none at all (section 3.9).
- Beyond that, we collect data only if you contact us, subscribe to our newsletter, submit a form, or run the optional Teams server.
1. Who we are
Gaja AI Private Limited, registered in India. Contact: [email protected].
2. The Software (default local install)
When you install SuperBased from npm, PyPI, or the VS Code Marketplace and run it on your own machine:
- SuperBased captures session metadata from supported AI coding tools (Claude Code, Cursor, Codex, Copilot, and others) and stores it locally in a SQLite file at
~/.observer/observer.db. - By default, everything stays on your machine. The local install does not talk to any SuperBased server on its own. The optional local proxy on
127.0.0.1:8820only forwards traffic to the LLM provider your AI client was already calling, never to us. - The default install is telemetry-free: we collect no usage analytics, crash reports, or fingerprints from it.
- This stays true whether or not you ever sign in to the hosted service described next. Signing in changes nothing about the local install by itself - it only matters the moment you explicitly run a command that uploads something, as section 3 explains.
3. The hosted Cloud Intelligence service (optional, signed-in)
SuperBased also offers an optional hosted service reached only through the observer cloud command or the web portal at cloud.superbased.app. It is entirely opt-in - nothing in this section applies to you unless you create an account and take an explicit action. There is a free, capped tier (“Signed-in Free”) and a paid tier (“Plus”, see section 3.8 and our Refund Policy).
What stays local, always
- Sessions captured while your machine is enrolled in an organization's SuperBased Teams deployment are never eligible for the hosted service, whether or not you sign in. Our software checks organization-enrollment at the moment each session was captured; when that check can't tell either way, it treats the session as ineligible rather than guessing. This is enforced on your machine before anything is even built for upload, and checked again on our server as a second line of defense.
- Signing in by itself uploads nothing about your coding sessions. Session data is only ever built and sent when you run a command that explicitly says so - see the next section.
What we receive when you sign in
Sign-in uses WorkOS, a third-party identity provider. When you sign in, we receive your account identifier, email address, and display name from WorkOS - used only to identify your account and to show your name in the portal. No session evidence is sent as part of signing in, and we never receive your password.
What we receive only with your explicit consent
Before any session data is uploaded, the observer cloud preview command shows you the exact bytes that would be sent - what you preview is byte-for-byte what uploads. A consent receipt is bound to those exact bytes using two independent digests, one over the content and one over the final upload. If anything changes before the send - a local edit, a software update, a scrubbing-rule change - the upload stops and asks you to re-confirm rather than silently sending something different. Each upload is tied to a specific purpose you chose (for example, requesting an AI-written title and summary for one session); we never upload more than the purpose you approved covers.
How long we keep it
| Data | Retention |
|---|---|
| Temporary evidence (the uploaded bytes, before analysis) | Deleted within 1 hour of upload at the latest - whichever finishes first, analysis completing or that 1-hour clock. A retry can never extend it. |
| Analysis results (titles, tags, descriptions, weekly project digests, and any correction history) | Kept on the hosted service for 30 days on the Free plan and 12 months on Plus, counted from when the result was produced, or until you delete the result or your account, whichever comes first; the correction history of a result is removed with it. Your own device keeps its local copy of every result and digest, so nothing you see on your machine disappears; only the hosted history, corrections and export window are limited. |
| Consent records and billing history | Kept for 12 months after account deletion for accounting and dispute records, then deleted. |
| Security and deletion audit records | Kept for 24 months after account deletion, then deleted. |
| Data exports you request | Available for at most 7 days after you request them, then deleted automatically. |
Deletion and export
From the portal's Privacy & devices page (or observer cloud delete-account), you can:
- Export your data before deleting anything, as a downloadable file that expires after 7 days.
- Delete your account, which runs to completion immediately: your analysis results, uploaded evidence, devices, sessions, and community/billing links are deleted outright, and your account record is kept only as an anonymous placeholder (no name, no email) until the 12/24-month clocks above finish and remove it too.
Subprocessors
The hosted service is built and run by us, using the following subprocessors:
| Subprocessor | Purpose | Region |
|---|---|---|
| Microsoft Azure | Hosting infrastructure (compute, database, storage) for the hosted service. | United States (Azure East US 2) |
| Azure AI Foundry | Runs the AI model that produces your analysis results (titles, tags, descriptions, digests). In Microsoft's own terms, the models are stateless: what we send is not stored by the model and is never used to train, retrain or improve Microsoft's models. Microsoft's abuse-monitoring programme applies as it does to every Azure OpenAI customer: automated classifiers screen prompts and completions without storing them, and a sample of prompts and completions that those classifiers flag may be stored, in the same region, for review by authorized Microsoft employees, then deleted under Microsoft's retention rules. We applied for Microsoft's “Modified Abuse Monitoring” exemption and were declined on 14 September 2026 because our subscription is not managed by a Microsoft account team; we are pursuing that status in parallel and will update this row if the exemption is granted. Our service records, for every analysis it runs, which posture was in force. | Same region as Azure hosting, above. |
| WorkOS | Sign-in (authentication). We never receive your password. | United States (WorkOS, Inc.; processing under WorkOS's Data Processing Addendum with Standard Contractual Clauses for transfers) |
| Paddle | Payment processing for the Plus subscription. Paddle is the merchant of record and handles your card details and sales tax directly; your card number is not disclosed to us at all. | United Kingdom, European Union and United States (Paddle.com Market Ltd / Paddle.com Inc.; processing under Paddle's Data Processing Agreement) |
| Cloudflare | Network edge, DNS, and abuse protection in front of the hosted service and the website. | Cloudflare's global network. |
Billing (Paddle)
If you subscribe to Plus, Paddle collects and processes your payment details directly - we never receive or store your card number. We keep only your subscription id, plan, status, and current billing period, deleted when you delete your account. Paddle's payment notifications to us are logged for accounting and fraud-prevention purposes and kept for up to 12 months.
No portal analytics
The hosted portal runs no analytics, no tracking pixels, and loads no third-party script beyond Paddle's own checkout script (loaded only on the billing page, at the moment you choose to subscribe). The only cookie the portal sets is the session cookie needed to keep you signed in, which is why the portal needs no cookie banner.
4. The website
The pages at superbased.app serve static HTML, CSS, JS, and images, plus a privacy-lean web-analytics beacon (PostHog, EU-hosted, relayed through our own domain - no third-party request from your browser). What it means in practice:
No cookies, no fingerprinting, no cross-site tracking
A temporary session identifier lives in your tab's sessionStorage and is gone when the tab closes. We cannot recognize you on a return visit.
Honors your browser's signals
If your browser sends Do Not Track or Global Privacy Control, the analytics script never loads at all.
What we see
Pages viewed, time on page, referrer, clicks, approximate region, browser and device class - used solely to understand which content helps and where the site confuses people. Some visits may be recorded as anonymized session replays with all form inputs masked.
What web analytics never captures
Your identity, anything you type, or your activity on any other site. We do not sell or share this data; it is processed by PostHog EU (Frankfurt) as our processor.
Fonts
The site also loads Google Fonts (Space Grotesk, Press Start 2P, JetBrains Mono) over fonts.googleapis.com - Google may receive your IP for that font fetch. We do not.
5. Optional Teams & Enterprise services
If you stand up a SuperBased org server (Teams or Enterprise) and a developer points their local agent at it, the agent pushes the developer's session metadata to your org server on a schedule. We do not run that server - you (the operator) do. This is a separate deployment from the hosted Cloud Intelligence service in section 3 and does not share its accounts, consent, or data.
- Hash by default. Every content-bearing column ships only as a SHA-256 hash. Raw values are sent only if the developer's local
~/.observer/config.tomlsets[org_client.share].full_content = trueoradmin_managed = true- the latter for fleets an org admin provisions centrally. Both keys live on the developer's own machine, and the org admin cannot switch either on from the server. - Data lawful basis: legitimate interest in observability of your own AI tooling within your organization. You as the org operator are the data controller for that deployment.
6. Forms you submit (newsletter, enterprise, design-partner)
The website has three optional forms - a newsletter signup (on the homepage and at /newsletter), an enterprise contact form, and a design-partner application (both on /enterprise). If you email us directly we simply process your message and address to reply. For the forms:
What we collect, and why
| Form | What we collect | Why |
|---|---|---|
| Newsletter | Your email address only. | To send you the product changelog and occasional cost findings, on the lawful basis of your consent (double opt-in - see below). |
| Enterprise / design-partner | Your business email, and only what you choose to type - organization, approximate team size, the tools your team uses, and a short description of your need. | To respond to your enquiry and manage the sales or partnership conversation, on the lawful basis of taking steps at your request and our legitimate interest in following up on inbound interest. |
We ask you not to include secrets, credentials, or internal architecture, and we don't request them. We also capture any utm_* campaign parameters already in the page URL, so we know which content sent you.
Double opt-in
Our email service isn't live yet, so newsletter signups are held pending. When it launches you'll receive a single confirmation email; you are only added to the list after you click the link in it. You can unsubscribe from every newsletter in one click, and we suppress unsubscribed and bounced addresses.
Where it goes (the durable inbox)
Each submission is validated at our edge and written to a private Cloudflare Workers KV store (the “intake inbox”), hosted in Cloudflare's network. Our own local tooling later pulls those records over a read-scoped token into a local database, then deletes them from the inbox. Nothing you submit is exposed publicly, and no submission ever reaches a third-party marketing platform beyond the email service that will send the newsletter once it is live.
Bot defense
The forms use Cloudflare Turnstile, a privacy-preserving “are you human?” check that sets no tracking cookies and does not profile you. Cloudflare acts as our processor for the check and the durable inbox.
Retention
Inbox records are deleted from Cloudflare KV as soon as our tooling reconciles them (and in any case expire automatically within ~90 days). We keep the resulting contact/enquiry record only as long as needed to serve your request or, for newsletter subscribers, until you unsubscribe; a minimal suppression record (a hashed address) is kept after removal so we don't email you again.
No trackers, no cookies
The forms set no cookies and load no third-party analytics or advertising trackers. We do not sell, rent, or share what you submit.
7. Cookies
The website sets no cookies. The web analytics described in section 4 uses per-tab sessionStorage only - nothing persists after you close the tab, which is why the site needs no cookie banner. The hosted portal (section 3.9) sets exactly one strictly-necessary session cookie and nothing else.
The local dashboard (127.0.0.1:8081) sets only first-party functional cookies needed for the UI to remember view preferences. No tracking cookies, no third-party cookies.
8. Your rights (GDPR, UK GDPR, CCPA)
Where applicable law gives you data-subject rights (access, rectification, erasure, restriction, portability, objection, no automated decision-making, “do not sell”), you can exercise them by emailing [email protected], or, for the hosted Cloud Intelligence service, directly from the portal's Privacy & devices page (section 3.6). We respond within 30 days.
Because the default local install stores nothing on our infrastructure, in most cases the answer for someone who has never signed in to the hosted service is “we hold no data about you.”
9. Children
The Services are not directed to children under 16. We do not knowingly collect data from children under 16.
10. Security
See our Security & Privacy explainer for the technical details: source on GitHub under Apache-2.0, signed releases, SBOM + SLSA provenance attached to every binary.
11. Changes
If we materially change this Policy we will update the “Last updated” date above. Historical versions are visible in the git history of the source repository.
12. Contact
Gaja AI Private Limited - [email protected].