Coda

Coda Privacy Policy

Effective Date: October 21, 2026

This Privacy Policy describes how OpenEvidence Inc. ("OpenEvidence", "we", "us") processes personal information through Coda, including the Coda account website, the Coda desktop app, the Coda phone apps, the Coda model provider, cloud looms and the integrations Coda offers (collectively, the "Service").

This Privacy Policy does not apply to information that we process through the OpenEvidence platform or our other offerings. The Coda Chrome extension has its own policy at /privacy/chrome.

Coda is software that runs AI agents. Most of what your agents do happens on your own computer, in the Coda app and its local engine (a "loom"). We receive only the information this Privacy Policy describes.

Personal information we collect

Information you provide to us. Personal information you may provide to us includes:

  • Contact data, such as your name and email address.
  • Account data, such as the credentials you set to establish an account on the Service (we store passwords only in hashed form), the Google account you sign in with (we ask Google only for your name, email address and profile), your organization and role in it, and the services you have purchased.
  • Payment data needed to complete transactions, including payment card information, which is collected and processed directly by Stripe. We do not receive or store your card number.
  • Communications data based on our exchanges with you, including when you contact us through the Service or by email.
  • User content, including prompts and other content your agents send to the Coda model provider, and the files and content you keep in cloud looms. When your loom uses the Coda model provider, we pass your calls to the AI model provider that runs the model and return its answer to you; we do not log the content of those calls.
  • Other data not specifically listed here, which we will use as described in this Privacy Policy or as otherwise disclosed at the time of collection.

Information we collect when you use the Service.

  • Usage records. For each call to the Coda model provider we record identifiers, the model used, token counts, cost, status and times, so that we can bill you and show you your usage. We do not record your prompts or the model's answers.
  • Linked looms. For each loom linked to your account, we record its name, its computer's name, and when it was first and last seen, so that the website can list them for you.
  • Sessions. We keep a record of each signed-in session, which ends when you sign out or after 30 days without use.
  • Automatic data collection. We and our service providers may automatically log information about you, your computer or mobile device, and your interaction with the Service, such as device data (for example, IP address) and approximate location inferred from it. This information is collected by first-party cookies, local storage and similar technologies.

Organizations. If you belong to an organization on Coda, its owners and admins can see its members and each member's spending, and the organization's audit log keeps members' email addresses.

Phone apps. The Coda phone apps open Coda's web app and collect nothing of their own: they contain no analytics, advertising or tracking software. The key that pairs your phone with your computer stays on your device. Notifications are encrypted end to end by your own computer and delivered through Apple's or Google's push service, which can see only delivery information (which device, when, and the size of the message), not its content.

Desktop app usage and crash reports. Unless you turn them off in the app's Settings, the Coda desktop app sends us counts of which features you use and reports of crashes, tied to a random identifier for your installation rather than to your account. They never include your prompts, messages, model answers, code or files, and we do not keep the IP address they come from. We keep them in our own systems for 90 days. The usage counts are also sent to Mixpanel, which keeps them for as long as our Mixpanel account's data retention allows. Turning the reports off deletes the identifier.

Integrations. If you connect Coda to Slack or GitHub, the access you grant is kept on your loom, and your loom communicates with Slack or GitHub directly, not through OpenEvidence.

How we use your personal information

We may use your personal information for the following purposes or as otherwise described at the time of collection:

Service delivery and operations. We may use your personal information to provide and operate the Service, including processing your requests, billing you, communicating with you (such as sign-in, verification, password reset and billing emails), and fraud prevention and security.

Compliance and protection. We may use your personal information to comply with applicable laws and government requests, audit our internal processes, enforce the terms that govern the Service, and prevent or mitigate fraud or illegal activity.

With your consent. In some cases, we may specifically ask for your consent for certain activities.

How we share your personal information

We may share your personal information with the following parties and as otherwise described in this Privacy Policy, in other applicable notices, or at the time of collection:

Service providers. Third parties that provide services on our behalf or help us operate the Service or our business, including Google Cloud (hosting, databases and cloud looms), Vercel (hosting the website), Resend (sending email) and Mixpanel (product analytics on the desktop app's usage counts, never its crash reports).

Payment processors. Any payment card information you use to make a purchase on the Service is collected and processed directly by Stripe and is subject to Stripe's Privacy Policy.

Artificial intelligence platforms. We use third-party artificial intelligence (AI) providers, including Anthropic, OpenAI and Google, to run the models available through the Coda model provider. To learn more about how those providers process your information, please refer to their applicable terms and privacy policies.

Professional advisors, where necessary in the course of the professional services that they render to us.

Legal or business authorities. We may be obligated to disclose personal information to law enforcement, government authorities, and private parties in litigation, as we believe in good faith to be necessary or appropriate for the compliance and protection purposes described above, as well as to entities such as acquirers, successors, or assignees as part of a merger, acquisition, sale, or similar transaction, and/or in the event of an insolvency, bankruptcy, or receivership in which personal information is transferred to one or more third parties.

Your choices

In this section, we describe the choices available to you. We will honor any additional rights conferred on you by your local privacy law.

Access, update, or delete your information. You may review and update your account information by signing in to your account. You may delete your account at any time from your profile page; deleting it signs you out everywhere, revokes your keys and ends your cloud looms. After an account is deleted we keep billing records, records linked to your former account that we keep for fraud prevention (including your Google account identifier), your organization's audit log, and usage records.

Cookies. Most browsers let you remove or reject cookies. For more information about cookies, visit http://www.allaboutcookies.org.

Retention

We generally retain personal information to fulfill the purposes for which we collected it, as described above. When we no longer require the personal information we have collected about you, we will delete it. When a cloud loom ends (or 30 days after Coda Pro ends), we delete it and its conversations and files; deleted data can be recovered from our backups for up to 7 days, then it is gone. You can also request deletion of your personal information and user content.

Other sites and services

The Service may contain links to, or connect to, websites, mobile applications, and other online services operated by third parties, such as payment processors, model providers you configure yourself, Slack and GitHub. We do not control websites, mobile applications or online services operated by third parties, and we are not responsible for their actions. We encourage you to read the privacy policies of the other websites, mobile applications and online services you use.

Security

We employ technical, organizational and physical safeguards that are designed to protect the personal information we collect. However, security risk is inherent in all Internet and information technologies, and we cannot guarantee the security of your personal information.

International data transfer

We are headquartered in the United States and may use service providers that operate in other countries. Your personal information may be transferred to the United States or other locations where privacy laws may not be as protective as those in your state, province, or country.

Changes to this Privacy Policy

The "Effective Date" at the top of this Privacy Policy indicates when it was last revised. We reserve the right to modify this Privacy Policy at any time. Any modifications to this Privacy Policy will be effective upon our posting.

How to contact us

Email: support@coda.ai

Mail: OpenEvidence Inc., 215 NW 24th St., Suite 300, Miami, Florida 33127