Privacy Policy

ClawIDE is made by David Daniel / Aeroxis (“we”, “us”). This policy covers three separate things, which are worth keeping apart because they behave very differently:

1. This website, www.clawide.app.
2. The ClawIDE app — the binary you install and run on your own hardware.
3. Buying a license, which involves our license server at api.clawide.app.

Your use of the software itself is governed by the EULA.

The short version

• The app on your machine sends us no usage data, no analytics, and no telemetry. There is no event tracking, no crash reporter and no analytics SDK in the binary.
• Your code, terminal sessions, prompts, notes, tasks and API keys never reach us. They stay in ~/.clawide on your machine.
• This website uses Google Analytics and, for advertising, the Reddit Pixel. Both only load if they are configured at build time, and both are blocked by any normal content blocker.
• Buying a license means giving Stripe your payment details and giving us your email address.
• We do not sell personal data, and we have no CRM, no marketing automation and no mailing list.

1. This website

Analytics. We use Google Analytics 4 to count pageviews and a few funnel events: copying the install command (install_command_copied), clicking a buy button (checkout_started) and switching the monthly/annual pricing toggle (pricing_toggle_changed). These record what was clicked and where on the page it was, not who you are. GA sets its own _ga cookies and derives an approximate location from your IP address.

When you click a buy button, we append your GA client and session ids to the checkout link so that a completed purchase can be joined to the visit that produced it. These ids are pseudonymous — they identify a browser, not a person.

Advertising. When we are running Reddit ads, this site loads the Reddit Pixel, which records a page visit, an event when you copy the install command, and an event when you click a buy button. Reddit sets its own cookies (_rdt_uuid, _rdt_cid). If you arrive from a Reddit ad, Reddit adds a click id (rdt_cid) to the landing URL, and we store it in a first-party cookie called clawide_rdt_cid for 28 days so that a later purchase can be attributed to that ad.

Fonts. Every page loads Plus Jakarta Sans and IBM Plex Mono from Google Fonts. This happens on every visit, whether or not analytics is enabled, and it discloses your IP address and user agent to Google.

Server logs. The site and the license server run on Heroku, which keeps standard request logs (including IP addresses) for a short period as part of operating the service.

Apart from clawide_rdt_cid, this website sets no cookies of its own and uses no local storage.

2. The ClawIDE app on your machine

ClawIDE is self-hosted. It runs on your hardware, stores everything in ~/.clawide, and we have no access to any of it. Notes, bookmarks, scratchpads, tasks, terminal scrollback, session state, gateway API keys and tracker tokens are all local files. The usage analytics screen inside ClawIDE reads your local Claude Code transcripts and renders them locally; nothing is uploaded.

We deliberately did not build product telemetry. We cannot see how many people install ClawIDE, which features they use, or whether a trial converts.

The app makes exactly these automatic outbound requests:

• Update check. Once 30 seconds after start and then every 24 hours, ClawIDE fetches a release manifest from GitLab, where the binaries are published. The request carries no identifier beyond your IP address and a ClawIDE/<version> user agent — no licence key, no machine id, no hostname. We do not operate that server and do not receive its logs; GitLab sees the request. You can turn this off with the auto_update_check setting in Settings, and it is disabled automatically inside Docker and for development builds.
• License revalidation. If — and only if — you have activated a license, ClawIDE revalidates it against api.clawide.app every 24 hours. See the next section for exactly what is sent.
• Cloud seat sync. If — and only if — you are signed into a ClawIDE Cloud (Team) organization, ClawIDE refreshes your seat status every 24 hours using your session token.

If you use the free tier and never activate a license, the update check is the only automatic request ClawIDE makes.

Two things are worth calling out because they involve third parties:

• The bookmark bar shows a site icon for each bookmark by loading it from Google’s favicon service. This means the hostname of each bookmark is disclosed to Google when the bookmark bar renders.
• The web interface loads a few libraries (Markdown rendering, syntax highlighting, diagrams, the emoji picker) from the jsDelivr CDN, which sees your IP address.

Anything else ClawIDE talks to is something you configured yourself — your model gateway, your Linear/Jira/GitHub tracker, an MCP server you pointed it at. Those requests go directly from your machine to that provider under your own credentials, and we are not in the middle.

3. When you buy a license

Payment is handled entirely by Stripe on Stripe’s own checkout page. We never see or store your card number.

When a purchase completes, Stripe notifies our license server and we store:

• your email address and Stripe customer id;
• your plan, billing interval, subscription id, status and renewal date;
• your license key;
• one machine identifier per activated machine, plus activation and last-seen timestamps;
• the raw notification Stripe sends us, which is kept as received. Depending on what Stripe collected at checkout, that record can include billing details such as your name, billing address or tax information.

We then email you your license key. That is the only email our system sends; it goes through a third-party email delivery provider.

About the machine identifier. When ClawIDE first runs it generates 16 random bytes and stores them locally; the identifier sent to us is a SHA-256 hash of that random value. It is not a hardware fingerprint. No serial number, MAC address, hostname or username is read or transmitted. Activating and validating a license sends exactly two fields — your license key and that identifier — and nothing else. Because your key is re-sent daily, our server can see that a given license is in use, and from which IP address.

A license activates up to 3 machines. Licenses verify offline using a signed token, so ClawIDE keeps working for a 7-day offline grace window without contacting us at all.

ClawIDE Cloud / Team accounts (in beta) additionally store an account email address, a hashed password, organization and seat membership, and session tokens (stored hashed).

4. Cookies and similar technologies

There is no cookie banner on this site, and we do not currently collect consent. If you are in a region where consent is required before non-essential cookies are set, treat that as a gap we have not yet closed rather than a claim that you consented. Blocking the tags (see below) is effective in the meantime.

5. Who we share data with

We do not sell personal data. We share it only with the providers needed to run the product:

On what we report to Reddit. We only report a purchase to Reddit when Reddit already knows the buyer — either because you arrived from a Reddit ad click, or because the Reddit Pixel had already set its own id in your browser. If neither is true, we send Reddit nothing about your purchase at all.

When the purchase did come from a Reddit ad click, the report includes a SHA-256 hash of your email address, so Reddit can match the sale to the ad. When Reddit knows you only from its own pixel id, the purchase is reported against that id and no email address is included. Your raw email address is never sent to Reddit in any case. Note that a hashed email is pseudonymous rather than anonymous: Reddit can match it against an existing account.

6. Why we process it

• To provide what you asked for — issuing and validating your license, sending your key, processing your payment. Without this we cannot deliver the software you bought.
• Because we have a legitimate interest in understanding how the site performs, keeping the service secure, and preventing one license from being shared across unlimited machines.
• For advertising measurement, which is the basis most likely to require your consent in the EU and UK. See the note in the cookies section.

7. How long we keep it

• Analytics data: Google Analytics is configured to retain event-level data for 14 months. Aggregate reports persist beyond that.
• Advertising data: kept by Reddit under Reddit’s own retention rules.
• License and purchase records: kept for as long as the license exists, and afterwards for as long as we need them for tax, accounting and refund records. We do not currently expire or automatically delete these records.
• Machine activations: kept while the license exists.

8. Do Not Track, and how to opt out

We do not implement a Do Not Track signal, and we would rather tell you what actually works:

• Content and ad blockers work here. Analytics and the Reddit Pixel are ordinary third-party scripts. If your browser blocks them, they do not load, no events are sent, and nothing about the site breaks. A meaningful share of our visitors block them, and we treat that as a normal outcome, not something to route around.
• Google’s opt-out. Google publishes a browser add-on that disables Google Analytics across all sites.
• In the app, turn off auto_update_check in Settings to stop the daily update check. If you never activate a license, the app never contacts our license server.
• Email us at support@clawide.app to ask for your data to be deleted.

9. Your rights

Depending on where you live you may have the right to access, correct, export or delete your personal data, or to object to some processing. We have not built a self-service tool for this. Email support@clawide.app and we will handle it by hand; tell us the email address you purchased with so we can find your records. Note that deleting your license record also deactivates the license.

For data held by Stripe, Google or Reddit, you can also go to those companies directly — they each run their own request process.

10. International transfers

We are based in the United States and every provider listed above is either US-based or operates globally with US infrastructure. If you are in the EU, the UK or elsewhere, your data is transferred to and processed in the United States.

11. Children

ClawIDE is a developer tool and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, email us and we will delete it.

12. Changes to this policy

If we change what we collect or who we share it with, we will update this page and change the “last updated” date at the top. Material changes to how we handle purchase data will also be reflected in the EULA where relevant.

13. Contact

Questions, requests or corrections: support@clawide.app.