Patchkin
Sign inGet access
Legal

Privacy policy

What we collect, what we never collect, and your choices. In short: terminal output and your code are not stored by us, governance records are names, counts and results, and we do not sell personal data.

Effective 14 October 2026 · Last updated 14 October 2026

1. Who we are

Patchkin is a service that lets teams run, watch and govern AI coding agents on their own machines. It is provided by Thoutam FZC, Sharjah, United Arab Emirates (“Patchkin”, “we”, “us”).

This policy covers this website and the Patchkin service: the web app, the hub that connects it, and the small program that runs on your machines. Contact us about privacy at legal@thoutam.com.

Two roles. For the account and website data described below, we decide why and how it is used, so we are the controller. For the work records your organization chooses to collect about its own people and repositories (see “Records your organization turns on”), your organization decides why and how, and we process them on its behalf, so we are the processor and your organization is the controller.

2. What we collect

Account and organization data

  • Your name, work email, a hashed password (or the identity your single sign-on provider sends us), your role and your teams.
  • Organization settings: its name, plan, teams, members, standards (the rules you write), context-bank notes, and the administrative actions recorded in the activity log.

Machine and session data

  • For each paired machine: its name, operating system, program version, which agent tools are installed, and basic health numbers such as CPU and memory use.
  • For each session: its name, the tool, the folder it started in, the options it was started with, who drove it, and when it started and ended. Do not put passwords or keys in launch options.
  • Terminal output is streamed through our servers from your machine to the browser of the person watching, over an encrypted connection. We do not write it to our databases, apart from the two short exceptions below. It is kept on your machine so a browser can catch up when it connects. If you turn on end-to-end encryption for a machine, our servers cannot read it at all.
  • Waiting alerts. When an agent stops and may be asking you something, the program on your machine sends up to 200 characters of the question it printed, with anything that looks like a password or key replaced (a best effort, not a guarantee). We keep that text in a temporary cache for up to 30 minutes so the web app can show it to the people on that team. It is not put in notifications: a notification only says that a session may be waiting. The cache is saved to disk by our database cache service, so a copy can remain in its files until they are next rewritten. Machines that use end-to-end encryption send nothing.
  • Continue elsewhere. When you move a session to another machine that is not end-to-end encrypted, our servers read the recent terminal output (about 6,000 characters) and, for Claude Code, the conversation file (which can contain your prompts, its answers, code and secrets), and pass them to the other machine. They are held in memory only for the transfer and are not written to our database. The work continues in a new process on the other machine; the folder and tools must already be there. We record that a handover happened: the machines, the sessions, the reason and the time. You can choose not to move the conversation. Machines with end-to-end encryption are skipped.
  • Standards written to your machines. The rules, commands and skills your organization publishes are written into each tool’s own configuration. For Cursor they are written as files inside the repositories the program knows about, and the program asks git to ignore them so they are not committed by accident.

Records your organization turns on

If your organization switches on governance, we store: the repository, branch and commit ids and subjects; commit author names and emails as they appear in git; changed file names and line counts; findings (the kind of problem and where, never the secret itself); pass or fail of your checks and how long they took; the names and commands of MCP servers and instruction files, with secrets removed; and counts of cost and tokens. Your organization chooses how long these are kept (the default is 180 days) and they are deleted automatically afterwards.

Website and service use

  • Our web servers log the time, your IP address, the page requested and the result. We use this to run and secure the service.
  • Product events such as which pages of the web app are opened, to understand which features are used.
  • Anonymous visit statistics for this website from Cloudflare Web Analytics: the page, where the visit came from, the country, the browser and device type, and how fast the page loaded. They are not linked to a person.
  • If you choose to turn on browser notifications, a notification address from your browser so we can send them.
  • If you write to us, what you send.

3. What we never collect

  • The contents of your files or diffs.
  • What you type into an agent.
  • What an agent prints, other than the two short-lived exceptions above.
  • Secret values. A finding says that an AWS key appears in a file; it does not store the key.
  • The output of your tests or linters.
  • Environment variables, headers or tokens from MCP configuration.

4. How we use it

  • To provide the service: connect your browser to your machines, show sessions, apply standards, record findings, and report cost.
  • To keep the service secure, prevent abuse and fix problems.
  • To send you service messages such as email confirmation, password resets and alerts you asked for.
  • To understand how the product is used and improve it.
  • To meet legal obligations.

We do not sell personal data, and we do not use it for advertising. This website uses Cloudflare Web Analytics to count visits and measure performance. It does not use cookies or local storage, does not build a profile of you and does not follow you across other sites. We do not use advertising or marketing trackers. If we add other analytics or marketing tools, we will update this policy first and, where the law requires it, ask for your consent before they run.

5. Our legal bases (EEA and UK)

Where the GDPR or UK GDPR applies to data for which we are the controller, we rely on: contract (to provide the service you or your organization signed up for), legitimate interests (security, product improvement and running our business, balanced against your rights), consent (for optional things such as browser notifications, which you can withdraw), and legal obligation. For records your organization collects, your organization is responsible for having its own legal basis.

6. If you use Patchkin through your employer

If your organization uses governance, it decides what is recorded about your work, within the limits above. Your organization must tell you what is recorded, and the product shows you that notice. You can always see your own activity in the web app. Per-person views for others are off unless your organization turns them on. Questions about your employer’s use are best sent to your employer first.

7. Who we share data with

We share data only with people and companies that help us run the service, under written terms that limit what they can do with it:

  • Hosting and infrastructure: a cloud hosting provider in Germany for the Patchkin application and its data, and a web hosting provider in the United States for this website.
  • Email delivery: our web hosting provider's mail system.
  • Website delivery and visit statistics: Cloudflare.
  • Payments, when paid plans are offered: Stripe and PayPal. They handle card and account details; we do not store full card numbers.
  • Your own identity provider and git host, when you connect them.

We may also disclose data if the law requires it, to protect rights, safety and security, or as part of a merger or sale of the business (we would tell you). A current list of providers is available on request.

8. International transfers

The Patchkin application and its data are hosted in Germany (EU). This website, and the email sent from its contact form, are hosted in the United States. Thoutam FZC is based in the United Arab Emirates, so personal data may also be accessed from there to run and support the service.

We plan to offer regional hosting. Customers who need their data in a particular region, or want to run Patchkin on their own infrastructure, can ask us what is available, and we will tell account owners before any move of their organization’s data. If we transfer personal data from the EEA, UK or Switzerland to a country without an adequacy decision, we use approved safeguards such as standard contractual clauses.

9. How long we keep it

  • Governance records: as long as your organization sets (default 180 days), then deleted automatically.
  • Account and organization data: while your account is active, and for a short period afterwards for backups and legal needs.
  • Server logs: kept for a limited time for security and troubleshooting.
  • Messages to us: as long as needed to deal with them.

You can ask us to delete your organization’s records at any time (see “Your rights”).

10. How we protect it

Connections use TLS. Machines connect out to us, so you open no inbound ports. Pipeline and usage tokens are limited to one purpose each. Updates to the program are verified by checksum before they are applied. End-to-end encryption is available per machine. You can sign in with two-factor authentication or single sign-on. See the security page for detail, including what we have not yet done: we have not completed an independent security audit or certification. No system is perfectly secure, and we will tell affected people and regulators where the law requires us to.

11. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict some uses, to withdraw consent, and to complain to your data protection authority. Californian residents have similar rights under the CCPA/CPRA; we do not sell or share personal data for cross-context advertising. Where the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data applies, you have the rights it provides, and we handle requests under it.

To use a right, email legal@thoutam.com. If your data was collected by your employer through Patchkin, we may direct you to your employer, who controls it. We will reply within the time the law allows.

12. Cookies and local storage

This website sets no cookies. It loads one third-party script, Cloudflare Web Analytics, which does not use cookies or local storage. Its fonts are served from this site.

The web app keeps your sign-in token and your light or dark preference in your browser’s local storage. These are needed to keep you signed in and are not used for tracking. Clearing site data signs you out.

13. Children

Patchkin is for professional use and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe we have, contact us and we will delete it.

14. Changes to this policy

We will update this policy as the service changes. If a change matters, we will tell account owners by email or in the web app before it takes effect. The date at the top shows when it was last updated.

15. Contact

Thoutam FZC
Sharjah, United Arab Emirates
legal@thoutam.com