MantisCode

Privacy Policy

Last updated: October 21, 2026

This policy explains what personal data MantisCode processes, why, for how long, who it is shared with and how you can exercise your rights. It applies to the MantisCode app for iOS and Android, its backend (api.mantiscode.app), the remote workspaces where the agent runs and the mantiscode.app website. If this English version and the Spanish version differ, the Spanish version prevails.

In short:

• From your GitHub account we only store your identifier and username. We do not store your email, real name or picture.
• Your code, your conversations with the agent and your attachments live in your workspace, not in our database, and are deleted when the workspace is destroyed.
• We do not sell your data, show ads, use analytics or tracking tools, or train AI models on your content.
• What you send to the agent goes to the provider of the AI model you choose, which processes it under its own terms.

1. Data Controller

The controller is Rubén Solano Jiménez, who provides MantisCode as an individual. For any privacy matter, write to [email protected]. Full identification details are in the Terms of Service.

2. Data We Process

2.1 GitHub Account

You sign in with GitHub. We store your numeric GitHub identifier and your username (login). We never see your GitHub password.

To work with your repositories, MantisCode asks GitHub for these permissions:

• repo: read and write access to your public and private repositories, and to those of organizations that allow it.
• workflow: change the GitHub Actions files in those repositories.
• read:user: read your public profile.
• read:org: see, without changing them, the organizations and teams you belong to. We use it to show you the organizations where you can create repositories.

2.2 Credentials

• GitHub token and app session. Your GitHub access token is stored encrypted in our database. App session tokens are stored in our database and in your device's secure storage.
• Copy in your workspace. So that Git and the GitHub CLI work, the GitHub token is available inside your workspace as environment variables (GH_TOKEN and GITHUB_TOKEN) and in a file that only the workspace user can read.
• AI providers. If you connect a provider with an API key, we store it encrypted in our database and copy it to your workspace so the agent can use it. If you sign in through the provider itself (for example, with a device code), the token is stored only in your workspace.
• SSH servers. If you add a server, we store its address, the user, the server fingerprints, the public key and the private key, the latter encrypted.

2.3 Your Work Content

Inside your workspace we process the copy of the repository you open, your messages, the agent's answers and actions, your attachments (photos, documents and screenshots), diffs, Changes and skills. That content is stored in the workspace, not in our database.

Attachments pass through our server on their way to the workspace and are deleted from it within 24 hours.

In our database we only store what is needed to show your sessions: the repository URL, the branch, the session title, the state of Changes, diff counters and whether questions or permissions are pending, without their text.

2.4 Push Notifications

If you enable them, we store your device's notification token, a device identifier, the platform and the language. The notification text is generic (for example, "There is a new response in my-repo") and does not include what the agent writes. It does include the repository name and URL and internal session identifiers.

2.5 Subscription

Purchases are made on the App Store or Google Play and managed with RevenueCat. We receive your subscription status, plan, dates and purchase events, linked to your internal MantisCode identifier. Before storing those events we remove receipts, tokens, signatures and emails. We never receive your card details.

2.6 Technical Data

• Status and events of your workspaces (creation, hibernation, resume and errors) and their CPU, memory and disk usage.
• Server logs, with internal identifiers and repository URLs. We do not log the content of your conversations or your messages to the agent.
• Your IP address is used on the spot to limit abuse. We do not store it in the database, although it may appear temporarily in server logs that are overwritten automatically.

2.7 Data Stored on Your Device

The app keeps your credentials in the system's secure storage and, in its own storage, a cache of conversations, drafts, model preferences and settings.

Logging out deletes the credentials, the conversation cache, drafts and cached settings. The theme, language, some interface preferences, device identifiers and the data that lets you restore a purchase made on that device are kept. Uninstalling the app deletes everything.

2.8 Device Permissions

• Camera and photos: only when you attach an image.
• Microphone and speech recognition: only when you use dictation. Transcription is done by your system's speech recognition service (Apple or Google), which may process the audio on its servers. MantisCode only receives the text.
• Notifications: only if you accept them.

We do not ask for your location or track your activity across other apps or websites.

2.9 The mantiscode.app Website

Public pages use no cookies, analytics or third-party resources. They only store the light or dark theme you choose in your browser. The operator dashboard uses a technical session cookie, for the operator only.

3. Why We Use Data and Legal Bases

• Providing the service you sign up for (performance of a contract, Art. 6(1)(b) GDPR): signing you in, creating, hibernating and resuming your workspace, opening repositories, running the agent, performing the Git actions you request, applying your model settings, sending you notifications and managing your subscription.
• Keeping the service secure and running (legitimate interest, Art. 6(1)(f) GDPR): preventing abuse, rate limiting, diagnosing failures and sizing the infrastructure from usage data. You can object by writing to us (section 9).
• Complying with legal obligations (Art. 6(1)(c) GDPR): handling your rights requests and requests from authorities.

You decide camera, microphone and notification permissions on your device and can withdraw them at any time.

We do not use your data for advertising, build profiles, make automated decisions with legal effects on you, or sell or share your data. MantisCode does not train AI models on your code, your messages or the agent's answers.

4. AI Providers

To complete a task, the agent sends your messages, attachments and the repository context it needs to an AI model. Who receives it depends on the model you choose:

• A provider you connect (for example, OpenAI, Anthropic, xAI, GitHub Copilot or Amazon Bedrock): you use it with your own account or key. That provider processes the data under its contract with you and its policies, including its retention and training rules.
• OpenCode Zen free models: your workspace includes access to them without connecting any account, and the app uses one by default if you have not chosen another model. What you send to them goes to OpenCode Zen and to each model's provider, under privacy terms that depend on the model and may include using your data to improve it. Review them before sending confidential code and, if you prefer, choose a model from a provider you have connected.

MantisCode does not control what each provider does with your data. Choosing a model means choosing who receives your content.

5. Who We Share Data With

Providers that process data on our behalf (processors):

• Hosting, with data centers in Germany: backend servers, database, backups and workspaces.
• RevenueCat, Inc. (USA): subscription management.
• Expo (650 Industries, Inc., USA): delivery of push notifications through Apple Push Notification service and Firebase Cloud Messaging.

Third parties that process data under their own policies:

• GitHub, Inc. (USA): sign-in, repositories and Git operations.
• Apple and Google: app distribution, payments, notifications and speech recognition.
• AI providers, as described in section 4.
• Anyone who receives a public preview link you share (section 7).

We will only hand data to an authority when a law or a court order requires it.

6. International Transfers

We store your data in the European Union (Germany). Some of the services in section 5 are in the USA or other countries. When the recipient participates in the EU-U.S. Data Privacy Framework, the transfer relies on it; otherwise, on the European Commission's standard contractual clauses included in its terms. Transfers to the AI provider you choose happen on your instruction. You can ask us for information about these safeguards.

7. Public Preview Links

If you share a web preview of your workspace, anyone with the link can see it without signing in. The link is shown only once, cannot be revoked individually and stops working when the preview expires or the workspace is destroyed. Do not share previews that show personal data or secrets.

8. How Long We Keep Data

• App session: 7 days, renewable up to 30 days with the refresh token. Expired sessions are deleted every hour.
• GitHub token in our database: for as long as your session lasts. It is deleted when you log out.
• Workspace (code, conversations, attachments, history and copies of the token and credentials): it hibernates after 60 minutes of inactivity and is destroyed with all its content after 7 days of hibernation. When you log out we try to destroy it immediately; if that is not possible, the same rule applies. MantisCode is not an archive of your conversations: push to GitHub whatever you want to keep.
• Backup when recreating a workspace: if you ask to recreate a workspace, we first save your unpublished work as a hidden ref (refs/mantis/backup/...) in your GitHub repository. That ref stays on GitHub until you delete it.
• Attachments on our server: up to 24 hours.
• Provider credentials, SSH servers, model preferences and notification devices: until you delete them or delete your account. Logging out does not delete them.
• Workspace technical and usage data: 90 days.
• Server logs: rotated by size and continuously overwritten.
• Account and subscription data: for as long as your account exists. We do not automatically delete inactive accounts.
• Database backups: deleted data may remain in them until they are overwritten in their normal rotation.
• Communications with you: as long as needed to handle your request; afterwards, blocked for the statutory limitation periods.

9. Your Rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability free of charge at any time. Write to [email protected] with your GitHub username and the right you want to exercise. Because we do not store your email, we may ask you to prove that you control that GitHub account.

We will answer within one month. If the request is complex, we may extend that by two more months and will tell you so within the first month.

• Portability: we give you, in JSON format, the account data we store in our database. Your code is already in your GitHub repositories.
• Account deletion: follow the steps at mantiscode.app/delete-account. We delete your account, credentials, servers, preferences, devices, sessions, workspaces and subscription data from our systems, and ask RevenueCat to delete your customer record. Apple and Google manage their own purchase histories.
• In the app you can log out, delete provider credentials and servers, and turn off notifications.
• GitHub access: logging out or deleting your account removes the token from our systems, but does not revoke the authorization on GitHub. To revoke it, go to GitHub → Settings → Applications → Authorized OAuth Apps. We recommend doing so when you stop using MantisCode.
• Complaints: if you believe we have not handled your rights properly, you can complain to the Spanish Data Protection Agency (aepd.es) or to the data protection authority of your EU country of residence.

10. Security

• GitHub tokens, provider credentials and SSH keys are stored encrypted with AES-256-GCM.
• All communications are encrypted (HTTPS and WSS).
• Each workspace is private and isolated from other users' workspaces. Network rules prevent it from reaching our internal infrastructure and the hosting provider's metadata services.
• The operator dashboard only shows your GitHub username, the status of your workspaces and their resource usage. It does not show your repositories or your conversations.
• As server administrator, the controller has technical access to the infrastructure. He only accesses a user's data when strictly necessary to fix an incident, handle that user's request or comply with a legal obligation.
• If a security breach affects your data, we will notify the Spanish Data Protection Agency within 72 hours and, if it poses a high risk to you, inform you without undue delay through the means available to us.

Limits you should know about:

• Code and commands that run in your workspace, including the agent's, can read the GitHub token and provider credentials in it, and have internet access. Do not run code you do not trust and do not keep secrets in the repository that you do not want the agent to read or send to the model.
• No system is infallible. If you think a credential has been exposed, revoke it in its service and let us know.

11. Children

MantisCode is intended for people aged 18 or over. We do not knowingly process children's data. If we learn that a minor has created an account, we will delete it.

12. Changes to This Policy

We will publish each new version, with its date, in the app and at mantiscode.app/privacy-policy. If a change is significant (for example, new uses or new recipients of your data), we will announce it visibly on the website and in the app's release notes before it applies. We will not use your data for a new purpose without telling you first and, where the law requires it, asking for your consent.