Privacy Policy

Athenode ("we", "us", "our") provides a spec-driven development platform: the free athenode software that runs on your own computer, the self-hosted Athenode Pro server, and an online service for Athenode accounts, organisations and their billing, Athenode Pro licenses and install tokens, and the plugin library. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and the choices and rights you have.

Data we collect

• Account and profile data: the information you provide when you create an account, such as your name, email address, and any profile details you choose to add.
• Organisation data: the organisations you create or are a billing administrator of, their names and billing email addresses, invitations of other billing administrators, and their Athenode Pro subscriptions, license keys and install tokens.
• Published plugins: the plugins you publish to the plugin library (skills, agents, rules, MCP server configurations and plugin files), with their names, descriptions, categories and versions and the attribution of the external plugins imported into them, and your likes and reports of library entries.
• Server logs: when you use the web app, the Athenode API, the athenode software or Athenode Pro with the service, our servers record technical request data, such as your IP address, the time and address of the request and the response status. Tokens and other credentials are removed from these logs.
• Analytics and cookies: when you consent, we collect usage data such as pages visited, features used, session history, and your IP address, via cookies and similar technologies.
• Advertising measurement: when you consent to marketing cookies and arrive from one of our ads, we record the identifier of that ad click and whether the visit led to a registration.

The athenode software, Athenode Pro and AI coding tools

The athenode software (the athenode package with its CLI and local daemon, and the @athenode/cli alias) runs on your computer. Your projects, specifications with their questions and answers, implementation plans, statuses and blockers, ToDo cards and plugins are kept in its data folder on your computer and are not sent to us. Since 2026-10-19 the service keeps no projects, specifications, ToDo cards or project plugins.

• When it contacts us: only when you use the plugin library through it: to browse and install library entries, and, after you sign in to your Athenode account with the daemon's device sign-in, to publish, edit or unpublish your plugins. The sign-in's tokens are stored on your computer. Installing a public plugin with athenode use needs no account (see "Published plugins and public display" below).
• What it does not send: the software does not upload your source code, the other files of your repository, your specifications or ToDo cards, or your conversations with the AI coding tool. Publishing sends the plugin you publish, and nothing else.
• No telemetry: the software collects no usage analytics. It checks the public npm registry for a newer version at most once a day, which you can turn off.
• Athenode Pro: an Athenode Pro server runs on infrastructure of the organisation that installs it. The accounts, projects and content on that server are controlled by that organisation, which is their controller; we have no access to them. The server contacts us only to download its package with the organisation's install token and to activate or refresh its license with the organisation's license key.
• Your AI coding tool: when you use Athenode with an AI coding tool, the content that the tool reads from or writes to Athenode is also processed by that tool and its provider under their own terms and privacy policy, which we do not control. We do not send your data to these providers ourselves.

How we use cookies and analytics

We use a small number of cookies to make the site work, and, only with your consent, additional cookies for analytics and for measuring our advertising. Neither is initialized until you grant consent, and the related data collection stops if you withdraw it. Cookie preferences are requested in accordance with applicable regional requirements, and you can change your choice at any time using the cookie settings control on our sites.

• Analytics: we use Amplitude to record visits, page views and session replays in which text and form fields are masked, to understand how our sites and the app are used.
• Marketing: we use the Google Ads tag to measure how our advertising performs. When you arrive from one of our ads, it stores the identifier of that ad click in a cookie and, if you register, reports the registration to Google Ads together with technical data such as your IP address and browser details. We do not send Google your name, email address or any content you created, and we do not allow Google to use this data to personalise advertising. If you withdraw the consent, the tag's cookies are removed.

Subprocessors

We share data with a limited number of service providers who process it on our behalf, including providers of:

• hosting and infrastructure;
• authentication;
• analytics (Amplitude);
• advertising measurement (Google Ads, provided by Google Ireland Limited);
• email delivery;
• payment processing (Paddle, see below).

When you search an external skill catalogue while adding a skill, we send only your search text to that catalogue, without your account details or IP address.

We do not sell your personal data, and we do not use it for targeted or behavioral advertising.

Payments (Paddle)

Paid subscriptions are sold through our online reseller Paddle.com, which acts as the Merchant of Record for all orders.

• Data shared with Paddle: when you open the checkout in the Athenode web app, we pass your account email address and your internal Athenode user ID to Paddle. The name, billing address and payment details you enter in the Paddle checkout are collected and processed directly by Paddle; we do not receive or store your full payment details.
• Purpose: payment processing, invoicing, tax calculation and compliance, and fraud prevention.
• Paddle.js: Paddle's checkout script is loaded only on the web app's organisation checkout page and on our payment page (athenode.com/pay), which opens checkout links from Paddle's emails. It is strictly necessary to process your payment, is not used for marketing, and therefore does not require your cookie consent.
• Paddle's own processing: Paddle processes this data as an independent controller under its own Privacy Policy.

Marketing communications

We only send marketing emails if you have opted in. You can withdraw this consent at any time.

Organisations

If you are a billing administrator of an organisation on Athenode, the organisation's other billing administrators can see your name and email address. The members of an Athenode Pro server are accounts of that server, not of the service, and the organisation that runs it manages them.

Published plugins and public display

If you publish a plugin to the plugin library, your display name is shown with it, as its publisher, to every signed-in Athenode user. Your email address is not shown.

If you also turn on public display for a published plugin, that plugin's name, description and category and the full content of its agents, skills with their bundle files, rules and plugin files are shown on our public website (lib.athenode.com). Anyone can see those pages without an account, and search engines may index them. Its MCP server configuration is public too: anyone can install the plugin, MCP servers included, without an account, with athenode use. Your display name and your email address are not shown there. The content is your own text: if you put personal data into it, that data becomes public with it, so check it before you turn public display on.

If a published plugin contains an external plugin, a third-party plugin imported into it, the plugin library shows that external plugin's attribution with it, as the external plugin's own manifest gives it: its name, the name of its author, its licence and the links to its source, homepage and repository. With public display on, our public website shows the same attribution, with the author's name linked to the author's web address when the manifest gives one, where anyone can see it and search engines may index it. The author's name and web address are personal data of a third party. The author's email address, if the manifest gives one, is not displayed in the plugin library or on our public website. It does stay in the plugin's data: it is sent to signed-in Athenode users who open the plugin in the plugin library, and it is part of the plugin that is installed. While public display is on, that includes anyone who installs it without an account with athenode use. If you are the author of an external plugin and want your attribution removed or corrected, contact us at support@athenode.com.

• Legal basis: we show a published plugin's content on the public website only on the basis of your consent, which you give by turning on public display for that plugin. Public display is off unless you turn it on, and while it is on it covers every later version of the plugin that you publish.
• Withdrawing consent: you can withdraw this consent at any time by turning public display off for the plugin, or by unpublishing it. The plugin, with its whole content, is removed from the public website within about a day. Search engines and other third parties may keep copies for longer, which we do not control.
• Account deletion: when you delete your account, the plugins you published are removed from the public website.
• Reports: if you report a published plugin, we store your account identifier, the reason you chose, your comment if you add one, the date of the report and the state of its review. Only Athenode administrators see a report, never the publisher of the plugin or the public. The email that tells our administrators about a new report contains the plugin, the reason and the comment, but not your name or email address. A report is deleted together with the plugin it concerns. Reports that an administrator has reviewed and dismissed are kept. If you delete your account, your reports are not deleted; they keep your former account identifier, which no longer leads to your name or email address.
• Automated content checks: when a plugin is published, when a new version of it is published and when public display is turned on for it, we scan the plugin's content automatically for suspicious patterns. A finding creates a report attributed to the system, not to any person. The check processes only the content of the plugin, including any personal data you put into it, and no other personal data.
• Public counts: for a plugin with public display on, our public website shows how many times it was liked, how many projects added it on the service before 2026-10-19 and how many times it was installed with athenode use. Only these totals are shown; who liked, added or installed a plugin is never shown.
• Anonymous installs: when anyone installs a public plugin with athenode use, the CLI connects to the Athenode API without an account and sends only the plugin's name, the CLI's version and, when updating an earlier install, the fingerprint of the version installed before. We use the IP address of the request to limit the number of installs per IP address; it is held in memory only for that purpose and is not linked to any account. Each install adds one to the plugin's install total, without recording who installed it. Like every request, it is also recorded in our server logs.

Legal basis and jurisdiction

Athenode is operated by Oleksii Hlushenok, an individual based in Poland, who is the controller of your personal data. We process personal data in accordance with applicable data protection law, including the EU General Data Protection Regulation (GDPR) and, for California residents, the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA).

We rely on these legal bases under the GDPR:

• Performance of a contract (Art. 6(1)(b)): your account, your organisations with their subscriptions, license keys and install tokens, the plugins you publish, and providing the service you signed up for, including paid subscriptions.
• Legitimate interests (Art. 6(1)(f)): server logs, to keep the service secure and working and to prevent abuse; reports of published plugins and the automated checks of their content, to keep the plugin library and our public website safe; limiting anonymous installs of public plugins per IP address, to prevent abuse; showing the attribution of external plugins imported into published plugins, to credit their authors and meet their licences.
• Legal obligation (Art. 6(1)(c)): records we must keep, such as those related to invoicing and tax.
• Consent (Art. 6(1)(a)): analytics and marketing cookies, marketing emails and the public display of a plugin you published. You can withdraw consent at any time, without affecting processing before the withdrawal.

Data storage and retention

Your data is stored on infrastructure located in the EU. Where a subprocessor processes personal data outside the European Economic Area, such as Paddle in the United Kingdom or Google in the United States, the transfer is covered by an adequacy decision of the European Commission, including the EU-U.S. Data Privacy Framework, or by the Standard Contractual Clauses.

• Your content: a plugin you published is kept for as long as it is in the plugin library; when you unpublish it, it is removed from the service at once. The projects, specifications, ToDo cards and plugins that the service kept before 2026-10-19 were deleted from it with the release of that date.
• Backups: our encrypted database backups are kept for 30 days, so deleted data disappears from them within 30 days.
• Server logs are kept for 90 days.
• Reports of published plugins are kept for as long as the plugin they concern is in the plugin library, including after they were reviewed, and are deleted together with it.
• Your account: when you confirm the deletion of your account, you can cancel the deletion during a grace period of 30 days. After that your account and personal data are permanently deleted, and they disappear from backups within a further 30 days, except where we are required to retain data for longer to comply with a legal obligation.

Security

We take reasonable technical and organizational measures to protect your personal data against unauthorized access, loss, or misuse. To report a security vulnerability in Athenode, including the athenode software and Athenode Pro, write to support@athenode.com.

Data breach notification

If a data breach occurs that affects your personal data, we will notify you and, where required, the relevant supervisory authority, in accordance with applicable law.

Your rights

Depending on your jurisdiction, you may have the right to access your personal data, to have it corrected or deleted, to restrict or object to its processing, to receive it in a portable format, and to withdraw a consent you gave. To exercise any of these rights, contact us at support@athenode.com; we will respond within one month.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work, or with the Polish authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, uodo.gov.pl).

Age requirement

You must be at least 18 years old to use Athenode, as set out in our Terms of Service. We do not knowingly collect personal data from anyone under 18.

Contact us

If you have any questions about this Privacy Policy or how we handle your data, contact Oleksii Hlushenok, the operator of Athenode, at support@athenode.com.