Privacy Policy

Olive Hill Group, LLC, a California limited liability company, operating as Code Recycle at coderecycle.ai. Privacy contact: privacy@coderecycle.ai.

Account. Email address and whether it is verified, display name, profile image URL if your sign-in provider supplies one, authentication tokens from that provider, and per-session IP address and browser user-agent.

Public profile. If you contribute a listing, star one, or edit your profile, your display name, profile image, bio, website, contributed listings and the stars they receive are shown publicly on your profile page. Your email and what you have taken are never shown. We do not accept uploaded pictures.

Organization. Organization name and your role in it.

Transactions. What you acquired, when, the amount, and a reference to the Stripe payment. Entitlements, licence grants and download events. We do not store card numbers — card details go directly to Stripe and never reach our servers.

Agent activity. Agent credentials, their scopes, budgets and policies, approval decisions, and an audit record of significant actions with the acting user or agent identifier.

Search queries and content you submit. Queries you type are logged with your organization where you are signed in.

We run no advertising trackers and no third-party analytics scripts.

To operate your account and deliver what you acquired; to take payment; to keep the service secure, which is the narrowest reason we retain IP and user-agent; to keep an audit trail — particularly of purchases made by automated agents, which protects you as much as us; and to answer you when you write.

We do not sell personal information and we do not share it for cross-context behavioural advertising.

Stripe — payment processing and payouts; receives your payment details directly. Vercel — hosting; processes requests including IP addresses. Neon — database hosting.

Anthropic and OpenAI — catalogue search understanding and embeddings. Search queries you type may be sent to these providers. Your email, name and account identifiers are not sent with them.

Because a query is content you write, it can contain anything you type. Please do not put credentials, secrets, private source code, personal data, or information you are not authorised to disclose into a search box.

When a search finds nothing, we record the gap so we know what to stock. Those records are private by default.

A request becomes public only from a separately written, sanitised summary — never your raw query — and only after you opt in having seen the exact public text, or a moderator approves it under a documented rule. Names, companies, clients, credentials, source code, personal data and proprietary project facts are removed. You may withdraw a published request at any time.

These are targets, and we are telling you plainly that they are targets:

• Account data: while your account exists.
• Session IP and user-agent: about 90 days, unless needed for a security investigation.
• General security logs: about two years.
• Transaction, licence, entitlement, agent-authorisation and approval evidence: about seven years, or the entitlement duration plus the relevant dispute period.
• Financial and tax records: about seven years, or the legally required period.
• Backups expire through the normal backup cycle.

Automated deletion jobs are not yet running. Until they are, these are the periods we work to rather than periods a system enforces. We would rather say that than publish a schedule we do not keep.

Legal holds, fraud, disputes, sanctions and security incidents extend retention while reasonably necessary.

Where applicable law grants you rights over your personal information — to know, access, correct, delete, or object — we honour them. We will also consider reasonable access, correction and deletion requests voluntarily, subject to security, transaction-record, licence-evidence and legal-retention exceptions.

We have not completed the entity-level analysis that determines whether the California Consumer Privacy Act applies to Olive Hill Group, and we would rather honour requests than claim a status we have not verified in either direction.

To make a request, email privacy@coderecycle.ai.

Closing your account removes your profile from active systems. Transaction, entitlement, licence-grant, tax, fraud and agent-authorisation records are retained — they are evidence of what an organization acquired and what an agent was authorised to do, and deleting them would remove your proof as well as ours.

We do not track you across other websites and we host no third-party advertising or analytics scripts, so there is no cross-site profile to opt out of. Because we do no such tracking, we do not respond differently to a browser Do Not Track signal.

Passwords and API keys are stored one-way hashed. Tokens that must be reusable, such as OAuth refresh tokens, are stored encrypted rather than hashed — those are different things and we would rather name the difference than blur it. Card data never reaches our servers. Outbound webhook destinations are validated against private-network ranges.

We do not claim to be unbreachable. If a breach affecting your personal information occurs, we will notify you as required by law.

The service is for people 18 and over and is not directed to children. We operate from the United States and our providers process data there. We do not currently market to consumers in the EU or UK.

We may update this policy. Material changes will be posted here with a revised version and date.