Code Input

GDPR overview

Implementation is partial and never declared. The visible text of the terms and the privacy policy never uses the words GDPR or General Data Protection Regulation; the only trace sits in JSON-LD metadata, where the terms describe a Data Protection section as covering GDPR compliance. That is machine-readable metadata, not a written commitment. The privacy policy does grant the usual set of rights: access, correction, deletion, objection to processing, portability and withdrawal of consent. Beyond that, nothing. No legal basis is cited, no data protection officer is named, no Article 27 EU representative is designated, no data processing agreement is offered, no subprocessor list exists and no international transfer mechanism is documented. There is no legal or privacy contact address, only contact, support, sales, enterprise and founder mailboxes. The terms name Malaysia, outside the EU, as the governing country.

Who owns the data?

The terms state that the Service and its original content, features and functionality remain the exclusive property of the company and its licensors. In the other direction, no clause grants the publisher any licence over your code or your content, and the publisher says source code is never stored: processing runs inside your own GitHub Actions runners. The privacy policy therefore covers personal data only, namely name and contact details, account identifiers, payment information, preferences, usage data, device information, logs and performance metrics. Sharing is limited to four listed cases: service providers, advisers and auditors, authorities acting under legal process, and partners with your consent. No subprocessor list and no data processing agreement are published.

Reuse rights

Your own material stays yours: nothing in the terms grants Code Input a licence over your source code or content, and the publisher states that code is never stored. The Service's own content is closed, however. You may not copy, modify, distribute, sell, lease or otherwise exploit any content or materials made available through the Service without the company's prior written consent. Two components are an explicit exception: the Rust command-line tool is published under the MIT licence and the browser extension is announced as fully open source, so both can be reused and redistributed freely under those terms. On personal data, the privacy policy grants access, correction, deletion, objection to processing, portability and withdrawal of consent, and nothing indicates that customer data is used to train models.

Data retention & training

Hosting summary

The privacy policy says only that information is stored on secure servers located in certified data centres, protected by industry-standard security measures. No country, no region and no hosting provider is named, and there is no mention of international transfers, standard contractual clauses or any European location. Code processing is a separate matter: according to the publisher, source code is never stored and all processing runs inside the customer's own GitHub Actions runners, outside Code Input's infrastructure. On jurisdiction, the picture is contradictory: the terms of service state that the governing country is Malaysia, while the structured data published on the site gives a San Francisco, California address, and nothing on the site reconciles the two. At network level, the domain resolves behind Cloudflare on an anycast address, which says something about the delivery infrastructure but nothing about where personal data is actually held. In short, hosting is described in general terms only, and anyone with a data residency requirement will have to ask the publisher directly.