Privacy Policy

1. Introduction

Alucify, Inc. ("Alucify," "we," "our," or "us") provides an intent engineering platform — a World Model for enterprise software — that makes AI coding agents structurally aware of enterprise codebases. This Privacy Policy describes how we collect, use, disclose, and protect personal information and customer data through:

• Our website at alucify.ai
• The Alucify VS Code Extension
• The Alucify Chrome Extension
• The Alucify web application and MCP server
• Our APIs and backend services

By using any of our Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use our Services.

2. Key Definitions

3. Information We Collect

3.1 Account Information

When you register for Alucify, we collect:

• Name and email address
• Organization name and role
• Authentication credentials via GitHub OAuth (we do not store GitHub passwords; we receive an OAuth token scoped to the permissions you approve)

3.2 Customer Data (Source Code and Artifacts)

3.3 VS Code Extension Data

The Alucify VS Code Extension collects:

• Workspace file structure and metadata (file names, paths, and language types)
• Source code content for files within the active workspace that you submit for analysis
• Extension usage telemetry (commands invoked, feature usage frequency, error logs)
• VS Code version and extension configuration settings

The VS Code Extension does not collect data from files outside your active workspace unless you explicitly include them.

3.4 Chrome Extension Data

The Chrome Extension collects:

• Page content only from domains and URLs you explicitly authorize
• Authentication tokens for your Alucify account
• Extension usage telemetry (features used, error logs)

The Chrome Extension does NOT collect:

• General browsing history or URLs outside authorized domains
• Credentials, cookies, or session tokens for third-party sites
• Content from pages you have not explicitly authorized
• Keystrokes, form inputs, or clipboard data

You can view and modify authorized domains at any time in the extension settings. Revoking a domain immediately stops all data collection from that domain.

3.5 Usage and Technical Data

Across all Services, we automatically collect:

• IP address and approximate geolocation (city/region level)
• Browser or client type, operating system, and device identifiers
• Pages visited on alucify.ai, referral URLs, and session duration
• Feature usage patterns and interaction logs
• Error reports and diagnostic data

3.6 Cookies and Tracking Technologies

On alucify.ai, we use:

• Essential cookies: Required for authentication, session management, and security. Cannot be disabled.
• Analytics cookies: Help us understand how visitors use our site. Can be disabled via our cookie banner.
• Functional cookies: Remember your preferences and settings.

We do not use advertising or targeting cookies. See our Cookie Policy for details.

4. How We Use Your Information

4.1 Customer Data Processing

Your source code and project data are processed exclusively to provide Alucify's core services:

• Generating and maintaining your AppGraph (semantic representation of your application)
• Running deterministic simulations: coverage analysis, congruency checks, and impact propagation
• Computing energy-based fragility and structural health scores
• Providing adaptive contextualization for AI coding agent integration via MCP
• Generating requirements validation reports

4.2 LLM Processing Disclosure

• Semantic interpretation: LLMs transform AST-extracted code structures into canonical DSL forms (e.g., ORM models → GraphQL types, service handlers → StateChart definitions). This involves sending code snippets to LLM providers (Anthropic, OpenAI, and Google).
• Deterministic processing: All graph construction, validation, simulation, coverage, congruency, impact analysis, and energy scoring are performed by our deterministic algorithms — not by LLMs.
• Context generation: When providing context to AI coding agents via MCP, relevant AppGraph sub-graphs are assembled deterministically. The downstream agent's LLM usage is governed by that agent's own privacy policy.

Data sent to LLM providers is:

• Limited to the minimum code snippets necessary for semantic interpretation
• Not used by our LLM providers for model training — we maintain contractual commitments with all providers prohibiting training on customer data
• Processed in accordance with our Data Processing Agreements with each provider
• Transmitted via encrypted connections

4.3 General Business Purposes

We also use information for account management, billing, and customer support; communicating service updates and security notices; improving and optimizing our Services; ensuring security and preventing fraud; and complying with legal obligations.

4.4 What We Never Do With Your Data

17. Contact Us

If you have questions about this Privacy Policy or how we handle your data:

© 2026 Alucify, Inc. All rights reserved.