Privacy Policy

Last updated: October 19, 2026

1. Introduction

Burin Labs, LLC ("Burin Labs," "we," "our," or "us"), based in San Francisco, California, makes Burin Code: a Mac app and a terminal app for macOS, Linux, and Windows for software development. This Privacy Policy explains how we collect, use, and protect information when you use Burin Code, our online services, or burincode.com (together, the "Service"). Data flow depends on the feature and model route described below.

2. Information We Collect

Information You Provide

API Keys: If you provide your own API keys for AI model providers (e.g., Anthropic, OpenAI), the application stores them in your operating system's credential store: the login Keychain on macOS, the system keyring (Secret Service) on Linux, and the Credential Manager on Windows. A file readable only by your user account is used only where no keyring is available; that file is not encrypted unless you configure a file encryption key, and the application shows which storage is in use. Direct-provider requests use those credentials locally; Burin's managed route uses a separate short-lived inference grant rather than uploading your personal provider key.
MCP Server Configuration: If you connect to Model Context Protocol (MCP) servers, connection details including OAuth tokens are stored locally on your device. If you enable settings sync, your MCP server configuration is uploaded to your account after environment and header values, recognized credential fields and command arguments, and credentials in URLs are replaced with placeholders. Restore preserves matching local secret values. Other configuration is uploaded, so avoid putting secrets in fields that are not recognized as credentials.
Account Information: If you create a Burin Code account, we collect your email address and display name. If you sign in with GitHub or Google, we also receive and store that provider's account identifier, the email address on that account, and access and refresh tokens for it. If you register a passkey or two-factor authentication, we store the passkey's public credential, label, device type, and last use, and the encrypted two-factor seed.
Usage Records: For each request made on the managed route, we store your account identifier, the model, the provider, token counts, and cost. We do not store the prompt or the response.
Waitlist: If you join the waitlist, we store your email address, the page you signed up from, and the time.
Support Messages: If you email us, we keep the correspondence in our support inbox, hosted by Google, to answer you.
Problem Reports: If you use Report a problem in the Mac app or /report in the terminal app, it sends your message, the reply address you enter, the app version, build, and operating-system version, the session identifier, and any transcript you choose to attach. In the Mac app you can also attach a screenshot. If you are signed in, the report also names your account email and identifier. Our API relays the report by email to our support inbox and does not store it. A report that cannot be sent waits in a local outbox on your device until it is delivered.

Information Sent Automatically

Feature Flags (signed in): While you are signed in, the application asks our API for feature-flag values about every five minutes. The request carries your sign-in session. The absolute path of the open project is sent only when the API confirms that your account is an administrator; it is withheld for other accounts or if that check fails. For administrator accounts, the path may contain your account name. Burin API request logs and traces omit query strings, including this project path.
Service Checks: At launch the Mac app sends an unauthenticated request to our API to check whether account features are reachable. Once you are signed in, the application also requests your account details, plan, and managed-inference grant. Like any request, these expose your IP address and the operating system's default user agent, which names the app build and operating-system version.
API Request Logs: Our API logs each request's method, path, status, and timing, and exports request traces to an operations-monitoring provider. We do not store IP addresses or user agents in our database; rate limiting uses IP addresses in memory only.

Optional Diagnostics

Activation Events: If you opt in, the Mac app sends a limited set of events such as app launch and first successful agent turn. An event includes a persistent random installation identifier, app version, operating-system name and major version, locale, event name, and optional title-generation route. It excludes code, prompts, and account data. You can change consent in Settings > Telemetry. The terminal app records the same choice but sends no activation events.
Crash Capture: If enabled, crash capture writes JSON reports to your device for your review. Burin does not automatically upload those files.
OpenTelemetry: If enabled, Harn exports traces to the collector endpoint you configure. That collector's operator controls its retention and access.

Website

Website Requests: Our website hosting and network providers process ordinary request metadata, such as IP address, user agent, requested path, and timestamp, to deliver and protect the site. The website does not install a product-analytics tracker and does not set cookies. Our API sets one short-lived, strictly necessary cookie only while you confirm a terminal sign-in in your browser.
Browser Storage: The website stores a random feature-flag identifier in your browser's local storage and sends it with an unauthenticated request on each page load so that feature flags can be evaluated consistently. It is not linked to an account. The website also stores your theme choice and, while you are signed in, your sign-in session, account identifier, email address, and name. Signing out removes the session; clearing site data removes all of it.

3. How We Use Your Information

We use collected information to:

Provide and maintain Burin Code and the Service
Process account creation and manage paid subscriptions and AI credits
Send important service notifications (e.g., security alerts, billing)
Prevent abuse of the Service, including the managed route and AI credits
Improve application performance, stability, and features
Respond to support requests
Comply with legal obligations

We do not sell your personal information, share it for cross-context behavioral advertising, or use it for advertising.

4. Your Code and Files

Burin Code reads and edits project files locally. Model requests contain the prompts and selected code context needed for the task. Their route depends on the model selection:

A Local route sends the request to the endpoint you configured.
A Direct route sends the request from Harn to the third-party provider associated with your personal key.
A Managed route sends the request through the authenticated Burin API and Harn Cloud to platform-managed model supply.

The model picker labels the effective route. Review the privacy terms for any independently operated model endpoint or connected service you use.

On the Managed route, the Burin API streams the model's response to you as it arrives and does not store the prompt or the response. Harn Cloud, which makes the provider call, stores the request and result for that task and deletes them after a retention period that defaults to seven days.

The agent loop, your file edits, and your tools run on your device. A session record is written to your project's local `.harn` and `.burin` directories, including the full text of tool calls and their output. Detected credentials are removed before that record is written. Those files are not encrypted; the retention controls described below govern their deletion.

Connected MCP servers. When the model calls a tool on a connected MCP server, Burin sends that server the tool's name and the arguments the model chose. It does not automatically attach your conversation, system prompt, or session history. Tool arguments may include code, file contents, paths, or other task data selected by the model. If the server requests your project roots, it receives the absolute path of the project directory, which may contain your account name. Tool arguments and tool results may also contain absolute file paths when sent to a model provider.

5. Third-Party Services

Burin Code integrates with or relies on the following services. Those that process personal information on our behalf do so under their terms with us and only to provide their service.

AI Model Providers (e.g., Anthropic, OpenAI): Direct routes send prompts and selected context from Harn to the provider under your account. Managed routes send that material through Burin's service to platform-managed model supply.
MCP Servers: If you connect to external MCP servers, data is exchanged directly between your device and those servers according to their policies.
Harn Cloud: Operated by us. Executes managed-route model requests and, if you use it, hosted agent runs. Stores the request and result for each task under your tenant.
Render (render.com): Hosts our website, backend services, databases, and request logs. Our production infrastructure is located in the United States (Oregon).
Operations monitoring: Receives request traces from our API (request path, timing, and status) so we can find and fix outages.
Cloudflare (cloudflare.com): Provides DNS and domain management for burincode.com and forwards email sent to support@burincode.com to our support inbox.
Resend (resend.com): Sends our transactional email, such as password-reset messages, and delivers in-app problem reports to our support inbox.
Stripe (stripe.com): Purchases made through Stripe Managed Payments are sold through Link, Stripe's merchant of record service. Burin Labs, LLC operates Burin Code and provides product support. Checkout and card entry are hosted by Stripe; card numbers do not reach our servers. We send Stripe your email address when your customer record is first created, and a random identifier for each checkout attempt.
GitHub and Google: Provide optional sign-in. If you use one, we receive your account identifier and email address from them.
Google (Gmail): Hosts our support inbox. Email you send to support@burincode.com and in-app problem reports are stored there so we can answer you.
Google Fonts (fonts.googleapis.com, fonts.gstatic.com): Serves the typefaces used on burincode.com. Loading a page requests those files from Google, which receives your IP address and user agent.

We are not responsible for the privacy practices of services you choose to connect, such as a model provider under your own key or an MCP server.

6. Model Training

Burin Labs does not use your prompts, code, or files to train its own models.

Your privacy settings control where model requests may go. Until you save a choice, inference stays on your device. You can allow hosted open-weight models or other configured hosted models. These settings apply when a run starts; stop ongoing runs before tightening them.

Allow training-based discounts is off by default. With it off, the runtime admits a hosted route only when the provider registry records that it does not train on requests, or a supported per-request control has been applied to prevent training. Unknown training policies are refused. If you turn this setting on, a provider may use your requests for training in exchange for lower prices.

Provider retention policies still apply. A run can request supported per-request retention or training controls, but their availability depends on the provider and this does not guarantee zero retention. Otherwise the provider's defaults apply. On a Direct route, the provider also receives the request under your own account and terms. Review the terms of any provider whose key you configure. Local inference requires an endpoint on your device.

Our provider registry records, for each provider, whether it offers a per-request control over retention or training, what that provider's documented default is, and the date we last checked it. Where a provider has not been researched, the registry says so rather than leaving it blank. The model settings panel shows that entry for the provider you have selected, quoted from the provider's own published answer with a link to it.

7. Data Storage and Security

Provider API keys are stored in the operating system's credential store: the macOS login Keychain, the system keyring (Secret Service) on Linux, and the Credential Manager on Windows. Where no keyring is available, they are stored in a file readable only by your user account, which is unencrypted unless you configure a file encryption key; the application shows which storage is in use. Other local application state is stored in Burin configuration and data directories on your device and is not encrypted.
Account data (if applicable) is stored by our hosted backend and database providers. Traffic between your device and our services uses TLS.
Account passwords are stored as argon2id hashes. Sign-in session tokens are stored only as one-way hashes, never in their original form, and expire after 30 days.
Where we hold a credential on your behalf — a provider API key you saved to your account, an OAuth token, an MCP authorization token, or a two-factor seed — it is encrypted at rest with AES-256-GCM. Other account fields, including your email address and synced settings, are not separately encrypted at the column level.
Managed inference grants are short-lived (six hours) and scoped to the inference endpoint; platform provider credentials are not sent to your device.
No security system is impenetrable; we cannot guarantee absolute security. If a breach affects your personal information, we will notify you as the law requires.

8. Data Retention

Stripe webhook payloads are processed in memory and are not stored. We retain the event identifier, type, processing outcome, and timing needed for idempotency and replay; replay fetches the event from Stripe by its identifier.

A scheduled job runs once a day and applies the following to the records we hold:

Per-request usage records: kept for 13 months, then replaced by monthly totals per account, provider, and model. The totals remain; the record of each individual request does not.
Account administration records: kept for 13 months, then deleted. Until then the database refuses changes and removal, except that account deletion irreversibly removes the deleted account's identifying fields while preserving the non-identifying operator receipt.

Other data is kept as follows:

Local Data: Application data stored on your device, including your session records, prompt history, and tool output, stays on your device. Burin removes a project's session records and tool output older than your retention window (30 days by default; configurable, including keep-forever) when the Mac app opens the project or a terminal/headless session starts. The Mac app's privacy settings and the terminal/headless controls can clear that project's history on request. Other local application data remains until you delete it. Removing the application binary alone does not delete project history or Burin configuration.
Account Data: If you create an account, we retain your information, including synced settings, sign-in activity, and billing records, for as long as your account is active. You can delete your account at any time with Delete account on your account page at burincode.com/account/usage, or by asking us at support@burincode.com. Deletion takes effect immediately: we delete the account, credentials, settings, collaboration state, per-request usage, and identifying session records. We cancel Stripe subscriptions, expire checkout sessions, refund settled one-time payments, and remove account identifiers from financial and operator-audit records that must remain.
Waitlist: kept until you ask us to remove it or we invite you and close the waitlist.
Managed Route: The Burin API does not store the prompts or responses it relays. Harn Cloud stores the request and result for each task and deletes them after a retention period that defaults to seven days.
API Request Logs and Traces: kept by our hosting and monitoring providers for their standard log retention periods.
Optional Diagnostics: Queued activation events remain local until accepted by the telemetry endpoint and are cleared when you withdraw consent. Accepted activation events are kept for 30 days, then deleted. Crash files remain local until you delete or share them. OpenTelemetry retention is controlled by the collector you configure.

9. Your Rights

You have the right to:

Access the personal information we hold about you
Request correction of inaccurate information
Delete your account and associated data, yourself on your account page or by request
Withdraw activation-event consent through Settings > Telemetry

To exercise these rights, contact us at support@burincode.com. We will confirm your request from the email address on your account and respond within 45 days. You may use an authorized agent; we will ask the agent for proof of your permission. We will not treat you differently for exercising these rights.

10. California Privacy Rights (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the CPRA, gives you the right to know what personal information we collect, use, and disclose; to request deletion; to correct inaccurate information; to opt out of the sale or sharing of personal information; and to limit the use of sensitive personal information. Exercise them as described in the previous section.

In the past 12 months we have collected these categories of personal information, from you, your device, and the sign-in provider you choose, for the purposes described in this policy:

Identifiers: email address, display name, account and installation identifiers, and IP address
Commercial information: plan, subscription, and payment history (card details are held by Stripe)
Internet or other network activity: usage records, feature-flag requests, and website request metadata
Sensitive personal information: account login credentials, used only to sign you in

We disclose these categories only to the service providers named above, for business purposes. We do not sell or share personal information, as those terms are defined in the CCPA, and we do not use sensitive personal information to infer characteristics about you. We keep each category for the retention periods described above.

11. International Users

We are based in the United States and store and process information there. If you use the Service from another country, your information is transferred to the United States. Where laws such as the GDPR apply, we process your information to perform our contract with you (providing the Service and billing), for our legitimate interests (security, abuse prevention, and improving the Service), with your consent (optional activation events, which you can withdraw at any time), and to meet legal obligations. You may also have the right to object to processing, to data portability, and to complain to your local data protection authority.

12. Canadian Privacy Rights (PIPEDA)

If you are a Canadian resident, you have rights under the Personal Information Protection and Electronic Documents Act (PIPEDA), including the right to access and correct your personal information. Contact us at support@burincode.com for requests.

13. Children's Privacy

Burin Code is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us at support@burincode.com.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting a notice on burincode.com or within the application, and by email if you have an account and the change affects how we use information we already hold. Your continued use of the Service after changes constitutes acceptance of the updated policy.

For questions about this Privacy Policy, contact Burin Labs, LLC at support@burincode.com.