Privacy Policy

Who we are

ooda is operated by Toy Software Ltd, a company registered in England and Wales (company no. 15848160), at C/O Esdg Accountancy Ltd, 44 Royal Parade Mews, London SE3 0TN, United Kingdom. We are the data controller for the personal data described here, and we comply with the UK GDPR and Data Protection Act 2018.

For personal data that you put into your projects or publish through ooda, you (or your organisation) are the controller and we act as your processor. That relationship is covered by our Data Processing Agreement.

What we collect

We collect the minimum we need to run the service:

• Account details — your email, name, organisation membership and role, and a securely hashed password if you set one.
• Usage and security data — IP addresses, request logs, and similar technical data used to operate the service, apply rate limits, and keep it secure.
• Project metadata — project names, settings, published-site URLs and their access policies, and who created them.
• Content you create — the code, files, and sites you build, run, and publish.
• Support communications — anything you send us by email.

What we don't collect

We don't use advertising or third-party tracking cookies, we don't sell your data, and we don't use your code, content, or AI conversations to train models.

How we use your data

We use the data above to:

• provide the service — run your environments, build and serve your sites, and authenticate you (to perform our contract with you);
• keep ooda secure and reliable — rate limiting, abuse prevention, and debugging (our legitimate interest in protecting the service);
• communicate with you about your account and important changes (to perform our contract); and
• meet legal obligations where they apply.

We use analytics that don't rely on tracking cookies and don't build profiles of you.

Your code, sandboxes, and AI

When you use a cloud environment, your code lives inside that container for the duration of the session. When you delete a project, its container and storage are destroyed and we don't keep copies of your code outside active environments.

When you use a coding agent, the prompts and code you send are routed to the AI model provider your organisation has configured — for example Anthropic, AWS Bedrock, Azure OpenAI, or your own gateway — using your organisation's own credentials. That provider processes the data under your own agreement with it, not as our sub-processor. ooda doesn't store AI conversation history — session context exists only for the duration of the active connection, and we don't use your prompts or code to train models.

Cookies

We use only essential cookies: a session cookie to keep you signed in, and, for password- or login-gated published sites, a short-lived cookie that records you've passed the gate. We don't use cookies for advertising or cross-site tracking.

Third-party processors

We rely on a small number of providers to run ooda. Each processes data on our behalf under its own data-protection terms:

International transfers

Our database and object storage are configured for EU jurisdiction. Some of our processors are based outside the UK. Where personal data is transferred outside the UK, we rely on appropriate safeguards such as the UK's International Data Transfer Agreement (or the EU Standard Contractual Clauses with the UK Addendum), or transfers to countries the UK considers adequate.

Data retention

We keep account data while your account is active. Code in a cloud environment exists only for the duration of the session and is destroyed when the project is deleted. Published sites are retained until you unpublish them or delete the project. Security and request logs are kept for a short period and then deleted.

You can delete your projects, sites, and account at any time.

Your rights

Under UK data protection law you have the right to access, correct, delete, restrict, or object to our use of your personal data, and to data portability. To exercise any of these, email [email protected].

You can also complain to the UK Information Commissioner's Office (ICO) at ico.org.uk, though we'd appreciate the chance to help first.

Security

We protect your data with encryption in transit and at rest, isolated environments, and access controls. You can read more on our security page.

Children

ooda is a tool for software teams and isn't directed at children. We don't knowingly collect personal data from anyone under 16.

Changes

We may update this policy from time to time. We'll change the date above and, for material changes, let you know.

Contact

For anything privacy-related, email [email protected].