Privacy Policy

Nythrex is provided by Individual Entrepreneur Kyrylo Ruslanovych Kucherenko (ФОП Кучеренко Кирило Русланович), 24 Pid Holoskom St., Lviv, Ukraine (“Nythrex”, “we”).

For your account data we are the controller. For data that comes from sources connected to a workspace (repositories, issues, cloud bills), the workspace owner and admins decide what to connect; we process that data on behalf of the workspace owner and only to provide the service to them.

Personal data requests: cooperation@nythrex.com. Data protection officer: not appointed.

• Access to sources is read-only. Nythrex never changes or deletes anything in your repositories, trackers or cloud accounts.
• Code and prompts are not stored. Neither file contents, nor the text of AI prompts and responses, nor the text of comments and reviews.
• Access tokens are encrypted. The encryption keys are protected by a key in Azure Key Vault.
• We do not sell data, show ads or train models on your data.
• Optional analytics and advertising require your consent. The Cal.com calendar loads only after you click “Book a demo”.
• Application data is stored in Microsoft Azure, Poland Central region (EU). Demo bookings are processed by Cal.com.

After you click “Book a demo”, your browser loads an embedded Cal.com page. Before that click, the website does not load the calendar or send requests to Cal.com.

Cal.com receives technical connection data, including your IP address, and, when you book, the name, email, selected time and answers you enter in the booking form. Booking details are available to the demo organiser and are processed by Cal.com and the connected calendar and conferencing services. The form does not send these details to the Nythrex application database.

The embedded page may use its own cookies and browser storage. The service’s data practices are described in the Cal.com privacy policy.

• Registration: email and password (via ASP.NET Core Identity; only a hash of the password is stored), whether the email is confirmed, and a failed sign-in counter for temporary lockout.
• Onboarding: three answers — which tools you use, what you focus on and how you heard about Nythrex.
• Workspace: name, members and their roles (owner, admin, member), invitations (the invitee’s email and the invitation’s state), projects, teams, digest settings.
• Cost of time (optional): hourly rates entered by the owner or admins. Only they can see them; a member sees only their own.

Each source is connected with its own OAuth authorization (for GitHub, by installing the GitHub App), started by the workspace owner or an admin. Nythrex then reads the records below on a schedule through the provider’s official APIs.

Tracker history and snapshots. For Jira, Azure Boards, Trello and Linear, we also retain available workflow transitions, priority, estimates with their units, labels, and plain-text issue descriptions limited to 20,000 characters. The first observation is kept as a snapshot; reconstructed historical fields are marked individually. Attachments are not fetched.

Historical datasets and text representations. An automated service prepares versioned datasets across workspaces for model experiments, keeping synthetic and real data separate. These can contain issue titles and descriptions, structural features, durations and recorded cost valuations. Local models in our Azure environment generate numerical text representations (embeddings) for similarity search and training features. Embeddings and their reduced representations are derived personal data, not anonymous data. Similarity results stay within your workspace; the admin interface shows only aggregates. Person features use workspace-scoped opaque identifiers, without separate name or email fields. Dataset or source content is never sent to an external embedding or LLM API. Disconnecting a source deletes its embeddings and the affected workspace’s dataset rows from every version; deleting a workspace removes both. Closed-account reporting also purges affected representations and prevents their regeneration. Affected dataset and model versions are marked purged.

Read only. Where a provider offers read-only permissions, we ask only for those. Microsoft (Azure DevOps, Azure) and Google (BigQuery) offer no narrower permission for the calls we need: access is limited to the rights of the user who connected the source, and Nythrex makes only read requests. In Google Cloud, Nythrex lists projects, datasets and tables and runs SELECT queries against the billing export table; BigQuery may bill these queries to your project.

Tokens. OAuth access and refresh tokens are stored encrypted in the database (ASP.NET Core Data Protection); the encryption keys are protected by a key in Azure Key Vault. The client secrets of our applications at the providers are kept in Azure Key Vault and read with the application’s managed identity.

Disconnecting. When the owner or an admin disconnects a source in Nythrex, its tokens and every record obtained from it are deleted. The grant itself can be revoked in the provider’s settings (for example, by uninstalling the GitHub App or removing the app in Atlassian).

Claude Code and Codex are connected with a command on the developer’s computer, which a workspace member approves. The tools then send telemetry to Nythrex:

• the time, model and token counts of each request, and the cost estimated by the tool itself;
• how the request reached the model: how the tool was signed in (a ChatGPT or Claude account, an API key) and the name of the model provider — never keys, tokens or credentials;
• from Claude Code's status line (Pro and Max accounts only), at most once a minute: how much of the five-hour and weekly usage limits is used and when they reset. Nythrex uses this to tell the subscription plan and calculate its fee;
• the session id, the email and account id in the tool, the organization;
• the repository address (without credentials), branch and commit the session ran in; the tool version and terminal type.

Not stored: the text of prompts and responses, code, file contents and names, tool parameters. Codex adds tool arguments and output fragments to its telemetry — Nythrex drops them on arrival without storing them.

Within a workspace, one person appears under different names: a GitHub login, an email in commits, a Jira account id, an AI tool account. Nythrex links these identifiers into one person record within the workspace — automatically by unambiguous rules (for example, the same email) or manually when an admin does so. Person records are never linked across workspaces.

Most people in this data have no Nythrex account. From the timing of events the product estimates time spent (an estimate from activity gaps, not timekeeping). Nythrex does not compare people with each other or rate their productivity; colleagues’ data by name is visible only to the workspace owner and admins.

For Jira, Nythrex follows Atlassian’s personal data requirements (Personal Data Reporting API):

• every 7 days Nythrex reports to Atlassian the account ids of the people whose names and addresses it stores, with the time this data was retrieved;
• if Atlassian answers that an account was closed, Nythrex erases that person’s name and email in every workspace and renames the person record to “Закритий акаунт Atlassian” (“Closed Atlassian account”, as the product shows it);
• if an account’s data changed, Nythrex reads it again and replaces the stored copies;
• app accounts (such as Jira automation) are not people and are not reported.

• read or store the contents of code, diffs and files;
• store the text of comments, reviews or pull request descriptions; issue descriptions and first-observation snapshots are retained as described above;
• change anything in connected sources;
• sell your data or send connected workspace records to advertising platforms;
• use your data to train models;
• load optional Google tags before consent or send form contents, email addresses, project names or source records to analytics.

• Providing the service — account, workspace, source sync, costs, recommendations: performance of our contract with you (Art. 6(1)(b) GDPR).
• Processing data about people from connected sources — on behalf of the workspace owner, on the basis they determine as controller (usually a legitimate interest in analysing their own engineering).
• Protecting the service — lockout after failed sign-ins, rate limiting, CSRF protection: legitimate interest (Art. 6(1)(f)).
• Sending email — email confirmation and invitations: performance of the contract; the weekly recommendations digest: legitimate interest, with one-click unsubscribe in every message.
• Optional analytics and advertising — only on your consent (Art. 6(1)(a) GDPR), separately for each purpose; you can withdraw it at any time.
• Meeting provider requirements — Atlassian personal data reporting.

Application data is stored in Microsoft Azure, Poland Central region. We use these Microsoft services:

• Azure App Service — the application and the website.
• Azure SQL Database — the database.
• Azure Key Vault — encryption keys and integration client secrets.
• Azure Functions — a separate application that sends the recommendations digest once a week.
• Azure Communication Services (data location: Europe) — sending email: email confirmation, invitations, the digest. The delivery log records that a message was sent, not its content.
• Azure AI Foundry (Azure OpenAI) — optional plain-language phrasing of recommendations. The model receives only the facts of one recommendation and the rule’s description: no records, code or addresses, with people’s names replaced by placeholders. The model is deployed as Global Standard, so Microsoft may process the request in another Azure region. Microsoft does not use this data to train models.

When optional measurement is enabled and you consent, Google processes browser and device information, approximate location derived from the connection, pseudonymous cookie identifiers, page categories, actions and campaign codes. We do not send form contents, account identifiers or connected workspace records. Google may process data outside the EEA under its applicable data-processing and transfer terms. See Google’s privacy policy. Google Analytics event retention is controlled by the configured property; contact us for access or deletion requests.

Calls to the APIs of connected providers (GitHub, GitLab, Atlassian, Linear, Microsoft, Google) go from our server to their endpoints; those providers process data under their own policies. Demo bookings are separately processed by Cal.com and connected calendar and conferencing services, as described above.

• account and workspace data — as long as the account or workspace exists;
• records from a source — as long as the source is connected; they are deleted when it is disconnected;
• a sign-in session — 12 hours;
• data of closed Atlassian accounts — erased within the next 7-day reporting cycle;
• database backups — until the Azure SQL backup retention period ends, after which Azure deletes them.

To delete your account or a whole workspace with its data, write to cooperation@nythrex.com. We will delete the data within one month and confirm it.

You have the right to access your data, to have it corrected or erased, to restrict its processing, to data portability and to object to processing based on legitimate interest. To exercise a right, write to cooperation@nythrex.com — we will answer within one month.

If your data reached Nythrex from a source connected by your employer or team (for example, you authored commits or are an assignee in Jira), the quickest route is the owner of that workspace. You can also write to us — we will pass the request to the workspace owner and help carry it out.

You can lodge a complaint with a supervisory authority: the Ukrainian Parliament Commissioner for Human Rights (governing law: the law of Ukraine); if you are in the EU, also the data protection authority of your country.

The website and application store your analytics and advertising choices in nythrex-consent-v1 for 180 days, shared across nythrex.com and app.nythrex.com. Both optional categories are off by default. Google Tag Manager loads only after you grant an optional category. Analytics measures page visits, active time, scrolling and product actions; advertising consent permits campaign measurement and personalised advertising. Clicking “Book a demo” loads a third-party Cal.com page, which may use its own cookies and browser storage.

The application also uses necessary cookies:

• __Host-NythrexV2.Session — the sign-in session; HttpOnly, Secure, valid for 12 hours.
• NythrexV2.Csrf — protection against cross-site request forgery (CSRF); Secure, SameSite=Strict, until the browser is closed.

The application also briefly keeps an invitation or email confirmation token and an unfinished project setup selection in the tab’s sessionStorage. This data disappears when the tab is closed. The necessary nythrex-language cookie remembers your chosen language for one year. With analytics consent, Google Analytics may use _ga and _ga_* browser identifiers, configured for up to 180 days without sliding renewal. If advertising tags are enabled with your permission, Google may also use advertising identifiers. You can refuse either optional category and change or withdraw consent through “Cookie settings” on every page. Withdrawal removes accessible Google measurement cookies and reloads the page to stop loaded tags; it does not erase data already processed by Google.

• all traffic goes over HTTPS with HSTS;
• passwords are stored only as hashes; after 5 failed attempts sign-in is locked for 15 minutes;
• provider tokens are encrypted, with the keys protected in Azure Key Vault;
• Azure services reach each other with managed identities, without stored passwords;
• access to workspace data is limited by role, and workspaces are isolated from each other.

If we change what data we process or who receives it, we will update this page and the effective date at the top.

Questions about this policy and your data: cooperation@nythrex.com.
Individual Entrepreneur Kyrylo Ruslanovych Kucherenko (ФОП Кучеренко Кирило Русланович), 24 Pid Holoskom St., Lviv, Ukraine.