Privacy Policy · Coloom

This policy explains what Coloom collects, how it uses your data, who we share it with, and what choices you have. It applies to everything at coloom.ai and the per-project sandbox subdomains (*.dev.coloom.app).

We try to keep it short, specific, and honest. If something here is unclear, email privacy@coloom.ai — we'd rather change the policy than have it misread.

1. What we collect

Account data

When you sign up via Google or email, we store: your email address, display name, and (for Google) your avatar URL. We store a Google subject ID so subsequent sign-ins resolve to the same account.

Project data

When you create a project we store its name, description, slug, sandbox configuration, your linked GitHub repository names, and project-level memory the agent accumulates (a compact summary of what your project is and the conventions you prefer). We do not store a copy of your repository content in our application database — that lives in your sandbox's encrypted EFS volume, which is destroyed when the project is destroyed.

Chat & agent activity

Every chat message, ticket, and agent task run gets recorded so you can reload conversations, audit who triggered what, and let the AI use its own past context. AI-completion summaries are stored verbatim so the conversation history remains useful even after a sandbox is paused or destroyed.

OAuth tokens

If you connect Claude, ChatGPT, Supabase, Vercel, or GitHub via OAuth, the resulting tokens are stored encrypted at rest in AWS Secrets Manager (per-user for the OAuth tokens; per- project for the sandbox copy of the active token). The encryption key never leaves AWS. Google connector tokens are handled differently — see §5.

Billing data

Stripe handles all payment-method data. We store your Stripe customer ID and your prepaid credit-wallet balance and ledger (top-ups and metered usage debits). We never see your card number or bank details.

Infrastructure logs

We log API requests, sandbox lifecycle events (boot, idle, terminate), and abuse-related signals (network egress bytes per task, sustained CPU). Logs include user IDs and IP addresses, retained for up to 90 days. We do not retain raw bodies of your chat messages in operational logs.

2. How we use it

We use the data above to:

Run the product you signed up for — host your sandboxes, route messages to the AI agent, deploy your code, send transactional email.
Bill you for usage (Stripe), keep you out of the destroy queue when you've paid, and stop charging when you cancel.
Detect and stop abuse — sandboxes used for spam, DDoS, crypto mining, or anything that endangers other customers.
Make the agent smarter on your specific project (project memory). Memory stays scoped to the project that learned it; it is never shared across customers.
Respond to support requests and email you about important account events (trial ending, payment failed, sandbox failed to start, projects scheduled for deletion).

We do not sell your data. We do not use your code, your prompts, or your AI outputs to train any model. See §4 for what the AI providers do.

3. Who we share with

Coloom is a small product built on existing infrastructure. The following sub-processors see specific slices of your data:

Amazon Web Services — hosts the database, runs every sandbox container (Fargate), stores secrets + uploaded images. Same physical region (us-east-1) for all of the above.
Anthropic, OpenAI,Google — the AI providers you connect. Coloom forwards your prompts + relevant project context to whichever provider you've authorized. Token usage is governed by that provider's terms; their data-use policies apply.
GitHub — when you connect a repository, Coloom reads and writes that repo using your GitHub App installation token. Code is mirrored into your sandbox's private workspace.
Supabase, Vercel — per-user integrations you opt into. Coloom holds an OAuth token that grants the scopes you approved in their consent screens.
Stripe — payment processing. They receive billing email, country, and the metadata we tag your subscription with.
Amazon SES — sends transactional email (account notifications, trial reminders, abuse warnings).
Google Sign-In — verifies the OAuth ID token if you signed up that way.

We may also share data when legally required (subpoena, court order) or to protect other users (e.g. when an abuse investigation crosses provider lines). We push back on overbroad requests where we can.

4. AI providers & training

When you run an AI task in Coloom, your prompt + the project context the agent needs (file contents, recent chat history, repository metadata) are sent to the AI provider you connected.

Coloom does not train on your data. We do not retain prompts in any system designed for model training, and we do not share data with any third party for that purpose.

Each AI provider has its own data-use policy. Anthropic and OpenAI both publicly commit to not training on data sent through their API products, but you should review each provider's policy directly:

5. Google user data

Coloom has an optional personal Google connector. Nothing in this section applies unless you connect a Google account under Settings → Connectors. Signing in with Google is separate: it only uses the account data described in §1.

What we access

When you connect, you choose a Google account and approve these permissions on Google's consent screen:

Your email address (openid, email) — to show which Google account is connected.
Google Calendar (calendar.readonly, calendar.events) — to read your events and to create, update, or delete events when you ask.
Google Docs (documents) — to read and edit documents you point the AI at, and to create new documents.
Google Sheets (spreadsheets) — to read and edit spreadsheets you point the AI at, and to create new spreadsheets.
Google Slides (presentations) — to read and edit presentations you point the AI at, and to create new presentations.
Google Drive (drive.file) — only files that Coloom created or that you opened with Coloom: create files and folders, and change sharing on them when you ask. We cannot list or search the rest of your Drive.

How we use it

We use Google user data only to carry out the action you requested — yourself, or through an AI session you are running in Coloom (for example “add this meeting to my calendar” or “update the numbers in this sheet”). Each request runs on our servers with your own connection. Your Google tokens never enter a project sandbox, and other members of your projects cannot use your connection.

Storage

Your Google access and refresh tokens are stored encrypted at rest in our database. We do not keep a separate copy of your Google content. What you or the AI write into a chat, ticket, or project (for example a quoted paragraph from a document) is kept as part of that chat or project, under §6.

Sharing

To carry out a request, the Google content it needs is sent to the AI provider you chose for that session (see §4), only for that request. We do not sell Google user data, use it for advertising, or share it with data brokers. No one at Coloom reads your Google data, except with your explicit permission for a specific case, when needed for security or abuse investigations, or when required by law.

Limited Use

The use of raw or derived user data received from Google Workspace APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data to develop, improve, or train generalized or foundational AI/ML models.

Disconnecting

Disconnect the Google connector in Settings → Connectors at any time. We then delete your stored Google tokens and ask Google to revoke the grant. You can also remove Coloom's access at myaccount.google.com/permissions.

6. Retention & deletion

Active account data lives as long as your account does. When you delete a project, we:

Soft-delete the project record (hidden from your UI immediately).
Tear down the sandbox CFN stack (ECS service, EFS file system, target group, listener rule).
Delete the project-scoped secrets in AWS Secrets Manager.
Release the ALB slot.
Stop metering the project — no further wallet debits.

Chat messages, tickets, and audit log rows referencing the deleted project are retained but hidden — they may be hard- deleted in a future sweeper job. If you want immediate hard deletion of any record, email privacy@coloom.ai.

If your wallet balance runs out (top-up failed, or you simply stopped paying), your paused sandboxes are kept around for a 30-day grace period — long enough to top up and resume — then everything is permanently destroyed by an automated reaper. You'll get an email warning 7 days before the destroy.

7. Your rights

You can:

Access — see and download your projects, chat history, billing history through the app.
Correct — change your display name, avatar, and email-via-account-settings (some flows require sign-in via the new email).
Delete — destroy any project; close your account by emailing privacy@coloom.ai.
Export — request a JSON dump of your account data via the same email. We'll deliver it within 30 days.
Opt out of marketing email (you'll still get transactional account email).

If you're in the EU / UK, you have GDPR rights including the right to lodge a complaint with your local data protection authority. Coloom's legal basis for processing your data is contract (running the service you signed up for) and legitimate interest (preventing abuse).

If you're in California, you have CCPA rights. We don't "sell" personal information in the CCPA sense.

8. Security

OAuth tokens are encrypted at rest with a key held only in AWS Secrets Manager. All in-flight traffic is TLS-only. Sandboxes run in isolated Fargate tasks with no network path to our metadata database. We have access logs, alarms on abuse signals (egress / CPU spikes), and a human-in-the-loop kill switch for compromised accounts.

Coloom is not currently SOC 2 / ISO 27001 / HIPAA / FedRAMP certified. If your use case requires those, please email first.

9. Children

Coloom is not designed for users under 16. We don't knowingly collect data from children. If you believe a minor has created an account, email privacy@coloom.ai and we'll delete it.

10. Changes to this policy

We'll update this page when our practices change. Material changes (new sub-processor, new data category) get an email notification to active users. The "Effective" date at the top reflects the current version.

11. Contact

Email privacy@coloom.ai for anything in this policy. For security disclosures use security@coloom.ai.