Privacy Policy

Conifer Solutions, Inc., a Delaware corporation, is the controller of the personal data described in this policy.

• Contact: contact@conifer.build

The same address receives all privacy questions, data-subject requests, and security reports.

2.1 Website analytics

When you visit conifer.build, we record the pages you visit, how you reached them, including the referrer and any campaign, how you interact with them, your coarse country, and your browser's user agent. To count visitors without identifying them, we store a hash of your IP address and user agent that changes every day, rather than the address itself. Where your browser sends a Do Not Track or Global Privacy Control signal, we do not compute that hash or record your country.

When you download Parallax from our site, we record the download and where it came from, and if you then sign in to Parallax, we link that record to your account.

We use no third-party analytics service.

2.2 Accounts, teams, forms, and purchases

• Account. Your email address and, if you create one, a password, which our authentication provider stores only as a hash. If you sign in with Google or GitHub, we receive your email address and the profile details that provider shares, such as your name, picture, and username.
• Teams. If you belong to a company account in the console, its members can see your email address and your usage and spend, and its owners and admins can see the API keys you created.
• Forms. If you contact us or submit one of our forms, we keep what you send.
• Newsletter. If you subscribe to the newsletter, we record which issues you open and which links you click. Every email contains an unsubscribe link.
• Purchases. Payment is handled by Stripe, and card numbers do not reach Conifer. We share your email address and name with Stripe, and if you save a card, for example for auto-reload or a Parallax plan, Stripe charges it when we instruct it to.
• Account email. We email you about your account and the features you use.
• Slack. If you connect your account to Conifer's Slack app, it can read your account's balance and usage to answer your questions in Slack.
• Status board. If you report an outage on status.conifer.build or subscribe to its alerts, we keep what you send, and with a report, your IP address.
• Older Conifer apps. The Conifer desktop app and CLI are no longer offered. A copy that is still installed may keep sending us the usage data it was built to send, which is on by default, and, if you turned them on, samples of your prompt text, which are readable by Conifer staff. You can stop both in that app's settings or by uninstalling it.

2.3 API requests

Where a request goes. The gateway sends a request to a provider that serves the model you named. If that provider fails, the gateway may retry the request with another provider that serves the same model, and if you list fallback models, the request may go to their providers too, so a single request can reach more than one provider. Some open-weight models are served through an inference marketplace, which chooses the host that serves the request under that host's own terms.

Choosing the model. When you send auto, balanced, best, or beta-auto, the request's content also goes to the router that chooses the model, which may be our router service or a decision model hosted by one of our model providers. When you name a model, no request content reaches either.

What we store. We do not store the prompt of a standard request. A response is held in the gateway's response cache, where it is set to expire after ten minutes, so that a retried request returns the original response instead of incurring a second charge. The cache does not hold your prompt. If you ask us to run a request later as a deferred job, we store the request so that it can run, and it stays stored after the job has run until you ask us to delete it.

Usage data. For each request we keep metadata such as the account and API key that made it, the model, the provider, token counts, the charge, timings, and any error, without the text of the prompt or response. We use it to bill you, to provide support, and to keep the Service secure and reliable.

Your own API keys. Where you supply a provider key, we store it encrypted and bound to your account, and we never show it back to you beyond its last four characters.

Provider terms. The provider that serves a request handles it under its own terms, including how long it keeps requests and whether it may use them for training, which we do not set. This applies where you use your own key as well.

2.4 Parallax

Parallax is a desktop application that runs coding agents, such as Claude Code and Codex, and has models from other labs review their work.

Signing in. You sign in to Parallax with GitHub, Google, or a code or link we email to you. We receive your email address and the profile details your sign-in provider shares, such as your name, picture, and GitHub username, and your teammates in Parallax can see your name and picture. If you sign up with GitHub, we store a GitHub token for your account so that Parallax can act on GitHub for you.

What Parallax uploads. When you sign in, Parallax connects the coding agents it finds on your machine, unless you choose to connect them yourself. From then on, it uploads their sessions to your account as they run: your prompts, the agent's replies, its tool calls and their results, the commands it ran, and the changes it made to your repositories, including new files not yet committed. Sessions on a Parallax cloud machine are uploaded in the same way.

Memory. Parallax's memory, which is on by default, also sends your prompts, your agents' tool calls, and your corrections to your account and to models through our gateway, so that it can learn the rules you give your agents and bring them up when they apply.

Your controls. You can delete a session from your account, stop uploads from a machine, or revoke a machine's access. To delete everything Parallax holds for your account, including reviews, write to us.

Reviews. Reviews run on our servers. A review receives the session and a copy of the repository, and the models it uses are reached through our gateway, as described in §2.3.

Research dataset. When a review finds that a coding agent misunderstood or went against what its developer asked, we keep a record of that incident in a research dataset, including the prompts and corrections the review cites, word for word. We use it to study how coding agents fail the people using them and to improve Parallax. There is no fixed retention period for it yet.

Cloud machines. A Parallax cloud machine runs on our hosting provider. Its disk holds your repository's code and whatever you and your agents put there, and Parallax sends it the sign-ins and keys your agents need there, such as your Claude, Codex, GitHub, and Conifer credentials. Deleting the machine deletes its disk.

Your Claude and Codex sign-ins. Parallax uses the Claude Code and Codex sign-ins on your machine to run those agents for you, including on machines you have paired and on your cloud machines.

Models through Conifer. Conversations with the free models in Parallax, and with any other model you run through Conifer, go through our gateway, as described in §2.3. When a session uses beta-router, your prompts and the agent's replies also go to our gateway to choose the model.

The GitHub App. If you install the Parallax GitHub App, it reads the pull requests and code of the repositories you choose so that it can review them. It may post review comments, which on a private repository may quote your requests in the session, and it may open pull requests and issues.

Usage data. Parallax sends us basic usage data by default, such as your app version, operating system, account identifier, and totals of tokens and cost, but no prompt text or code. You can turn it off in Settings. Detailed error reports, and "Share what you ask", which sends us the text of your requests, are off unless you turn them on. Parallax also checks GitHub for updates.

The phone app. The Parallax phone app connects to the machines you have paired through our relay. Its notifications are delivered through Expo, Apple, and Google, and show the session's title and what it is waiting on.

For users in the EU, the UK, and other regions with equivalent law, our legal bases under the GDPR are as follows.

We do not carry out automated decision-making that produces legal or similarly significant effects concerning you.

We share personal data with the subprocessors listed on our subprocessors page, which describes each one, the data it receives, and why.

Otherwise, we disclose personal data only:

• where you direct us to do so;
• to comply with a valid legal obligation; or
• in connection with a merger or acquisition, in which case this policy continues to apply until you are given notice of a replacement.

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

You may ask us to delete data sooner, and we will do so unless the law requires us to retain it, as it generally does for billing records.

All users. Wherever you live, you may ask us to access, correct, delete, or export your data, or to cease a particular use. Write to contact@conifer.build. We will respond within the time the law requires, and we will not charge you or treat you differently for making a request.

GDPR and UK GDPR. Where the GDPR or UK GDPR applies to you, you have the rights of access, rectification, erasure, restriction, portability, and objection, together with the right to withdraw consent at any time. Withdrawal does not affect processing already carried out. You may also lodge a complaint with your national data protection authority, although we ask that you raise the matter with us first.

California. The CCPA and CPRA give you the rights to know, to delete, to correct, and to opt out of the sale or sharing of personal information, and the right not to be discriminated against for exercising them. We do not sell or share personal information, so there is no opt-out to exercise; the Global Privacy Control signal is honoured on our website in any event. In the preceding 12 months we collected the categories described in §2 and disclosed them only as described in §4.

Other US states. Virginia, Colorado, Connecticut, Utah, Texas, and other states provide substantially the same rights. We extend the same process to all users.

Controls you can use yourself.

• Choosing providers. A provider allow-list, set with PUT /v1/account/allowed-providers, limits your account to the model providers you name.
• Naming a model. Naming a model, rather than asking us to choose one, keeps your request's content away from the router.
• Deleting your account. You can delete your account in the console, and your stored provider keys and routing settings with DELETE /v1/account. We keep certain records, such as billing and purchase records, as described in §5. To delete anything else, write to us.
• Parallax. You can delete a session, turn off uploads or usage data, and delete a cloud machine, as described in §2.4.

• The API and the website are served over HTTPS.
• Provider keys you supply are stored encrypted.
• Passwords are stored only as hashes, by our authentication provider.
• Payment card data does not reach our systems; Stripe collects it directly.

No system is perfectly secure and we do not represent that ours is. If you identify a vulnerability, write to contact@conifer.build and we will work with you.

Conifer is established in the United States, and we process your data primarily there. Model providers process the requests they serve on their own infrastructure, in locations they choose, and some of them are based outside the United States; our subprocessors page names them. If your requests should stay with particular providers, set a provider allow-list, as described in §6. Business customers who need contractual safeguards for transfers from the EU, the UK, or Switzerland can sign our Data Processing Addendum.

The Service is not intended for children under 13, and we do not knowingly collect personal data from them. If you are between 13 and 18, you may use the Service only with the involvement of a parent or guardian.

If you believe that a child under 13 has provided us with personal data, write to contact@conifer.build and we will delete it promptly.

We set no cookies, and we use no analytics or advertising cookies. Cloudflare, which hosts and protects our site, may set a security cookie (cf_clearance) when your browser passes its bot check. Stripe, Google, and GitHub set their own cookies on their own sites when you pay or sign in there.

We use your browser's local storage for your sign-in session and settings, for the analytics described in §2.1, and for a short-lived copy of your console data. Clearing your browser storage clears it.

Where we change this policy, we update the version date at the top of this page and publish the new version at this address. For a change that materially reduces your privacy protections, we will give at least 30 days' notice before it takes effect, by email where we hold your address and in the application, so that you may object, export your data, or stop using the Service beforehand.

We will not apply a materially different use to data already collected without first asking you.

Questions, requests, and complaints: contact@conifer.build

Conifer Solutions, Inc.

Version history: 2026-10-22 — updated to describe the current Service: the API and its routers, the console, and Parallax. Removes products that are no longer offered.

Version history: 2026-09-26 — adds Parallax session capture and review (section 2.6), its retention, and Fly.io as its host.

Version history: 2026-08-13 — first complete policy; replaces the 2026-08-04 summary. Adds legal bases, retention, rights, subprocessors, transfers, children's privacy, and full disclosure of the prompt-sample channel and the gateway response cache. 2026-11-02 — removed the postal address; email is the contact.