Privacy

Last updated: September 28, 2026.

Who we are

CodexNest is a tool that helps you turn text files and notes into one clear, portable prompt you can copy into an AI assistant such as ChatGPT, Claude, Gemini, or OpenAI Codex. CodexNest is independent and is not affiliated with or endorsed by OpenAI, Anthropic, or Google. The service is operated by Piano Latino LLC based in California, United States. For privacy questions or requests, use our contact form (the reliable channel ) or email hello@codexnest.com; a postal address is available on request.

Who can use CodexNest

You must be at least 16 years old to use CodexNest.

What we collect, why, and where it goes

Your prompt content (files and pasted notes)

• Not signed in: your working files and notes remain in your browser. When you request a preview, selected source text is sent to our server to assemble it. Guest previews are not saved in our database. Your browser temporarily keeps selected source text during signup so you can resume.
• Signed in: your project — including imported content and generated master-prompt versions — is saved to your account in our database so it's available across devices. We process this content only to run the service (import, spot duplicates, organize, and assemble your prompt). We do not sell it and do not use it to train any AI model.

Account information

When you sign in, authentication is handled by WorkOS (AuthKit). We store a small account record — your user id and email address — to own your data and show you as signed in.

Payment-related records

Stripe processes subscription payments and handles card details. We store Stripe customer and subscription identifiers, plan, status, billing period, and monthly unlock counts to provide your plan. We do not store card numbers. Billing records needed for accounting or legal obligations may be retained after account deletion.

Contact messages

If you use the contact form, we store your name, reply email, and message so we can respond, and we email them to our team (delivered via Zoho Mail) to reply. We also keep a one-way hashed version of your IP address, used only for rate-limiting and abuse prevention.

Service providers (sub-processors)

• WorkOS — authentication.
• Neon — hosts our PostgreSQL database (your account, projects, contact messages).
• Vercel — hosting and domain.
• Zoho Mail — delivers contact-form messages to our team.
• Google Fonts — serves the page fonts (may receive your IP as part of loading the fonts).
• Stripe — payment processing.

Anonymous usage totals

To prevent automated preview abuse, we temporarily store a keyed, one-way hash derived from the requesting IP address and a ten-minute window, along with a request count and expiry time. We do not store the raw IP in this rate-limit table. Expired entries are deleted when the next preview request is checked.

If enabled, optional Google Analytics helps us understand visits to public pages. It loads only after you choose “Allow analytics”; you can withdraw your choice through Analytics preferences. We honor Do Not Track and Global Privacy Control. Our page-view events exclude URL query strings, prompt content, email addresses, and account IDs. Google may process browser and device information, IP addresses, and analytics cookies under its privacy policy. Administration pages do not load Analytics.

We count homepage loads, successful previews, signup-gate displays, newly created accounts, and first prompt unlocks to understand where the service can improve. These measurements store only a UTC date, event name, and total count — no prompt text, email, account identifier, IP address, or visitor identifier. No analytics cookies are used. We skip these measurements when a request signals Global Privacy Control or Do Not Track. Totals older than 90 days are removed when the next measurement is recorded. Hosting providers may separately process operational request logs.

Cookies and local storage

We use only the cookies needed to run the service — no analytics or third-party tracking cookies:

• A session cookie to keep you signed in, and a short-lived cookie during the sign-in redirect.
• Your browser's local storage, to keep your in-progress work (and, when not signed in, your saved projects) on your device.

Retention and deletion

• We keep your account and project data while your account is active. We don't automatically delete your saved projects, including when plan limits change.
• Delete your data anytime: email hello@codexnest.com or use the contact form and we'll delete your account and its data within 30 days.
• Contact-form messages are kept only as long as needed to handle your inquiry and for abuse prevention.
• Work stored only in your browser (when you're not signed in) stays on your device; clearing your browser data removes it.

Your content and your control

• You own the content you upload or paste and the prompts you generate. You grant CodexNest only the limited permission needed to store, process, and show that content back to you so the service works.
• You can export source work and previously unlocked prompts. New full outputs require signup and an available allowance; partial previews do not include the complete output.

Your regional rights

Because CodexNest is offered internationally and operated from California, privacy laws including the EU/UK GDPR and the California Consumer Privacy Act (CCPA/CPRA) may apply to you. Where they do, you may have rights to access, correct, delete, or export your data, and to object to or restrict certain processing. To exercise them, use the contact form or email hello@codexnest.com; we'll respond within 30 days.

Changes

We'll post changes to this notice here and update the "last updated" date above.