Privacy Policy

This policy explains how Wex Labs Limited ("Wex Labs", "we", "us") uses personal data when you use Cusp: the desktop app, CLI and local agent runtime (the daemon), editor extensions, the iOS app, the web app at app.cusp.run, the cloud, the managed model gateway, Cusp Hub and our website cusp.run.

We are the controller of the personal data described here. When a business customer uses Cusp to process personal data inside its own code and content, we act as its processor, under our Data Processing Addendum, and that customer's privacy notice applies.

Contact: privacy@cusp.run · Wex Labs Limited, The Sati Room, 12 John Princes Street, London W1G 0JR, United Kingdom · ICO registration number [ICO NUMBER]. EU representative (GDPR Article 27): [NAME, ADDRESS, EMAIL].

1. The short versionCopy Anchor Link

• Your code stays on your computer. The agent runs on your computer. Your code, sessions and keys stay on your device unless you use a cloud feature, such as sync, cloud runners or artifacts.
• Synced sessions are encrypted on your devices. Once you've set up encryption, each computer encrypts your sessions before they sync. We store them but can't read them; we still see the metadata we need to sync and bill.
• You need a Cusp account, so we hold your account details. Beyond that, we receive only what the cloud features you use need, plus crash reports and usage metrics if you opt in.
• Model providers see what the agent sends them: your prompts and the code and files the agent reads. With your own keys, that's between you and the provider. With Cusp's managed gateway, we pass it to the provider and keep only usage metadata, never the content. See AI and Model Providers.
• We don't train AI models on your code or content, and we don't sell your personal data.
• No ads, no analytics trackers, no third-party cookies. Telemetry is off unless you turn it on.

2. What stays on your deviceCopy Anchor Link

The desktop app, CLI and daemon store your work locally, in a data folder on your computer (~/.cusp, or ~/Library/Application Support/run.cusp.desktop on macOS):

• sessions and their full transcripts, file checkpoints, worktrees, large tool outputs, local usage and budget records, and an audit log of permission decisions and network connections;
• your settings; and
• your model provider keys, which are stored in your operating system's credential store (such as macOS Keychain), never in plain files.

The apps also work out things on your device that never leave it: an activity log of what each installed extension did (tools called, files touched, hosts contacted, kept for 30 days), your project's technology stack (detected from files such as package.json) and extension suggestions based on your own session history.

We can't see this data. You can delete it at any time by deleting the data folder. The iOS app likewise keeps its data on the device, and runs voice transcription and its on-device assistant locally. If you allow it, the iOS app reads your calendars and reminders on the device to answer your questions; that data isn't sent to us.

3. What we collect, and whyCopy Anchor Link

3.1 Your accountCopy Anchor Link

When you create an account: your name, email address, password (stored only as a secure hash) or passkey, your workspace (organisation) and team memberships and roles, and the invitation you used. If you sign in with GitHub, we receive your GitHub username, email and avatar.

Why: to create and run your account and provide the Services (contract), and to keep the invite-only beta invite-only (legitimate interests).

3.2 Sign-in and security dataCopy Anchor Link

When you sign in: session records including your IP address and browser or device type, devices you've linked (device name, platform, last seen), device public keys, API and gateway keys (stored as hashes), and a security log of sign-ins and administrative actions. If you belong to a team workspace, that workspace's log records your sign-ins (with IP address and browser or device type) and changes you make to keys, devices, invitations, members, roles, billing and settings, and the workspace's owners and admins can view and export it.

Why: to keep you signed in, protect your account and our systems, prevent fraud and abuse, and investigate incidents (legitimate interests and contract).

3.3 Cloud content (when you use cloud features)Copy Anchor Link

Sync is your choice. Each computer asks you once, after you sign in (or when you run cusp login), whether to sync your sessions across your devices. Until you choose Sync, and if you choose Not now, nothing from that computer's sessions is copied to the cloud: no sessions or their history, crew conversations, artifacts or inbox items. Your account, Cusp models, billing and remote control still work. We record your choice for each computer and when you made it. You can change it at any time in Account → Computers. Turning sync off stops new copies but doesn't delete what was already synced; delete that yourself, or use Account → Your data.

With sync on, artifacts the agent builds for you (pages, documents, apps) are stored in the cloud, so you can open them on any device and share them by link. They're private to you until you change who can see them (§3.15). Attachments and images aren't uploaded: the cloud keeps only a reference and fetches them from your computer when you open them on another device.

Encryption. Once your account has encryption set up, each computer encrypts your sessions before syncing them: your messages, the agent's work and its output, titles, crew conversations and inbox text. Only your enrolled devices hold the keys. Artifacts can't be encrypted yet, so while encryption is on they don't sync: they stay on your computer. We store the encrypted copies but can't read them. To sync and bill, we still see metadata: account, device, workspace and session identifiers, the type and time of each event, approximate sizes, and the model, tokens and cost of each request.

• Before setup: until you finish setting up encryption, sessions sync as before and are readable on our servers.
• Earlier sessions: sessions synced before encryption are re-encrypted on your device. We delete the unencrypted copy once the encrypted one is verified, and it leaves our backups within 27 days.
• Recovery: we keep no copy of your keys. Without one of your devices or your recovery phrase, encrypted sessions can't be recovered.
• Web app: in the browser, encryption runs in code that our servers deliver.
• Not end-to-end encrypted: content you share (shared sessions, public artifacts); sessions you move to a cloud runner, which run there; requests to Cusp's managed models, cloud dictation and managed web search, which pass through our gateway (§3.5, §3.13, §3.14); and sessions synced by an older app version until it's updated.

If you link a device to the cloud (cloud sync), use cloud crews or cloud runners, move a session between your computer and the cloud (teleport), share a session, or publish an artifact, we store and process the content involved (for sync, in encrypted form once encryption is set up). This can include:

• workspace details (name, local folder path, git branch and remote URL);
• full session transcripts: your prompts, model responses, the agent's tool calls and their output, including the contents of files, diffs and command output;
• session exports and code patches you move to or from the cloud; and
• messages between agents, crew tasks and approvals.

Remote control. If you use the web app to follow or steer a session running on one of your computers, the session's content passes through our relay to reach your other device. The relay forwards it and doesn't store it. With encryption set up, the content is encrypted between your devices, so the relay can't read it; older desktop app versions can't reach an encrypted computer until they're updated.

Organisations that keep code on their computers. A workspace admin can turn on the "code stays on device" policy. Members' computers then send no session content to the cloud: no messages, tool output, titles, crew logs, inbox text or private artifacts, and no attachments. Only the metadata needed to coordinate devices and bill is sent (identifiers, status, timestamps, model and counts). Each computer enforces the policy and so does our cloud, which refuses content from that workspace. Cloud runners and moving sessions to the cloud are unavailable. Cusp's managed models and the remote-control relay are off unless an admin explicitly allows them; if allowed, prompts and session content pass through without being stored.

Why: to provide the cloud features you've chosen (contract). This content may include personal data about other people, such as names in commit history. If you use Cusp for an organisation, we process that data for the organisation under the Data Processing Addendum.

3.4 Model provider keys you store in the cloudCopy Anchor Link

If you add provider keys to your workspace in the cloud, we keep them encrypted (envelope encryption under a master key held separately from the database) and use them only to make requests that you or your workspace members start.

3.5 Managed gateway usageCopy Anchor Link

When you use Cusp's managed model gateway, we forward each request to a model provider and record usage metadata: the workspace, user and key that made the request, the model and provider, the app it came from, token counts, cost, status and latency.

We don't store the content of prompts or responses on our servers. It passes through to the provider and back. Content is stored only if you've separately turned on a cloud feature that stores sessions (3.3). We tell the providers that serve these requests not to collect or train on them, and on Team and Enterprise plans an admin can require zero data retention, so providers don't keep them at all. See AI and Model Providers.

Why: to provide and bill the gateway, apply your budgets and our rate limits and caps, prevent abuse, and understand capacity and costs (contract and legitimate interests).

3.6 PaymentsCopy Anchor Link

If you buy a paid plan, our payment provider, Stripe, collects your card or other payment details. We never see your full card number. We receive and keep your Stripe customer ID, subscription and invoice records, billing email and address, VAT number if you give one, and payment status. If you subscribe through the iOS app, Apple handles the payment and tells us only the subscription status.

Why: to take payment and manage your subscription (contract), and to keep accounting and tax records (legal obligation).

3.7 Crash reports and usage metrics (off unless you opt in)Copy Anchor Link

The apps and CLI ask once whether to send crash reports and usage metrics. Both are off by default, and you can change them at any time in Settings → Privacy. Setting DO_NOT_TRACK=1 or CUSP_TELEMETRY=off, or enabling Do Not Track in your browser, turns both off whatever you chose.

If you opt in, we receive:

• crash reports: a random installation ID (deleted when you opt out), which app, its version, your operating system and architecture, the error type and message, and the stack trace; and
• usage metrics: counts and timings of product events (for example, which features are used and how long operations take), with a fixed list of allowed attributes.

Reports are scrubbed on your device and again on our server to remove file paths, user names, secrets, tokens and code. They aren't linked to your account. We don't store your IP address with them; we use a one-way hash of it only for rate limiting. Crash reports may be processed by our error-monitoring provider (see Sub-processors).

Why: to find and fix bugs and improve Cusp (consent; you can withdraw it at any time). We keep these reports for no longer than 90 days.

3.8 Push notifications (iOS)Copy Anchor Link

If you allow notifications, we store your device's push token and your notification preferences, and send notifications through Apple's Push Notification service. Notifications contain only short titles and identifiers, not your code.

Why: to send the notifications you asked for (contract; you can turn them off in iOS Settings).

3.9 GitHub integrationCopy Anchor Link

If you install the Cusp GitHub App or connect GitHub, we receive information about the installation (the account or organisation name and the repositories you selected) and the events GitHub sends us, such as issues, comments, pull requests and checks, which can include usernames and text written by other people. We keep event payloads only briefly, to process them reliably.

Why: to provide the GitHub features you've set up (contract, or legitimate interests for other people's data in the events).

3.10 Cusp HubCopy Anchor Link

If you publish on the Hub, we process your publisher profile, verified domains, the extensions you publish and the signatures and logs we create for them. Our transparency log is permanent by design: it records which publisher released which version. If you write a review, your display name, rating and review are public. We count installs in aggregate.

Why: to run the Hub and keep it safe (contract and legitimate interests).

3.11 Talking to usCopy Anchor Link

When you email us, send feedback from the app, report a problem or take part in research, we keep the messages and any details you share. Feedback sent from the app goes to our support inbox with your email address, so we can reply.

Why: to help you and improve Cusp (legitimate interests).

3.12 Our websiteCopy Anchor Link

cusp.run doesn't use analytics, advertising or tracking cookies. It sets one cookie to remember your language, and stores your theme choice in your browser. See our Cookie Policy. Our hosting provider, and Cloudflare, which delivers and protects our sites, process standard server logs (IP address, request and browser type) to deliver and protect the site.

3.13 Dictation (voice input)Copy Anchor Link

When you dictate with cloud dictation, the default way to talk to Cusp, your voice is streamed live from your device through our gateway to our speech-recognition provider, ElevenLabs, which turns it into text. To help it recognise technical words, we also send a short list of hint words from the session you're working in, such as project, branch, file and symbol names and crew member names. ElevenLabs also applies your dictation settings, such as leaving out filler words. The microphone is used only while you're dictating.

We don't store or log the audio or the transcribed text on our servers. The text goes into your message like anything you type. ElevenLabs processes the audio as our sub-processor and doesn't use it to train its models; it may keep it under its own data processing terms, which don't set a fixed period. ElevenLabs offers zero retention only on its Enterprise plan, which we don't use yet. Your voice always passes through our gateway on its way to ElevenLabs, so dictation is never end-to-end encrypted. If your organisation keeps code on its computers, cloud dictation is off; on macOS you can use on-device dictation instead, which never leaves your computer.

Why: to provide the dictation feature you use (contract).

3.14 Web searchCopy Anchor Link

When the agent searches the web using Cusp's managed search (rather than a search key of your own), the search query is sent through our gateway to our search provider, Perplexity, which returns the results. The agent writes the query from your session, so it can include words from your work, such as names of libraries, errors or topics. We don't store the query or the results beyond what's needed to return them; we record usage metadata (time, provider and cost) for billing. Perplexity processes the query as our sub-processor and, under its API terms, doesn't use it to train its models. Web search isn't end-to-end encrypted. We'll add any further search provider to the sub-processors list before it receives queries, and only one that doesn't train on them.

Why: to provide the web search feature you use (contract).

3.15 Hosted artifactsCopy Anchor Link

If you sync artifacts, we store each version's files, the snapshot of the data it showed when that version was saved, its title and its version history. They're stored with our hosting provider in the European Union (Amsterdam) and served from a separate domain, nibusercontent.com, so an artifact can't reach your account, your sessions or our app. Artifacts can't be end-to-end encrypted yet, so they don't sync while your account's encryption is on.

Who can see an artifact. It's private to you until you choose otherwise:

• Only you: you open it signed in, on your devices.
• Anyone with the link: anyone who has the link can open it, without an account. We ask search engines not to index it.
• Public: like a link, but search engines may list it.

Links are long random addresses that can't be guessed. The agent can't share an artifact on its own: you approve each share. People who open a shared artifact see the artifact and the data it was saved with. They don't see your name, your files, your chats, your comments or the version history. An artifact can send data only to websites you've allowed it to contact.

Turning sharing off. Making an artifact private, or turning a link off, stops the link working at once. The artifact stays stored, private to you, until you delete it.

People who open a shared artifact. We don't track them: no analytics, no view counts and no cookies on nibusercontent.com. To limit abuse, we count requests using a one-way hash of the visitor's IP address, which we keep for one minute. Cloudflare, which delivers the domain, and our hosting provider process standard server logs, as for our website; our hosting provider keeps them for up to 90 days.

Reports. Anyone can report a shared artifact using the report link on the page. We keep the report (its category, details and the page address, and the reporter's name and email), a keyed hash of the reporter's IP address to limit repeat reports, and our decision. We keep a report until we've decided on it, then delete all of it 365 days after our decision, so we can handle appeals and repeat abuse. An artifact reported for child safety, malware or phishing, or by two different people, is held automatically until a person reviews it (section 15 of the Terms of Service).

Deleting. When you delete an artifact, we delete its versions, links and comments immediately, and its files from our storage. We keep a minimal record of the deleted artifact (its identifier, link address and any moderation status), without its content, until you delete your account. Content we remove for breaking our rules is deleted 30 days after removal, so you can appeal. Deleting your account deletes all your artifacts and their files. Records of deleted artifacts may remain in our database backups, stored in the EU (Amsterdam), for up to 27 days; artifact files aren't kept in backups.

Why: to host and share artifacts as you ask (contract); to keep the service safe and handle reports (legitimate interests, and our legal obligations for content we host).

4. Legal bases (UK GDPR and EU GDPR)Copy Anchor Link

We don't intentionally collect special category data. Please don't put it into Cusp unless you need to, and if you do, make sure you have a lawful basis.

5. Who we share personal data withCopy Anchor Link

• Service providers (sub-processors) that host and run Cusp for us, such as Railway (hosting and databases), Cloudflare (network delivery and protection), Stripe (payments), OpenRouter (managed model gateway) and Apple (push notifications). The full, current list is on our Sub-processors page.
• Model providers, when you use the managed gateway: they receive the content of your requests. See AI and Model Providers.
• Services you connect, such as GitHub, MCP servers and Hub extensions, receive what you or your agent send them, under their own terms.
• Your workspace. If you're a member of a team workspace, its owners and admins can see workspace content and usage, view and export its security log (including your sign-in times, IP addresses and device types), and manage your access. If you delete your account, your name, email, IP address and device details are removed from the workspaces you leave.
• Professional advisers, such as lawyers, accountants and auditors, under confidentiality obligations.
• Authorities, when the law requires it, or to protect people's safety or our rights. We'll push back on requests that aren't lawful and, where allowed, tell you.
• A buyer or successor, if our business is reorganised, sold or merged, under the same protections.

We don't sell personal data and we don't share it for cross-context behavioural advertising.

6. International transfersCopy Anchor Link

We're based in the UK. Our hosting is in the European Union (the Netherlands). Our hosting provider is a US company, and some of our other providers are in the United States and other countries. When we transfer personal data outside the UK or the EEA, we use a lawful mechanism: an adequacy decision or regulations (such as the EU-US Data Privacy Framework and its UK Extension, where the recipient is certified), or the European Commission's Standard Contractual Clauses with the UK Addendum, together with additional safeguards where needed. Ask us for a copy of the relevant safeguards at privacy@cusp.run.

7. How long we keep dataCopy Anchor Link

We may keep data longer where the law requires it or to deal with a legal claim.

8. SecurityCopy Anchor Link

We protect personal data with measures suited to the risk. These include encryption of synced sessions on your devices (once set up), encryption in transit, encryption of stored provider keys, access limited to staff who need it, a sandbox and permission system for the agent, separate domains for user content, and signed app updates. Our Data Processing Addendum lists the measures in detail. No system is perfectly secure. If something goes wrong that's likely to put your rights at risk, we'll tell you and the regulator as the law requires. To report a vulnerability, see our vulnerability disclosure policy.

9. Your rightsCopy Anchor Link

Depending on where you live, you have rights over your personal data. Under UK and EU law you can:

• access your data and get a copy;
• correct inaccurate data;
• delete your data ("right to be forgotten");
• restrict or object to our processing, including processing based on legitimate interests;
• port data you gave us, in a machine-readable format; and
• withdraw consent at any time, for example by turning telemetry off in Settings → Privacy.

You can download a copy of your data (a machine-readable JSON file with your profile, workspaces, devices, usage and every synced session) and delete your account in the web app under Account → Your data (app.cusp.run/account/data), or email privacy@cusp.run. We'll respond within one month. We may need to confirm your identity first. Exercising your rights is free.

If you're unhappy with how we've handled your data, please tell us first at privacy@cusp.run. We'll acknowledge your complaint within 30 days and tell you what we're doing about it. You can also complain to the UK's Information Commissioner's Office (ico.org.uk, 0303 123 1113), or to the data protection authority where you live or work in the EU.

10. US residentsCopy Anchor Link

If you live in a US state with a consumer privacy law, such as California, you have the right to know what personal information we collect, use and disclose; to access, correct and delete it; and not to be discriminated against for exercising these rights. In the last 12 months we've collected the categories described in section 3: identifiers (name, email, IP address, device IDs), commercial information (subscriptions and payments), internet activity (usage metadata), and the content you choose to sync. We use it for the business purposes in section 3 and disclose it to the service providers in section 5. We don't sell or share personal information, as those terms are defined in the CCPA, and we honour Global Privacy Control signals, and we don't use sensitive personal information to infer characteristics about you. To exercise your rights, email privacy@cusp.run. An authorised agent can make a request for you with proof of authorisation.

11. ChildrenCopy Anchor Link

Cusp is for people aged 18 and over. We don't knowingly collect data from children. If you believe a child has given us personal data, contact privacy@cusp.run and we'll delete it.

12. Automated decisionsCopy Anchor Link

We don't make decisions about you based solely on automated processing that have legal or similarly significant effects. Our systems apply automatic rate limits, spend caps and security checks (for example, blocking a request that goes over a cap, or holding a Hub extension that fails a security scan). You can ask a person to review any such decision at support@cusp.run.

13. Changes to this policyCopy Anchor Link

We'll update this policy when our practices change, and tell you about significant changes by email or in the app before they take effect. The date at the top shows when it was last updated.