Privacy for a local-first account layer.

Ziko is local-first. The VS Code extension keeps the real Claude and Codex orchestration, workspace access, provider session reuse, and local session recovery on your machine.

That local state can include prompts, synthesized recommendations, provider session identifiers, tool activity, transcript history, and workspace-derived metadata needed to restore or continue a Ziko session.

When cloud sync or account-linked extension features are enabled, Ziko can upload synced session records to the getziko.com account layer. Those records are used for account history, usage visibility, extension linking, and future cross-device session access.

Synced records can include session titles, summaries, transcript content, synthesis output, provider metadata, usage events, linked installation information, and the session JSON needed to reconstruct the saved Ziko session in the dashboard.

The website and authenticated dashboard run on Vercel. Authentication, database storage, and row-level access control are implemented with Supabase. Billing and subscription lifecycle data are handled through Stripe.

Public browser code only receives public configuration values. Sensitive values such as Supabase service-role credentials, Stripe secret keys, and internal maintenance secrets stay server-side.

We use account, billing, usage, installation, and synced session data to operate the product: sign-in, billing, entitlement checks, usage dashboards, installation linking, cloud history, and support.

We do not need to proxy Claude or Codex execution through the website in order to deliver the product. The extension remains the local execution surface; the website is the account and backend-authoritative surface around it.

The dashboard includes controls to export synced sessions, delete synced sessions, revoke extension installations, and revoke all linked installations. The system also supports retention maintenance for expired or purged cloud records.

Deleting cloud data from the account dashboard does not automatically erase any separate local session data still stored on your machine.

For privacy questions, account-data requests, or security concerns, contact the Ziko operators through the address published on getziko.com before public launch. Replace this placeholder contact path with the production address before opening the service publicly.