Privacy Policy
This policy explains what information Recurz, Inc., a Delaware corporation (“Recurz”, “we”, “us”) collects when you use recurz.ai, the Recurz products (including Tracez, Rulez, Memoryz, Steerz, Fixez, Verdictz, Councilz, Tapez, Squadz, Graduatez and Hotpathz), the Recurz collector and menu-bar app, and the related APIs (together, the “Services”), and what we do with it.
The short version: you send us agent transcripts so we can store them and build monitoring, evals, routing and model training on them for you. They stay in your account. We do not sell personal information, we do not use your data to train models for anyone but you, and we do not use data from Google for anything except signing you in.
1. Information we collect
Account information
When you sign in, our authentication provider (Clerk) gives us your name, email address, profile picture and a stable account identifier. If you sign in with Google, see section 4 for exactly what we receive from Google. We also keep the organizations you belong to, your role in each, and whether your account has been admitted to the private beta.
Devices and credentials
When you enroll a machine, we store a device identifier, the organization and person it belongs to, a name for it, when it was enrolled and last seen, and whether it has been revoked. Device secrets are generated on your machine; we store only a cryptographic hash of them. App grants installed into an organization are stored the same way.
Transcripts and related content (“Customer Content”)
The core of the Services is storing the transcripts of coding-agent runs that you choose to send us, from the Recurz collector, the menu-bar app, an OTLP exporter or our APIs. Depending on the agent harness and what you enable, a transcript can include:
- prompts, model responses and reasoning, tool calls and their output;
- source code, file contents, file paths, working directories, shell commands, git metadata and diffs that the agent read or produced;
- the machine’s hostname and local username where the harness records them;
- model names, token counts, costs and timings.
Transcripts can contain anything an agent saw, which may include personal information, confidential business information or credentials that appear in your files or terminal. You control what the collector watches and can pause it at any time. Please do not send us data you are not permitted to share, and see section 9 on sensitive data.
We also store what the Services produce from your Customer Content: summaries, findings, eval campaigns and results, routing policies and decisions, datasets, and models trained for you.
Model calls routed through Steerz
If you use Steerz to route model calls, the requests and responses pass through Recurz so they can be measured and routed. We record each call’s metadata (model, routing rule, outcome, region, token counts, cost and timing) to your account, not its content. It never holds your prompt longer than the call. If you turn on response caching, matching answers are kept for up to 7 days, scoped to your org.
Questions asked of Councilz
When you or your agents ask Councilz a question, we keep the question and what was attached to it so it can be answered and graded. Email addresses, phone numbers and strings shaped like keys are masked before any model reads it. The question and its attachments are deleted after 14 days.
Usage, logs and diagnostics
Our servers and our hosting providers record technical logs: IP address, user agent, request times, endpoints called, errors and performance metrics. The collector reports its version, status, pending-batch counts and errors; diagnostics you choose to export omit credentials, transcript text and file paths.
Website
recurz.ai is a static site. It does not use advertising or analytics cookies and does not load third-party tracking scripts. Signing in to protected parts of the site or the products sets cookies that keep you signed in.
We measure how the public site is used with our own first-party script, without cookies or other storage on your device. For each page view we record the page, the referring site, campaign tags in the link (and which ad network sent you, but not its click identifier), your country, device type, how long the page was visible, how far you scrolled, and which links you followed. Instead of your IP address we keep a one-way hash of it, your user agent, the date and a random value that changes regularly, so a visit can be counted once a day but cannot be linked to you or followed from one day to the next. We may show different versions of a page to different visitors to see which works better. Site analytics records are kept for up to 90 days. Our servers also send these same records, with the daily hash in place of any identifier, to Google Analytics to count visits and campaigns, along with the plan, seats and price when a visit ends in a purchase; nothing is loaded from Google in your browser and Google receives no IP address, cookie or ad click identifier.
The product pages (such as Tracez and Rulez) report how quickly they load and respond in your browser: page and request timings, response sizes, your connection type, country and device type. Each page view gets a random identifier that exists only in that page's memory, so its timings can be read together; it is not stored on your device and is not linked to your account. These records are kept for up to 90 days.
Messages you send us
If you email us, we keep the message and your contact details to reply.
2. How we use information
- To provide the Services you ask for: storing and searching your transcripts, producing summaries and findings, running evals, routing calls, and training and serving models for your account.
- To authenticate you and your devices, enforce organization boundaries, and revoke access.
- To secure and operate the Services: detecting abuse, debugging, capacity planning and keeping backups.
- To communicate with you about your account, security, changes to the Services or these policies, and, if you agree, product news.
- To comply with law and enforce our Terms of Service.
What we do not do. We do not sell or rent personal information, and we do not share it for cross-context behavioral advertising. We do not use your Customer Content to train models offered to other customers or the public. Any model the Services train from your Customer Content is trained for your organization and served only to it, unless you tell us otherwise in writing. We may use aggregated, de-identified statistics about how the Services are used (for example, how many turns were ingested) that do not identify you or reveal your content.
3. Processing by AI models
Some Services send portions of your Customer Content to large language model providers to produce summaries, findings, evaluations and routed responses. We send only what the feature needs, under API terms that do not permit the provider to train its models on that data. The current providers are listed in section 5.
4. Google user data
You can sign in to Recurz with your Google account. When you do, Google shares your name, email address, profile picture and Google account identifier with us (the OpenID Connect scopes openid, email and profile). We do not request access to Gmail, Google Drive, Google Calendar, your contacts or any other Google service.
- Use. We use this information only to create and sign in to your Recurz account, show your name and picture in the product, and contact you about your account.
- Storage. It is stored by our authentication provider (Clerk) and in our identity database, in the United States, encrypted in transit and at rest.
- Sharing. We do not sell it or share it with anyone except the service providers that operate sign-in and hosting for us, and as required by law.
- No AI training. We do not use information received from Google APIs to develop, improve or train generalized or non-personalized AI or machine-learning models.
- Humans. No one at Recurz reads it except with your permission, for security purposes, to comply with law, or as part of aggregated, anonymized internal operations.
- Deletion. You can remove Recurz’s access at any time at myaccount.google.com/permissions, and you can ask us to delete your account and this information as described in section 8.
Recurz’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
5. How we share information
We share information only with the service providers that run the Services for us, under contracts that limit their use to providing that service, and in the other cases below.
| Provider | Purpose |
|---|---|
| Amazon Web Services | Transcript ingest, storage, compute |
| Cloudflare | Website, edge network, databases, access control |
| Clerk | Sign-in and account management |
| Stripe | Payments and billing |
| Google Analytics | Public site visit and campaign counts (no cookies or IP addresses) |
| Modal | Model training and serving |
| Anthropic, OpenAI, Fireworks AI, OpenRouter | Summaries, findings, evals and routed model calls |
We may also disclose information: to members and admins of your organization, as the Services are designed to do; to integrations you install; when required by law or to protect the rights, property or safety of Recurz, our users or others; and to a successor in a merger, acquisition or sale of assets, which will remain bound by this policy for information collected under it.
6. Security
Data is encrypted in transit with TLS and at rest. Each organization’s data is isolated from every other’s, devices sign their uploads with per-device keys that can be revoked immediately, and access tokens expire after a few minutes. No system is perfectly secure; if we learn of a breach affecting your personal information we will notify you as required by law.
7. Retention
We keep Customer Content for as long as your account is active or until you delete it. When you delete content or close your account, we delete it from production systems within 30 days and from backups within 90 days, except where we must keep something to comply with law or resolve disputes. Server logs are kept for up to 90 days.
8. Your choices and rights
You can pause or stop the collector, revoke devices, and delete sessions from the product. You can also email privacy@recurz.ai to access, correct, export or delete your personal information, or to close your account. We will respond within 30 days and may need to verify your identity.
Depending on where you live, you may have additional rights. If you are in the European Economic Area, the United Kingdom or Switzerland, you can object to or restrict processing and complain to your data protection authority; our legal bases are performing our contract with you, our legitimate interests in running a secure service, your consent where we ask for it, and legal obligations. If you are a California resident, you have the right to know, delete and correct personal information and not to be discriminated against for exercising those rights; we do not sell or share personal information as those terms are defined in California law.
If your organization’s admin set up your access, your organization controls the Customer Content in its account, and we may refer your requests to it.
9. Sensitive data and children
The Services are built for software development. Please configure the collector so it does not send special categories of personal data, health information, payment card data or government identifiers. The Services are not directed to children under 16, and we do not knowingly collect their information; if you believe a child has given us information, contact us and we will delete it.
10. International transfers
We are based in the United States and store data in the United States (AWS us-east-1 and Cloudflare). If you use the Services from elsewhere, your information will be transferred to and processed in the United States.
11. Changes
We will post any change to this policy on this page and update the date at the top. If a change is material, we will tell you by email or in the product before it takes effect.
12. Contact
Recurz, Inc.
169 Madison Ave STE 55108
New York, NY 10016
privacy@recurz.ai