Your code and ideas stay yours
What the Qorvyn app, the team server and the usage statistics keep, where, for how long, who can see it, how it is protected, and how to use your rights.
Principles
- Your code and ideas stay yours. You keep ownership of everything you create or bring (your intellectual property). Code, prompts, outputs, notes and plans stay on your computer unless you share something or run work through a team server. Nothing is used to train AI models, sold or shown to other customers.
- Only what is needed. Every piece of data below has a reason; there is nothing else.
- Every access is accountable. Changes, sign-ins and the operator's access are recorded in an audit log.
- You stay in control. See, export, turn off and delete what Qorvyn holds about you.
Your intellectual property
What you and your organization create or bring to Qorvyn stays yours: source code, business ideas and confidential documents, custom agents and workflows, notes and shared knowledge, project architecture and technical designs. Using Qorvyn does not transfer ownership of any of it to FACTn Software.
- Only what running the service needs. For what you share through the team server, you allow us to store, transmit, back up and show it to the people in your workspace, nothing more. That permission ends when the content is deleted.
- No other use. We do not use your content to train AI models, do not sell or license it, do not use it in our products or other customers' work, and do not show it to anyone outside your workspace (except recorded operator access for support you ask for, abuse or a legal request).
- Your code is never ours to see. Code and private notes stay on your computer, and so do runs you start there. Work you run through a team server reports its results to it, never the code.
- AI providers. When an agent runs on Claude Code, Codex or another provider, that provider receives the prompt under its own terms. Choose providers whose terms fit your organization.
- Qorvyn itself. The Qorvyn software, name and Q logo belong to FACTn Software (Pvt) Ltd. Core and Enterprise are proprietary software, used under their license terms.
- Feedback. If you send us a suggestion about Qorvyn, we may use the idea to improve Qorvyn, never your code or confidential material.
On your computer
| Data | Leaves your computer? |
|---|---|
| Code index, search and symbols | No |
| Agent and workflow runs, their outputs and changes | No, except the results of tasks this computer runs for a team server as a runner (never the code) |
| Private notes, guardrails, agent definitions | Only an item you share |
| Provider keys (macOS Keychain, or an encrypted file on other systems) | No; given only to that provider's own CLI |
| Device key for team sign-in | Only its public half |
| Documents you add, knowledge items and lessons, product specs, check results and cost forecasts | No; agents get only approved knowledge, as cited context, through their own providers |
| Cloud environments and deployments (Azure) | Qorvyn holds no cloud credentials: it runs your own az sign-in, and only plans you approve reach your subscription |
| Usage statistics | Weekly anonymous counts, unless you turn them off |
| Authorization metadata | Checked online before protected operations |
On the team server
The server holds only what people share, the work they run through it, and what is needed to sign them in.
| Data | Kept | Who can see it |
|---|---|---|
| Your email and name | Until erased | You, your workspaces' members, super admins |
| Devices: name, public key, last seen | Until erased | You, super admins |
| Browser sessions, with the IP address they came from | 30 days after the session ends | You, super admins |
| Device sign-in requests, with their IP address | About an hour after they expire | You, while signing in |
| Workspaces, roles, invitations, project links | Until the workspace is deleted | Members, super admins |
| Git provider connections: provider, account name, and its sign-in tokens, encrypted (read access to repository names only, never code) | Until disconnected, the workspace is deleted, or the person who connected it leaves | Workspace admins see the account, never the tokens; super admins |
| Shared agents, workflows, knowledge and run status | Until deleted | Members, super admins (each visit recorded) |
| Goals, plans and their approvals; runs started through the server, with each task's result: output text (up to 64 KB), commit and branch references, check results and reported costs. Never your code itself | Until the workspace is deleted | Members, super admins |
| Runners: name, public key, labels, trust level, what the runner says about itself (operating system, version), last seen. Enrollment tokens only as a hash | Until revoked or the workspace is deleted | Workspace admins, super admins |
| Products and their specs (requirements, components, decisions), encrypted with the workspace's own key | Until the workspace is deleted | Members, super admins |
| Budgets and spending approvals | Until the workspace is deleted | Members (budgets), admins (approvals), super admins |
| Audit log, hash-chained so changes can be detected | Core: kept. Enterprise: 30 to 3650 days, never during a legal hold | Workspace admins, super admins |
| Enterprise: signed audit checkpoints (a hash and a signature, no content); also written to your immutable storage if you set one | Kept, also after the workspace is deleted | Workspace admins, super admins |
| Account plan, personal project slots (id, label and hashed repository addresses) and devices | Until the account is erased | You, authorized administrators |
| Authorization records: which account and device ran which command (its name only) in which project slot, with the Qorvyn version and the time, one per protected command | 30 days after each expires | You, authorized administrators |
IP addresses. The hosting platform's request logs include the caller's IP address and are kept 30 days to investigate errors and attacks. Usage statistics never store IP addresses.
Email and backups. Sign-in codes are sent through Azure Communication Services, which keeps delivery records. The server database (Azure Database for PostgreSQL) has Azure's automatic backups, with point-in-time restore for 14 days in the same region. Nightly copies made before 17 October 2026, when the server moved to PostgreSQL, are deleted automatically 14 days after they were made.
Project dashboard in the web portal (opt-in)
A member can share a project's dashboard with their workspace by running qorvyn dashboard --share on a computer that has the project. While it runs, workspace members use the same dashboard in the web portal, answered by that computer.
- Passed through, not stored: what the dashboard shows (code search results, diffs, run outputs, notes) and what people do there pass through the team server and are not kept. Every action is in the audit log.
- Only your workspace: viewers can look, members can act, admins can also change guardrails and setup.
- Never relayed: keys and secrets, and which commands the computer runs: those stay on the computer.
- Off by default: nothing is shared unless someone starts it, and it stops when they stop.
Your account
qorvyn activate signs in this device with Microsoft or a verified email code. Protected operations then require live, short-lived authorization bound to the user, device, project, operation and supported client release. There is no offline grace period. Every account starts on the Free plan: it does not expire and includes three personal projects; a project is one product, so a second clone of the same repository uses the project it already has, and each organization you belong to has its own allowance that never uses your personal one. The account service stores your plan, personal-project slots (an opaque id, the label you gave the project and hashes of its repository addresses), Enterprise membership, device and authorization audit metadata. Source code, prompts, readable repository addresses and paths, indexes, secrets and outputs are not part of authorization traffic. Anonymous usage statistics remain separate from the account.
Usage statistics
Anonymous and opt-out, sent at most once a week to telemetry.qorvyn.live. Every field:
| Field | What it is |
|---|---|
| Install id | A random id made on your computer, not linked to you, your email or your machine |
| Version, OS, processor, Node.js | Which Qorvyn and platform |
| Commands and dashboard pages | How often each is used; names from a fixed list, anything else is just “other” |
| Provider kinds | Claude Code, Codex and so on; your own providers' names are never sent |
| Runs and errors | Counts by outcome, duration buckets and error categories, never messages |
| Team sync | Whether it is used |
Never sent: code, file or repository names, paths, remotes, prompts, outputs, notes, emails or usernames. The collector refuses any report with anything else, and stores no IP addresses. Reports are kept 13 months.
Turn it off: qorvyn telemetry off, DO_NOT_TRACK=1 or QORVYN_TELEMETRY=0. It is always off in CI, and an organization can turn it off for everyone in its policy. qorvyn telemetry show prints the exact next report.
Where the data is
- Hosting: Microsoft Azure, Central India (App Service, Azure Database for PostgreSQL with Microsoft Entra sign-in only, Blob Storage, Azure Monitor), and Azure Communication Services with India data location.
- Sign-in: your organization's Microsoft Entra ID, or email codes.
- DNS: Cloudflare, for names only. Traffic is not proxied.
- Subprocessors: Microsoft and Cloudflare. No analytics or advertising services.
Who can access what
- Members see only their own workspaces. Other workspaces are not even revealed by name.
- Roles (owner, admin, member, viewer) limit what each person can do.
- Super admins (the operator, FACTn Software) must sign in through the identity provider, never with an email code. They can manage every workspace and read shared content for support, abuse or legal requests. Every action is recorded, including opening a workspace's page.
- Nobody at FACTn Software can see your code or private notes, or runs you start on your own computer: they are not on the server. Runs started through the team server report their results there (see above); your code stays on the runner and your Git host.
How it is protected
- Encryption in transit: HTTPS only, TLS 1.2 or newer.
- Signed devices: every request is signed with the device's own Ed25519 key, checked for time and replay. A signed-out device is refused at once.
- Browser sessions: random HttpOnly, Secure cookies, stored only as a hash. At most 7 days, 24 hours idle. Forms carry anti-forgery tokens, and pages have a strict content security policy.
- Sign-in: OpenID Connect with PKCE. Email codes are single-use, last 10 minutes and are rate-limited.
- Tamper-evident history: every device verifies the hash chain of shared changes and rebuilds its copy if anything was altered. The audit log is a hash chain too: admins can verify it at any time, and Enterprise signs daily checkpoints of it.
- Runners: each runner has its own key, enrolled with a one-time token. It is never a person's device. The server cannot make a runner run a command: tasks name the runner's own agents, and only its owner configures the checks it runs.
- No stored cloud keys: the server uses its managed identity. Secrets are encrypted at rest.
Your rights
Under GDPR (EU, Norway) and Sri Lanka's Personal Data Protection Act you can ask to access or export, correct or erase your data, and object to usage statistics.
- Erasure removes your memberships, devices, sign-in identities and sessions, and anonymises your account.
- Statistics stop with
qorvyn telemetry off.
Ask through factnsoftware.com; we answer within 30 days.
Incidents
If a breach affects your data, we contain it, tell affected organizations without undue delay (within 72 hours where the law requires), and report what happened, what data was involved and what we did.
Last reviewed 18 October 2026. Changes are listed in the release notes; material changes are announced here before they apply.