Privacy Policy

CodexAI LLC is the controller of the personal data described here. For any privacy question, request, or complaint, contact support@codexai.quest.

CodexAI is not affiliated with or endorsed by Grinding Gear Games, Path of Exile, or any other third party.

Your account. Email address, display name, and a salted hash of your password — never the password itself. Also email verification and sign-in codes, two-factor settings, your role and subscription tier, and the times you signed in and last changed your password.

Path of Exile character data. If you connect your Path of Exile account, we store the connection (your account name and the access tokens Grinding Gear Games issues) and the characters you choose to import: level, class and ascendancy, league, passive tree, skill gems, and full equipment including every modifier on every item. If you import from a Path of Building code or a build guide URL instead, we store what that source contained.

What you write. Build names, notes and goals, your conversations with the Assistant, item text you paste into the Upgrade Finder, and any feedback you send us.

Technical data. Your IP address, used to rate-limit abuse and recorded in security logs for events such as failed sign-ins. Session identifiers, and timestamps on the records above.

Payment data — which we do not hold. If you subscribe, the payment is taken by our payment provider acting as merchant of record. That means they are the seller of record for the transaction: you enter your card details on their system, they hold them, and they handle the tax and compliance that comes with taking money.

Your card number, expiry, security code and billing address never reach CodexAI. We could not produce them if we were asked to, and we could not leak them if we were breached. What we receive back is a customer identifier, a subscription identifier, which tier you are on, and when it renews — enough to unlock what you paid for, and nothing that could be used to charge a card.

We do not buy personal data, we do not run advertising or analytics trackers, and we do not sell or share your personal information as those terms are used in United States state privacy laws.

Three, all first-party, none for tracking: one that keeps you signed in, one that protects forms against cross-site request forgery, and one that remembers which league you last selected. There is no advertising or analytics cookie, which is why there is no cookie banner.

To run the service you asked for — importing characters, computing stats, scoring builds, answering questions, generating Hero Cards, taking payment. Processed to perform our contract with you.

To keep the service safe and working — rate limiting, abuse and fraud prevention, security logging, debugging. Our legitimate interest in a service that stays up and is not abused.

To improve CodexAI, and to produce aggregate statistics — understanding which analyses are wrong or unhelpful so they can be fixed, and measuring what is true across many builds so the guidance reflects how the game is actually played. Our legitimate interest, and you can object (see Aggregate And Anonymised Data and Your Rights).

To meet legal obligations — financial records for payments, and responding to lawful requests.

Where we ask for consent — for example before sending anything optional — you can withdraw it at any time.

Character data comes from Grinding Gear Games' official API, with your permission, through their own sign-in. We only read it. We never write to your Path of Exile account, and we never ask for your Path of Exile password.

Grinding Gear Games' data stays free. A paid CodexAI tier may charge for work we do — analysis, simulation, tooling, aggregated statistics. It will never put your imported character data, item data, or Path of Exile artwork behind a payment. That is a condition of using their API and we treat it as a rule, not a preference.

You can disconnect at any time from your profile's integrations tab. That removes the stored connection and access tokens. Characters you already imported stay until you delete them, because they are your saved builds — delete those separately if you want them gone.

You can also revoke CodexAI's access from your Path of Exile account settings, which stops any further import regardless of what we hold.

When you ask the Assistant a question, we send our AI provider the question, recent messages in that conversation, a summary of the build being discussed, and reference data about the game. We do not send your email address, your name, or your payment details.

We use the provider's business interface, under terms that do not permit your content to be used to train their models. They process it to answer the request and under a limited retention window for abuse monitoring.

Conversations are stored against your account so you can return to them, and may be reviewed by us for support, moderation, and to find where the analysis went wrong. Treat the Assistant as a product feature, not a private diary. Do not put passwords, payment details, or anything sensitive into it.

We use a small number of service providers, each processing data only on our instructions:

• Our AI provider — Assistant questions and build context, as described above.
• Our payment provider — as merchant of record they are the seller for the transaction, take your payment, and hold your billing details directly under their own privacy policy. We send them your email address so they can issue a receipt. They do not send us your card details.
• Our hosting and database provider — stores the data that runs the service.
• Our email provider — delivers verification, sign-in, and password reset messages.
• Grinding Gear Games — the source of imported character data, under their terms and privacy policy.

We query poe.ninja for market prices. That request contains item and league names only — nothing about you.

We will also disclose data if the law requires it, to protect our rights or someone's safety, or to a buyer if CodexAI is ever sold — in which case you will be told before your data moves.

Our providers are based in the United States and elsewhere, so your data may be processed outside your country. Where personal data leaves the UK or EEA we rely on the European Commission's standard contractual clauses or an equivalent safeguard.

No one else is shown your build as yours unless you decide they can. Your characters are not browsable, searchable, or listed anywhere by default.

Today the only way to share one is a Hero Card. When you enable sharing, that card gets an unlisted public link showing the build summary it displays. Anyone with the link can view it without signing in. Turning sharing off withdraws the link.

We are building features — such as guilds and leaderboards — where you may choose to show a build to other players. When they arrive they will follow the same rule: opt-in, clearly labelled, and reversible. We will update this page and tell you before any of it goes live.

Understanding what is happening across many builds is how CodexAI knows a skill is underperforming, what a healthy character looks like at your level, or which uniques the league has settled on. We do use your character data for that, and we want to be plain about it rather than bury it.

Those figures are aggregate and anonymised: counts, averages, distributions and trends across a population of builds. We may publish them, show them inside the product, and build paid analysis on top of them.

The line we will not cross. Nothing we publish or share will identify you or your account. It will never include your email address, your display name, your Path of Exile account name, or your character names, and it will never be presented as one identifiable person's build. If a figure is so narrow that it could only describe one player, it does not get published.

Your account identity is never shared with anyone, for any purpose. We use your Path of Exile account only to import your own characters at your request. We do not sell it, trade it, or hand it to another company for their own use.

If you would rather your builds were not counted even anonymously, email us and we will exclude your account.

While your account is open, we keep your account details, builds, and conversations so the service works. Deleting a build sends it to your Recycle Bin, where it stays until you remove it for good.

If you deactivate your account, it is closed and you can no longer sign in, but nothing is deleted and we can reopen it with everything still in it. This is the one we would rather you chose.

If you erase your account, it is gone. You can do this yourself from your profile — it is folded up under Deactivate, and it asks for your password, your email address typed back, and an explicit acknowledgement, because it cannot be undone. You can also email us and we will do it for you.

When an account is erased, we delete your profile, characters and imported Path of Exile data, chat history, Hero Cards and shared Item Cards along with their image files, build issues, Assistant usage records, Path of Exile connections and tokens, password history, feedback, and sessions.

What survives an erasure, and why: payment and subscription records, which we must keep for financial and tax purposes, and security logs, kept for a limited period to investigate abuse. Backups roll off on their own schedule, so a copy may persist briefly after deletion.

Alpha accounts may be removed at the end of an alpha period regardless of the above.

Wherever you live, you can ask us to: give you a copy of your data, correct it, delete it, give it to you in a portable form, stop or limit a particular use, or object to processing based on our legitimate interests.

If you are in the UK or EEA, these are your rights under the UK GDPR and GDPR, and you may complain to your data protection authority. If you are in California or another United States state with a privacy law, you have equivalent rights to know, delete, correct, and to opt out of sale or sharing — we do not sell or share your personal information, and we will never treat you differently for exercising a right.

Email support@codexai.quest. We will verify it is your account and respond within 30 days. You can do most of this yourself right now: export a build to Path of Building, delete a build from the Recycle Bin, disconnect Path of Exile from your profile, deactivate your account, or erase it outright from your profile.

We do not store anything we can read back unless reading it back is the point.

• Your password is never stored. We keep a salted hash of it, which cannot be turned back into your password. Nobody at CodexAI can look it up or tell you what it is.
• Sign-in codes, verification codes, two-factor codes and password reset codes are stored the same way — as hashes. We compare what you type against the hash; we never hold the code itself.
• Your Path of Exile access tokens are encrypted at rest. These are the one thing we genuinely have to read back, because we present them to Grinding Gear Games to fetch your characters. So instead of a hash they are encrypted with a key held outside the database, and a copy of the database on its own does not open your game account.
• Session cookies are stored as hashes too, so a database copy cannot be used to walk into your account.

Beyond that: sessions expire, forms are protected against cross-site request forgery, sign-in and other sensitive actions are rate limited, and access to production data is limited to those who need it.

No service is perfectly secure, and we will not pretend otherwise. If a breach affects your personal data we will tell you and the relevant regulator as the law requires. To report a vulnerability, see our Security Policy.

CodexAI is not intended for children under 16, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will remove it.

When this policy changes we update the date at the top. If a change materially affects how we use your data — a new purpose, a new category of sharing, or anything that makes a build visible to other people — we will tell you before it takes effect, not after.