COCKPITWho we are
Cockpit by Nakhla Studios, Saudi Arabia.
We decide why and how your data is used for Cockpit. In the words of the Saudi Personal Data Protection Law (PDPL), we are the "controller". In this policy, "we" and "us" mean Nakhla Studios. "You" means the person who uses Cockpit.
- Privacy questions, data requests and account deletion: privacy@nakhlastudios.com
- Everything else: hello@nakhlastudios.com
E-mail is our contact channel. We do not offer a phone line or a postal address for Cockpit.
The controller is Nakhla Studios, Saudi Arabia.
We have not named a data protection officer, because the law does not require one for a service like Cockpit. The privacy address above handles every privacy question.
What Cockpit is and what this policy covers
Cockpit lets you watch and control the AI coding tools that run on your own Windows PC, from your Android phone or tablet. It is meant for adults who use AI coding tools on their own PC. It has three parts:
- the Cockpit app on your phone or tablet;
- the Cockpit program on your PC;
- our online service that connects the two. Your account's data is stored in the European Union, on Cloudflare. Requests pass through Cloudflare's worldwide network on the way.
You sign in with a Google account. Any Google account can sign in. Each account gets its own separate area in our service. Only you, and the PCs you link to your account, can reach your area.
This policy covers the app, the PC program, our online service and this website. Please read it before you sign in in the app or link a PC.
What we collect and why
We collect data in two ways: directly from you (what you type or choose in the app) and automatically from the app and the Cockpit program on your PC while you use them. Each table says whether an item is needed or optional.
From your Google sign-in
Sign-in is done by Google's sign-in service, Firebase Authentication.
| What | Why | Needed? |
|---|---|---|
| Your Google account e-mail address, and whether Google has verified it | To sign you in, and to show which account a PC is linked to | Yes |
| The account name and photo link Google passes to the sign-in service | Stored by the sign-in service. The app does not use or show them. | Yes (Google passes them) |
| A user ID that the sign-in service creates | To keep your data in your own area | Yes |
| Your IP address and your app or browser details (the "user agent"), each time you sign in | Google's sign-in service processes them to sign you in and to protect sign-in | Yes |
Each time the app connects, it shows our service a short-lived sign-in token from Google. Our service checks it and does not keep it.
From the app on your phone or tablet
| What | Why | Needed? |
|---|---|---|
| A device ID made from your phone's Android ID, the phone model, a device name, the app version and the Android version | So your PC and your other devices can tell which device is which | Yes |
| A push address (token) for your device | To send you notifications | Only for notifications. You can turn them off. |
| Your answers to questions (and any note you type), the commands you send to your PC, project renames, checklist ticks | To do what you asked | Only when you use these features |
| Your settings (quiet hours, notification switches, the sounds switch, the always-on screen setting, and your PC's network address and MAC address if you type them in) | To work the way you set it up | Optional |
| Whether the app is open and watching; whether your Home box device can reach your PC on your home network | To decide how often your PC sends updates, and to wake your PC | Yes. Not stored: see "What we keep, and what only passes through" below. |
Our service on Cloudflare also sees your device's IP address each time it connects, as every online service does. Our service may use it for short-lived counters that stop abuse. These counters expire within 24 hours.
From your PC
The Cockpit program on your PC sends these to your area, and the app shows them to you:
- project names and folder names, progress, your inbox, reports (text, pictures and short clips), questions and alerts;
- notifications: a project name, up to 200 characters of your session's own words (for example its question to you), and how much of your AI plan's usage limits is used;
- your PC's health: disk space, memory, processor load, graphics card load and temperature (NVIDIA cards only, read with NVIDIA's own driver tool), computer name, and local network address;
- a picture of your PC's screen, only when you ask for one.
If you turn on "Show Claude Code sessions", the Cockpit program on your PC also sends, for each Claude Code session: the project folder's name (never the full path), whether it is working or waiting for you, the AI model it uses, when it started and was last active, internal numbers for the session, and the short question the session asks you when it stops to wait for you (at most 200 characters). It never sends your files, your code or your full conversation with the AI.
"Show Claude Code sessions" is off until you say yes. The PC program asks you once, and you can say "Not now".
We do not collect your processor (CPU) temperature. Cockpit never installs extra software or drivers to read it.
This information comes from your own PC and your own work. We do not look at it. Reports and screen pictures can contain private work information. You control what your PC sends.
When you link a PC
To link a PC to your account, the PC shows a one-time code. You type it in the app, and you confirm on the PC.
- The code works once and expires after 10 minutes, whether you say yes or no.
- While the code is in use, it holds your user ID and e-mail address, so the PC can show you which account asked to link.
- Your account keeps a list of linked PCs: a PC ID, the PC's name and the time it was linked.
- The PC gets its own key from our service. We keep only a scrambled fingerprint of that key (a hash), never the key itself. The key reaches only the area of the account it is linked to. You can unlink a PC in the app at any time; it loses access at once.
When you write to us
If you e-mail us, we receive your e-mail address, your name as your e-mail shows it, and what you write. We use them only to answer you and, for a privacy request, to carry it out.
What we keep, and what only passes through
To keep as little as possible, most live information is passed from your PC to your devices and not stored:
- Passed through, never stored: live progress (sent every 3 seconds only while an app is open and watching, otherwise about once a minute), "app is open" signals, screen pictures, and the pictures in reports.
- Stored in your area: the latest summary of your PC's status, and real changes only: projects, inbox, questions and answers, reports, checklists, alerts, notifications, commands and their results, settings, linked PCs and devices.
What we do not collect
- No location. The Wi-Fi permission is declared never to be used for location.
- No contacts, no photos from your gallery, no microphone, no camera.
- No card or payment details. Cockpit is free and sells nothing.
- No ads, no analytics and no crash-reporting service in the app.
- We do not ask for sensitive data (for example health, religion or biometric data). But screen pictures and reports show whatever is on your PC, so do not capture anything you do not want sent.
If you do not give the data
- Without a Google sign-in, you cannot use Cockpit.
- Without the device details, the app cannot connect to your PC.
- Without a push address, you get no notifications. Everything else works.
- Without the optional items (settings, your PC's network address, "Show Claude Code sessions"), only that feature does not work.
Why we may use your data (legal basis)
We use your data only to run Cockpit for you. We do not use it for advertising. We do not sell it. We do not send you marketing. We do not use it against the purpose we collected it for.
| Use | Legal basis |
|---|---|
| Signing you in, linking your PCs, showing your PC's status, sending notifications, running the commands you send, keeping your settings, deleting your account | Our agreement with you: we need the data to give you the service you asked for |
| "Show Claude Code sessions" | Your consent. You give it on your PC and can take it back at any time (see "Your rights") |
| Keeping the service safe: sign-in checks, access checks, short-lived abuse counters | Our legitimate interest in a safe service and in protecting our network and information |
| Answering your e-mails and your privacy requests | Our agreement with you if you use Cockpit; otherwise our legitimate interest in answering people who write to us; and our legal duty to answer requests about your rights |
| Delivering this website and protecting it (the request details Cloudflare receives) | Our legitimate interest in a working and safe website |
If we want to use your data for a new purpose, we ask you first.
Who handles your data for us
We use these providers. Cloudflare and Google Firebase act only for us and only for the job named (as our processors, under their data processing terms). Google Play and Gmail are Google services that Google runs under its own terms and privacy policy: Google Play gives you the app, and our mailbox is a Gmail account. Each provider receives data again and again while you use Cockpit, not just once.
| Provider | What it does | Where |
|---|---|---|
| Cloudflare (Workers and Durable Objects) | Runs our online service and stores your account's area. | Your area is created under Cloudflare's EU setting, so it is stored and run only in the European Union. Each request reaches it through Cloudflare's worldwide network, so your data passes through other countries on the way, encrypted. Cloudflare also records the area's ID number (not its contents) outside the EU for billing and fault-finding. |
| Cloudflare (Pages) | Hosts this website. | Cloudflare's worldwide network |
| Cloudflare (Email Routing) | Passes e-mails sent to our addresses on to our mailbox. | Cloudflare's worldwide network |
| Google Firebase Authentication | Google sign-in. | Google states that it runs only in data centres in the United States. |
| Google Firebase Cloud Messaging | Delivers notifications, with their short text, to your phone. Our service on Cloudflare hands each notification to it. | A worldwide Google service: Google may process the data wherever it has facilities. |
| Google (Gmail) | Holds our mailbox, where we read and answer your e-mails. | Google's worldwide systems |
| Google Play | Distributes the app. | Google's systems |
While we finish moving to Cloudflare: our service used to run on Google Firebase Realtime Database, in Belgium (Google Cloud region europe-west1). Until the move is finished, a copy of some account data is still kept there. Deleting your account also deletes your copy there. If that step fails, we delete the copy by hand, and it is deleted in any case when that database is deleted. When the move is finished, that database is locked and then deleted, and we update this policy.
We do not give your data to anyone else, except when the law requires it. If we change a provider, we update this list before the change.
All data travels encrypted (HTTPS/TLS).
Data sent outside Saudi Arabia
The Saudi Personal Data Protection Law applies to your data if you live in Saudi Arabia, wherever the data is stored.
Your data is stored and handled outside Saudi Arabia:
- European Union: your account's area (Cloudflare), and, until our move is finished, the copy in Belgium (Google Firebase Realtime Database).
- Countries along the way: requests pass through Cloudflare's worldwide network, encrypted.
- United States: Google sign-in (Firebase Authentication).
- Several countries: notifications (Firebase Cloud Messaging), our e-mail (Cloudflare Email Routing and Gmail) and Google Play.
- Why: the services we use do not offer storage in Saudi Arabia today.
- What is sent: the data in "What we collect and why", and only what each provider needs for its job. We do not ask for sensitive data. Screen pictures and reports contain only what you choose to send from your PC.
- To whom: the providers in "Who handles your data for us". Cloudflare and Google Firebase act only for us, under their data processing terms; Google Play and Gmail are Google services under Google's own terms and privacy policy.
- How often: continuously, while you use Cockpit.
- Legal basis for the transfer: we send this data abroad because it is needed to give you the service you signed up for (PDPL Article 29(1)(c) and (d); Regulation on Personal Data Transfer outside the Kingdom, Article 2(2)). We send only what each provider needs. SDAIA has not yet published a list of countries with an adequate level of protection. Our providers work under their own data processing terms, not SDAIA's standard contractual clauses. We keep these transfers under review and will update this section when that changes.
- How we protect it: data is encrypted in transit; each account's area is closed to everyone else by our service's access checks; each provider works under its own data processing terms; we keep data only as long as "How long we keep your data" says.
How long we keep your data
| Data | Kept for |
|---|---|
| Live progress, "app is open" signals, screen pictures, report pictures | Not stored: passed through only |
| Notification records | The last 200 |
| Command results | Deleted after 24 hours |
| PC health history | 30 days |
| Linking codes | Used up when you answer, and expire after 10 minutes |
| Abuse counters on our service | Expire on their own, within 24 hours |
| Device entries | Until you sign out on that device or delete your account |
| Linked PC entries | Until you unlink the PC or delete your account |
| Your account and the rest of your area (status summary, projects, reports, inbox, questions and answers, settings) | Until you delete your account |
| Sign-in data held by Google (Firebase Authentication) | Until you delete your account. Google states that after that it leaves Google's live and backup systems within 180 days. Google keeps IP addresses from sign-in for a few weeks. |
| The app's notification ID held by Google (Firebase Cloud Messaging) | We delete your push address on our side at once when you delete your account. Google keeps the app's notification ID on its side until it is deleted, and states that deleted data leaves its systems within 180 days. |
| Cloudflare's request logs (counts and timings, no content) | Kept by Cloudflare for a short time under its own rules; we do not store them ourselves |
| The time your account was emptied, linked to the account's internal ID | Kept so an old linking code can never link into the account again; kept while Cockpit runs; it holds nothing else |
| Your e-mails to us and our answers | Up to 12 months after the conversation ends, then deleted |
| A record of each privacy request (who asked, what, when, and what we did) | 2 years, then deleted, so we can show that we answered it |
When data reaches the end of its time, or you delete it, it is removed from our service and cannot be restored.
Deleting your account
In the app: Settings, then Account and device, then Delete account. The app asks you to sign in with Google once more, to make sure it is really you. This deletes your account's whole area at once, unlinks every PC, and then deletes your sign-in.
Without the app: follow our account deletion page. You can e-mail us from your account's address.
What happens:
- Everything Cockpit keeps for your account is deleted. Linked PCs lose access at once.
- Your sign-in is removed from Cockpit's sign-in service at once. Google states that sign-in data leaves its live and backup systems within 180 days.
- Any copy left on your own phone or PC stays there until you remove the app or the PC program. We cannot reach it.
- We keep nothing else, apart from the items in "How long we keep your data" that outlast deletion: the time the account was emptied, your e-mails with us, and the record of a request made by e-mail.
- A request by e-mail is done within 30 days. If we need longer, we tell you why before the 30 days end, and we finish within 30 more days.
Your rights
You have the right to:
- Know how and why we use your data. This policy is that notice.
- Access your data: ask us what we hold about you.
- Get a copy of your data in a readable form.
- Correct data that is wrong or out of date.
- Delete your data (see "Deleting your account").
- Take back your consent where we rely on it. Taking it back is as easy as giving it. For "Show Claude Code sessions": in the Cockpit program on your PC, open Settings and turn off "Show Claude Code sessions". Cockpit then takes its helper out of your Claude Code settings, after saving a backup. This does not undo what was done before.
- Complain to us or to SDAIA (see "How to complain"), and ask a court for compensation if you suffer harm.
To use a right, write to privacy@nakhlastudios.com from the e-mail address of your Cockpit account. We may ask you to confirm it is you. We answer within 30 days. If we need longer, we tell you why before the 30 days end, and we answer within 30 more days. If we cannot do what you ask, we tell you why. We keep a record of each request.
How to complain
If you are not happy with how we handle your data, write to us first at privacy@nakhlastudios.com, so we can fix it. We answer within 30 days.
You can also complain to the Saudi Data and AI Authority (SDAIA), which oversees the PDPL, on its National Data Governance Platform, dgp.sdaia.gov.sa, with the service "Submit a complaint about personal data". A complaint is made within 90 days of the problem, or of when you learned of it.
If you suffer harm because your data was misused, you can ask a competent court for compensation.
Security and data breaches
Our service checks your Google sign-in on every connection and lets only your account and your linked PCs reach your area. A linked PC has its own key that we store only as a fingerprint, and you can cut it off at once. Linking codes work once and expire after 10 minutes. All data travels encrypted. No system is perfectly safe.
If a breach puts your data at risk, we tell SDAIA within 72 hours of learning of it, and we tell you without undue delay if it may harm you, in plain words, with advice on what you can do.
When you visit this website
This website runs on Cloudflare. To deliver each page and protect the site, Cloudflare receives your IP address and the usual request details: the page asked for, your browser type and the time.
- This website has no ads, no analytics and no tracking, and it sets no cookies.
- If you choose a light or dark look, the site remembers it in your own browser. It is never sent to us.
- If you e-mail us, we use your address and your message only to answer you, and keep them as "How long we keep your data" says.
Permissions the app asks for
- Internet and network state: to work online.
- Wi-Fi state and multicast (Home box): to wake your PC on your home network.
- Nearby Wi-Fi devices: Android needs it to talk to devices on your home network. Never used for location.
- Notifications.
- Run in the background with a notice, and start after reboot (Home box and the always-on screen setting).
- Fingerprint or screen lock: to confirm power actions.
- A battery-settings shortcut: so your phone does not stop Home box.
Children
Cockpit is only for people aged 18 or over. We do not knowingly collect data from anyone younger. If we learn that an account belongs to someone under 18, we delete the account and its data. If you think this is the case, write to privacy@nakhlastudios.com.
Changes to this policy
We review this policy at least once a year. When we change it, we change the date at the top and add a line to the list below. For important changes, we tell you in the app first. If we want to use your data for something new, we ask you first.
- 6 November 2026: first version.
Contact
Cockpit by Nakhla Studios, Saudi Arabia.
Privacy, data requests and account deletion: privacy@nakhlastudios.com
Everything else: hello@nakhlastudios.com