v8labs.app ("we", "us") operates under the brand v8Labs Tech., based in İstanbul, Türkiye. Contact: support@v8labs.app. This policy explains what we collect, why, and your rights under the GDPR, the Turkish Personal Data Protection Law No. 6698 (KVKK) and other applicable laws.
What we collect
- Account data: your email address and, if you use Google sign-in, your Google account identifier. Purpose: to create and secure your account (contract performance).
- Plan & usage data: your subscription and counters such as "advanced prompts this week". Purpose: to provide your plan and enforce free-plan limits (contract performance).
- Terminal data (v8-prompt): a random key created on your computer when you first use v8-prompt (we store only a keyed hash of it, never the key), when it was first and last used, a keyed hash of the network address it first connected from, weekly and daily counts of free advanced prompts, and — if you connect it — which account it belongs to. Each request also says whether your computer runs Windows, macOS or Linux, so run and verify steps fit your machine; this is not stored. Purpose: to provide the free plan and your Pro plan and to prevent abuse of the free plan (contract performance, legitimate interest).
- Security data: session records and a salted hash of your IP address for security events. Purpose: to protect your account and prevent abuse (legitimate interest).
- Payment data: handled entirely by Paddle.com, our Merchant of Record. We never see or store your card details. We receive your Paddle customer ID and the status of your purchases.
Cookies
We set one strictly necessary cookie: the session cookie that keeps you signed in. We do not use tracking, analytics or advertising cookies, and we do not embed third-party trackers.
Prompt processing
- Text sent for improvement: when you press the v8 shortcut, the text in the agent's input box is sent to our service and an AI provider to produce the advanced prompt. We process the text in memory and do not store or log prompt bodies on our servers. Text that looks like a password or API key is removed before it reaches an AI provider. Review your input before sending it.
- Local undo copy: the v8-prompt tool writes your recent original texts, their advanced prompts and timestamps (at most 20, kept for one hour) to
~/.v8-prompt/rewrites/on your device. It uses this file to restore your original text when you press the shortcut again within one hour. The file can remain on your device after that hour; you can remove it yourself if you no longer need the undo copy. - Your code and files: when you press its key, v8-prompt reads the text in the agent's input box and the repository facts described in the next section. The contents of your files are not sent, with the narrow exceptions described there.
- We do not sell personal data, use it for advertising, or use your content to train AI models.
Repository context
To make the advanced prompt specific to your project, v8-prompt sends a context pack together with the text, only when you press its key. It is collected on your device from git and from manifest files in the directory where the coding agent runs, and is limited to 4,000 bytes in total. It contains:
- Repository facts: the repository folder's name, the current branch and whether there are uncommitted changes (yes/no).
- Stack: languages and frameworks read from manifests such as
package.json,pyproject.toml,requirements.txt,Cargo.toml,go.mod,pom.xmlorbuild.gradle. - Commands: the test, build, lint, typecheck and run commands defined in those manifests or a
Makefile, and a command that runs only the test file for the matched files. - Instruction files: which of
CLAUDE.md,AGENTS.md,.cursor/rulesand.github/copilot-instructions.mdexist (names only). When the manifests define no commands, up to four backticked command lines that look like test, build or lint commands are quoted fromCLAUDE.mdorAGENTS.md. These and the CI commands below are the only text taken from any file. - File paths: up to 8 repository paths that match your request by name or by content, with the reason each was chosen; up to 4 test files that belong to them; up to 2 existing files to follow as a pattern; and up to 4 instruction or rule files that apply to them (names only). File contents are searched on your device to rank these paths and are never sent. Files ignored by git, binary files and files over 512 KB are never searched or included.
- Function and class names: up to 8 names of functions, methods and classes defined in up to 3 of those files and their first test file (for example
cartTotalorCart.applyCoupon), chosen on your device by how well they match your request. Only the names are sent, never the code; names that look like keys or tokens are never sent.v8-prompt context symbols offstops sending names while keeping the rest. - CI commands: up to 4 test, lint, typecheck or build commands that your CI workflow files (
.github/workflows,.gitlab-ci.yml) run, with URLs, host names, secrets and variables removed. - Recent commits: the subject lines of the last 5 commits.
- Remembered answers: answers you confirmed for this repository in earlier question rounds (see below).
The context pack is processed in memory like prompt text and is not stored or logged on our servers. Commit subjects, file paths and function names may contain personal data, such as a name; review them with v8-prompt context show, which prints exactly what would be sent from the current directory. v8-prompt context off, or the environment variable V8_PROMPT_NO_CONTEXT=1, stops sending it; v8-prompt context on resumes. Without git or a manifest, only the folder name is sent. To rank files, v8-prompt keeps the names of the files changed in each repository's last 300 commits in ~/.v8-prompt/cache/ on your device; this cache is never sent. Purpose: to provide the service you requested (contract performance).
- Previous agent reply: if Claude Code places its last reply in the editor as
#comment lines, v8-prompt sends at most its last 4,000 characters as context for your follow-up prompt and leaves the block unchanged. It is processed like prompt text and is not stored on our servers. - Remembered answers (local only): answers you confirm to v8-prompt's questions are stored on your device in
~/.v8-prompt/projects/, one file per repository holding only the questions and your answers (at most 8). They are sent with later prompts from the same repository as part of the context pack.v8-prompt forgetdeletes the file for the current repository andv8-prompt forget --allfor every repository.
Processors
We use: Hetzner Online (hosting and database — Germany, EU), Paddle.com (payments, Merchant of Record — UK), Groq and OpenAI (text processing — US; API data is not used for model training), GoDaddy (sign-in emails — US), Google (optional sign-in — US). International transfers rely on Standard Contractual Clauses or equivalent safeguards. Where KVKK Art. 9 requires your explicit consent for a transfer abroad, you give it by ticking the consent box on the sign-in page before you create an account or sign in; you can withdraw it at any time by deleting your account.
Retention
Account data is kept until you delete your account. Usage counters are kept up to 13 months; security logs up to 12 months; sign-in codes and expired sessions are deleted automatically. Prompt bodies, repository context and previous-reply blocks are not retained on our servers. The local undo copy remains on your device until it is replaced or you delete it; remembered answers remain on your device until you run v8-prompt forget or delete ~/.v8-prompt. Paddle keeps invoices as required by tax law.
If you took part in the earlier Say, Clip or Hired browser-extension beta, any data from it that is still linked to your account (Google Drive links, share metadata and device tokens) is deleted together with your account when you delete it.
Your rights
You can access and download your data (Account → Download your data), correct it, delete your account (Account → Delete account), object to processing, and lodge a complaint with your data-protection authority (in Türkiye: KVKK Kurumu). Email support@v8labs.app for any request; we answer within 30 days.
Aggregate product activity
We count successful advanced-prompt generations and maintain a keyed, pseudonymous last-success marker to calculate recent activity. The public Live page shows totals and the number of active accounts or unlinked terminals in the last five minutes, never prompt text, account details or device identifiers. Markers older than one day are removed during daily maintenance; the non-identifying cumulative count is retained. Security attempt counters are retained for up to three days and are not public.