Circleci
- The policy says your content is not used for AI training.
- Your data is used for personalized ads, including by third-party ad companies.
- Data is shared with partners and affiliates; you can opt out.
- The documents do not say who can read your content.
They collect code, keys, and ads data; AI providers don’t train on Chunk inputs; you them and they can cut access without notice.
Agent Trust Hub uses AI and may make mistakes. Review reports and confirm their contents before relying on them.
Collected
Account info, IP and fingerprints, cookies, payment data, source code, keys, and third-party profile data.
Read the exact line
Privacy policy
“Source code commits, pull requests, issues, comments, build logs, test results, deployment configurations, usage metadata, and customer-stored artifacts”
Training
They run pipelines, market to you, target ads, and send Chunk AI inputs to providers who they say do not train on them.
Read the exact line
Privacy policy
“CircleCI’s AI Providers do not train on any data that inputted into Chunk or Chunk sidecars.”
Sharing
Employees, contractors, payment and analytics vendors, ad partners, and AI providers can see data; they say they do not sell it.
Read the exact line
Privacy policy
“CircleCI does not sell California residents’ personal information, as defined under .”
Kept
They keep data as long as needed for the stated purposes or as the customer contract says, unless law requires longer.
Read the exact line
Privacy policy
“CircleCI will retain Personal Data that Customers provide to CircleCI through the Services for the period necessary to fulfill the purposes outlined in this Privacy Policy unless a longer retention period is required or permitted by law.”
Controls
You can request a copy or deletion in the Privacy Center and turn off targeting cookies with the paperclip button.
Read the exact line
Privacy policy
“Users may visit CircleCI’s Privacy Center to request that CircleCI provide a copy of their Personal Data or that CircleCI delete Personal Data that CircleCI maintains on CircleCI’s systems.”
Fine print
They can change prices and cut access without notice; you them; is capped at $100.
Read the exact line
Terms of service
“You agree that CircleCI may, in its sole discretion and without prior notice, terminate your access to the Site and/or block your future access to the Site”
Expand “Read the exact line” to see the source alongside the explanation.
What you can turn off
The controls and opt-outs their own documents describe, and where they say to find them.
Turn off targeting cookies
CircleCI website, black paperclip button at the bottom left, Cookie preferences
Request a copy or deletion of personal data
CircleCI Privacy Center at https://privacy.circleci.com/
Email privacy requests
privacy@circleci.com with full name, email, and the specific request
Review third-party app privacy settings before linking
Privacy settings on VCS and other connected third-party services
If a switch is not where they say, the deletion request above still applies.
Line by line
The lines that matter most, worst first.
They process the secrets and keys that unlock your cloud and databases so pipelines can deploy.
Read the exact line
Privacy policy
“Deployment keys, cloud provider credentials, API keys, database connection strings, signing certificates, Terraform configurations, Kubernetes manifests, and metadata about secret usage and rotation”
For example, a database password stored for a deploy job is processed as part of the service.
Anything you post on the website (not just private account data) can be used, sold, or sublicensed forever.
Read the exact line
Terms of service
“you hereby grant CircleCI a , worldwide, nonexclusive, , , (through multiple tiers) license to perform, display, reproduce, prepare derivative works from, distribute, sell, , transfer and otherwise use without restriction all or any part of such content.”
For example, a forum post you write could be reused or sublicensed even after you leave.
If someone sues them over your use of the site or content you posted, you may have to pay their legal bills.
Read the exact line
Terms of service
“You agree to and CircleCI, its affiliates and their respective employees, contractors, agents, officers and directors from and against any and all claims”
For example, if a comment you posted leads to a lawsuit, you could be on the hook for their lawyers.
They can lock you out of the website without warning.
Read the exact line
Terms of service
“CircleCI may, in its sole discretion and without prior notice, terminate your access to the Site and/or block your future access to the Site”
For example, they could block your login today and you would not get a heads-up email first.
Listed prices on the site can change with no advance warning.
Read the exact line
Terms of service
“CircleCI may make changes to any products or services offered on the Site, or to the applicable prices for any such products or services, at any time, without notice.”
For example, a plan price you saw yesterday might be higher when you check out today.
They and partners use cookies to show ads based on what you browse.
Read the exact line
Privacy policy
“CircleCI and its partners use cookies or similar technologies to optimize the functionality of the Site, help CircleCI understand how the Site is used and provide Users with interest-based advertising based upon a user’s browsing activities and interests.”
For example, visiting pricing pages could lead to CircleCI ads following you on other sites.
They can build a work profile about you from LinkedIn and data vendors, not only from what you type.
Read the exact line
Privacy policy
“CircleCI may also obtain professional information about a User from other third-party sources such as public sources, social media platforms like LinkedIn and X, and third-party data providers.”
For example, your job title on LinkedIn could be used to send you sales emails.
What you put into Chunk is sent to outside AI companies.
Read the exact line
Privacy policy
“CircleCI will transmit the Inputs submitted to the Services to CircleCI’s AI Providers.”
For example, a code snippet you paste into Chunk is forwarded to their AI vendor.
They say the AI vendors will not use your Chunk inputs to train models.
Read the exact line
Privacy policy
“CircleCI’s AI Providers do not train on any data that inputted into Chunk or Chunk sidecars.”
For example, a private function you paste into Chunk should not become part of the vendor’s training set.
Logins and traffic to the service are encrypted in transit.
Read the exact line
Privacy policy
“When a User enters login information on the Service, all information to and from the service is encrypted using Transport Layer Security (TLS).”
For example, your password should not travel in plain text over the network.
Words to know
Legal words from the lines above, in plain English.
- sell or share
- Under California law, selling means passing your data to others for money or other value; sharing means passing it on for targeted ads. For example, letting an ad network use your browsing history in return for ad space counts as a sale.
- personal data
- Any information that is about you or can be linked to you, from your name to your phone's ID. For example, your email, your IP address and the list of apps on your phone are all personal data.
- CCPA
- California's privacy law, which gives residents the right to see, delete and stop the sale of their data. For example, a Californian can ask the app to stop selling their data and it must comply.
- retention
- How long a company keeps your data before deleting it. For example, a policy might keep your messages for 30 days after you delete them, or for as long as it likes.
- perpetual
- Lasting forever, with no end date. For example, a perpetual licence means the company can keep using your video years after you leave.
- irrevocable
- Cannot be taken back or cancelled once given, even if you change your mind or delete your account. For example, an irrevocable licence to your photos means you cannot withdraw it later.
- royalty-free
- The company can use your content without ever paying you for it. For example, your photo can appear in the app's ads and you get nothing.
- sublicensable
- The company can pass its rights over your content on to other companies without asking you. For example, an app can let an advertiser or a partner reuse your video under the licence you gave.
- indemnify
- You promise to pay the company's legal costs and losses if your use of the service gets it sued. For example, if you post a song you do not own and the label sues the app, you owe the app's lawyer bills.
- affiliates
- Other companies owned by or connected to the same parent company. For example, if you use one app, its sister apps under the same owner may also get your data.
- service providers
- Outside companies that handle your data on the app's instructions, such as a cloud host or an email sender. For example, the company that stores the app's files in the cloud sees your data but only does what the app tells it.
- cookies
- Small files a website saves on your device so it can recognise you and remember what you did. For example, a cookie keeps you logged in and can also tell an ad company which sites you visited.
How we got here · grade C · score 44/100 · 15 of 15 policy answers backed by a verified quote · 1 not stated
What does the app collect beyond what it needs to work?
They collect more than account and content: IP, fingerprints, cookies, source code, secrets, browsing on their domain, and professional data from LinkedIn and vendors.
Does it record your voice, face or body, and what happens to that?
The documents do not describe collecting voice, face, or body data as a product feature.
Are your chats and uploads used to train AI models, and is that off by default?
They say AI providers do not train on data inputted into Chunk or Chunk sidecars. CircleCI may still keep inputs and outputs to debug and improve features.
Can employees or contractors read your conversations, and when?
Not stated in the documents.
Are you profiled or tracked for advertising?
They and partners use targeting cookies and get data from ad servers and networks for interest-based ads, with a cookie opt-out.
Do they sell or share your data, and can you opt out?
They say they do not sell personal information under CCPA, but may share it for cross-context ads unless you opt out of targeting cookies. They also send Chunk inputs to AI providers.
What rights do they take over what you type and what the AI makes?
Content you post on the site is licensed to them forever, worldwide, irrevocable, and sublicensable, including the right to sell it.
How long do they keep your data after you delete it, and can you delete it in the app?
You request a copy or deletion through the Privacy Center. They keep data as long as needed for stated purposes or the customer contract, or longer if law requires.
Does it build a lasting memory or profile of you, and can you see, edit or turn it off?
They keep account health scores, lead scores, usage predictions, and marketing engagement, with no described user controls to view or turn that profile off.
Do they commit to basic security, and have they leaked data?
They describe TLS encryption and generally accepted standards, and point to a Security page. They do not guarantee no unauthorized access.
Is there a real age gate, and are teens protected?
The service is not directed to children and they say they do not knowingly collect from people below the lawful consent age. Website terms say you must be able to enter contracts and not be a minor.
Will they tell you when the rules change, and is the policy specific?
Privacy changes take effect when posted; using the service after that counts as acceptance. Material changes may be posted or communicated.
Can they close your account without warning, and can you get your data out first?
They may terminate or block site access in their sole discretion without prior notice.
If something goes wrong, who pays?
The site is as-is, liability is capped at $100, and you must indemnify them for claims related to your use or content.
Do subscriptions renew on their own, and can you get a refund?
The website terms say they may change prices for products or services at any time without notice. Paid CI plans are billed via a third-party processor.
The privacy policy is 6,201 words at a professional or legal expert level (Flesch reading ease 25.9); the terms are 3,297 words at a college graduate level.
