Last Updated: September 23, 2026
PandaNpc Inc. ("we", "us" or "our") respects your privacy and is committed to protecting it through compliance with this Privacy Policy.
Data controller. PandaNpc Inc. is the controller of the personal data described in this Privacy Policy.
- Registered address: 75 E 3rd St, Sheridan, WY 82801, United States
- Company registration number: Wyoming Secretary of State ID 2025-001661823
- Privacy contact: support@pandanpc.com
1. Collection of Personal Data
We collect personal data when you use our Site and Service. Personal data is any information that relates to you, identifies you personally or could be used to identify you including: your name, mailing address, email address, and telephone number.
Types of personal data we collect:
- Personal data you voluntarily provide (registration information, contact details)
- Personal data collected automatically (IP address, browser type, device information)
- Information from third parties (data provided by business partners)
- Account and device identifiers: the internal user ID associated with your account and an app-generated device ID used to maintain login sessions, bind push-notification registrations, and protect account access. These identifiers are not used for advertising tracking.
- Subscription and purchase history: when you use an Apple in-app subscription, we receive and retain the product identifier, original transaction identifier, pseudonymous app account token, purchase and expiration dates, subscription status, and App Store environment. We use this information to verify purchases, grant membership benefits, process renewals, cancellations, refunds, and refund reversals, prevent duplicate claims, and provide support. Apple processes your payment method; PandaNpc does not receive your card number, bank account number, or Apple Account password.
- Session content for AI features: the messages and prompts you type, any images you attach, voice recordings you make when using the voice input feature, the conversation context of each session, and any code, file contents, or command output that you or the AI assistant reference within a session. How we collect it: this content is collected only when you actively type, speak, or send content while using AI features in a session; we do not access your files or device content in the background.
2. Cookies and Tracking Technologies
We use cookies and similar browser storage (such as localStorage). Non-essential cookies and trackers are only set after you give consent in our cookie banner. You can accept all, reject all, or choose by category, and change your choice at any time via "Cookie settings" in the website footer or on your account page. We keep a record of your choice (a random consent ID, the choice, the policy version, time, IP address and browser user agent) as proof of consent.
Categories we use:
- Strictly necessary (always on, no consent required): sign-in state, language, theme, the regional pricing cookie
pnpc_geo, and the stored cookie choicepnpc_cookie_consent. - Analytics (only with your consent): Google Analytics (cookies
_gaand_ga_*, provided by Google LLC) and our own first-party visit statistics (browser storagepnpc_visitor_idandpnpc_sess_*). If you reject or withdraw consent, these are not set and existing ones are removed from your browser.
We do not use advertising cookies or marketing pixels.
3. How We Use Your Personal Data
We use your personal data for:
- Providing and maintaining the Service
- Transmitting your session content to third-party AI providers to generate AI responses, converting voice input to text, and generating an automatic session title and avatar image (see Section 4: AI Features, Data Shared with Third-Party AI Providers, and Your Consent)
- Processing your registration and account management
- Verifying App Store transactions, maintaining subscription status, restoring purchases, handling billing lifecycle events, and preventing subscription fraud or duplicate claims
- Communicating with you, including sending notifications and updates
- Providing customer support
- Sending marketing and promotional communications, only if you have opted in
- Improving and optimizing our services
- Protecting service security and preventing fraud and abuse
- Complying with legal obligations
- Resolving disputes and enforcing our policies
Legal Bases for Processing (EEA, UK and Switzerland)
If you are in the EEA, the UK or Switzerland, we rely on the following legal bases under the GDPR:
- Performance of a contract (Art. 6(1)(b)): providing your account, the Service, AI features you request, Agent Cloud, subscriptions and payments, and customer support.
- Consent (Art. 6(1)(a)): analytics cookies, sharing session content with third-party AI providers where the app asks for your consent, voice input, and marketing emails. You can withdraw consent at any time without affecting processing carried out before withdrawal.
- Legitimate interests (Art. 6(1)(f)): keeping the Service secure, preventing fraud and abuse, and improving the Service, where these interests are not overridden by your rights.
- Legal obligation (Art. 6(1)(c)): tax, accounting, and responding to lawful requests from authorities.
We record when you accept our Terms of Service and this Privacy Policy, together with the version accepted, the time, IP address and browser user agent.
4. Sharing and Disclosure of Personal Data
We may share your personal data:
- With service providers: To help us operate and improve services
- With third-party AI providers: To process your content and provide AI features (see below)
- With affiliates and business partners
- In corporate transactions (mergers, acquisitions)
- With government authorities when legally required
- With your consent
- In aggregated and de-identified form for analytics and research
We do not sell your personal data to third parties.
Main service providers (processors). We use the following categories of service providers, which process personal data on our behalf under data processing terms:
- Stripe, Inc. and its affiliates (United States): payment processing for web purchases. Stripe receives your payment details directly; we do not store your full card number.
- Apple Inc. (United States): in-app purchases on iOS (see below).
- BandwagonHost (IT7 Networks) (data center in Los Angeles, California, United States): hosting of our servers, databases and Agent Cloud machines that run the Service.
- Tencent Cloud Simple Email Service (Hong Kong region): sending sign-in codes and service notices.
- Google LLC (United States): Google Analytics (only with your consent) and Google sign-in if you choose it.
- GitHub, Inc. (United States): GitHub sign-in if you choose it.
- AI model providers: Anthropic, OpenAI, Google (Gemini), xAI (Grok), DeepSeek, Zhipu AI (GLM), OpenRouter (United States), Alibaba Cloud (Singapore region) and other providers you or we configure, as described in "AI Features" below. Depending on the provider, data may be processed in the United States, Singapore, China or other countries.
For iOS purchases, Apple independently processes payment and App Store account information under Apple's privacy policy. We receive only the signed transaction and subscription information needed to provide PandaNpc membership; we do not receive the payment-card details entered with Apple.
AI Features, Data Shared with Third-Party AI Providers, and Your Consent
PandaNpc is a client for accessing AI coding assistants. When you use AI features, certain data is shared with third-party AI services. We share this data only after meeting all of the requirements below.
What data is shared. The messages and prompts you type; any images you attach; the full conversation context of your session; and any code, file contents, or command output that you or the AI assistant reference within a session. To improve usability, a summary of your session content is also used to automatically generate a short session title and an avatar image. If you use the voice input feature, your audio recording is shared solely to convert your speech to text.
Who the data is sent to.
- The AI provider that powers your session: Your messages and session content are processed to generate AI responses. By default this is Anthropic (Claude). Depending on the AI provider configured in your own command-line tool, or in demo/sandbox sessions that we provide, your session may instead be processed by another AI provider such as DeepSeek or OpenAI. The data is routed through our relay service to the connected machine and then to that AI provider.
- OpenAI: A summary of your session content and the generated title are processed solely to create the automatic session title and avatar image. If you use the voice input feature, your audio recording is processed by OpenAI's speech-recognition service (Whisper) solely to convert your speech to text; the recording is not used for any other purpose.
Consent before sharing. The app discloses this data sharing and obtains your explicit, affirmative consent within the app before any session content is sent to a third-party AI service. If you do not consent, no session content is shared and the related AI features are not used. You may withdraw your consent at any time in the app's settings, after which AI features that require this sharing will be unavailable.
Purpose and limits. This data is used solely to provide the AI features described above. We do not sell your data, and we do not use it for advertising or unrelated purposes.
Third-party data protection. Before sharing your data with these third-party AI providers, we confirm through their terms and data processing agreements that they provide the same or an equal level of protection for your data as described in this Privacy Policy. These providers process your data solely to deliver the requested features and do not sell it. For details, please review Anthropic's Privacy Policy, OpenAI's Privacy Policy and DeepSeek's Privacy Policy.
Browser Extension and Web Automation
PandaNpc offers an optional Chrome browser extension ("the Extension") that connects to your own coding agent session, including Claude Code, Codex, PandaCode or DeepSeek Harness, and performs browser tasks you delegate to that agent.
What the Extension accesses. During a delegated browser task, the Extension can read page content, click, fill forms, scroll, take screenshots, upload files and navigate in the selected target browser tab. It can also list and switch tabs and read or modify site cookies to manage your own login state when the task requires it. The automation target may remain selected when you switch to another tab.
User-directed automation and controls. Browser commands arrive through your authenticated agent connection. Starting with version 0.1.62, the Extension does not apply a domain blacklist or require an additional in-panel approval for each browser action. Your connected agent may apply its own permission rules. You can stop the agent session or pause browser automation.
How the data is used. Requested page content, screenshots and tool results are sent through the encrypted PandaNpc relay connection to your connected agent session to carry out your task, as described in Section 4 for session content. The Extension keeps a recent local audit of browser tool names, target URLs and execution outcomes. Website content is not used for advertising or resale.
Permissions. Website access, scripting, the debugger permission and cookie access support the browser tasks you delegate, including page interaction, screenshots and login-state management. The Extension also reuses your PandaNpc sign-in to authenticate its connection.
5. Your Rights and Choices
You have the following rights regarding your personal data:
- Right to access: Request access to personal data we hold about you
- Right to correction: Request correction of inaccurate personal data
- Right to deletion: Request deletion of your personal data
- Data portability: Receive your personal data in a structured format
- Right to object: Object to certain types of data processing
- Right to restriction: Restrict data processing in certain circumstances
- Right to withdraw consent: Withdraw previously given consent
- Right to lodge a complaint with a data protection supervisory authority, in particular in the EU/EEA member state where you live or work
How to exercise your rights.
- Export your data: signed-in users can download a copy of their account data as a JSON file from the account page (https://pandanpc.com/account). For a complete copy including other data we hold, email support@pandanpc.com.
- Delete your account: use "Delete account" on the account page, or email support@pandanpc.com.
- Cookie choices: use "Cookie settings" in the website footer.
- For any other request, contact support@pandanpc.com. We will respond within one month, which may be extended by two further months for complex requests as permitted by law. We may need to verify your identity first.
6. Marketing Communications
We only send marketing emails if you have actively opted in; we never pre-select this choice. You can withdraw at any time. To stop receiving marketing emails, you can:
- Click the "unsubscribe" link in the email
- Send an email to support@pandanpc.com stating your request
- Update your preferences in account settings
Note that even if you opt-out of marketing communications, we may still send you important service-related notices.
7. Data Security
We implement and maintain physical, technical and administrative security measures to protect your data from accidental loss and unauthorized access, use, alteration and disclosure.
Our security measures include:
- Encryption technology to protect data transmission
- Storing data on secure servers
- Restricting access to personal data
- Regular security audits and assessments
However, please note that transmission of information via the internet is not completely secure. Your account security also depends on your password protection.
8. Data Retention
We retain your personal data for as long as reasonably necessary to:
- Provide services
- Comply with legal obligations
- Resolve disputes
- Enforce our agreements
- Meet regulatory and compliance requirements
Specific retention periods:
- Account data: kept while your account is active. After you delete your account, we delete or anonymize it within a reasonable period, except where we must keep it longer by law.
- Agent Cloud data: if your Agent Cloud subscription ends and is not renewed, Agent Cloud and the data stored on it are deleted 15 days after the subscription ends. Please export anything you need before then.
- Payment and invoice records: kept for the period required by tax and accounting laws (typically up to 10 years).
- Consent records (terms, privacy and cookie consents): kept for as long as needed to demonstrate consent, and for the duration of any related legal claims.
- Analytics data: Google Analytics data is kept according to the retention setting of our Google Analytics property. [Retention period to be confirmed.]
When personal data is no longer needed, we will destroy, delete or convert it into anonymous form as required by applicable laws.
9. Children's Privacy
Our Service is intended for users aged 13 and above. We do not knowingly collect personal information from children under 13.
If you are a parent or guardian and aware that your child has provided us with personal data, please contact us. If we discover that we have collected personal data from children under 13 without parental consent, we will take steps to remove that information.
10. International Data Transfers
When you access our Site or Service, your personal data may be transferred to the US or other countries outside the European Economic Area (EEA) and UK.
Our servers (hosted by BandwagonHost in Los Angeles, California), as well as several of our service providers (including Stripe, Apple, Google, GitHub, Anthropic, OpenAI and OpenRouter), are located in the United States. Our email delivery provider (Tencent Cloud) processes data in Hong Kong, and some AI providers process data in other countries, such as Alibaba Cloud in Singapore and DeepSeek and Zhipu AI in China. We ensure appropriate legal protection through:
- European Commission adequacy decisions, including the EU-U.S. Data Privacy Framework where the recipient is certified
- Standard contractual clauses approved by the European Commission (and the UK addendum where applicable)
- Other legally permitted data transfer mechanisms
You can request a copy of the relevant safeguards by contacting support@pandanpc.com.
We take measures to ensure your data is adequately protected during transfer.
11. Third-Party Services
Our Site may contain links to third-party websites, applications, or services. We are not responsible for the privacy practices of these third parties.
When you click on third-party links or use third-party services, please review their privacy policies to understand how they collect, use, and share your information. This Privacy Policy applies solely to information collected by PandaNpc.
12. Changes to Privacy Policy
We may update this Privacy Policy from time to time. For material changes, we will:
- Notify you via email (if you provided an email address)
- Post a prominent notice on our website
- Provide in-product notification
Where required by law, we will ask you to accept the updated Privacy Policy the next time you sign in. We recommend reviewing this page regularly to stay informed about our privacy practices.
13. Governing Law and Jurisdiction
This Privacy Policy is governed by Wyoming State law without regard to conflict of law principles. If you live in the EU/EEA or the UK, nothing in this section limits the rights you have under the GDPR or other mandatory data protection law of your country, including the right to complain to a supervisory authority or to bring claims before the courts where you live.
Any disputes arising from this Privacy Policy or our data processing practices shall be resolved through binding arbitration in Wyoming or by an arbitrator in accordance with the American Arbitration Association (AAA) Commercial Arbitration Rules.
14. Contact Us
If you have any questions, concerns, or requests about this Privacy Policy, please contact us:
Support: support@pandanpc.com
We will respond to your inquiries within a reasonable timeframe. For certain requests, we may need to verify your identity to protect your privacy and security.