Privacy Policy

Guildlings Plus has not been for sale since October 18, 2026. Guildlings is now an extension of natdal, and every feature is free. For new users, the natdal Terms and natdal Privacy Policy apply. This document keeps applying to Plus purchases already made and their records.

The short version

Guildlings reads what your coding agents write on your own disk and draws it on your own screen. The free app has no account, no telemetry and no analytics. If you buy Plus you sign in once, and we keep what is needed to know that you paid and which computers are yours — never what your agents are doing. This website counts visits outside Europe — see “This website”.

What stays on your machine

All of it lives under .guildlings in your home folder (%USERPROFILE%\.guildlings\ on Windows, ~/.guildlings/ elsewhere) and stays there, except as described under “What leaves your machine”:

• Your settings — theme, language, which monitors, hotkeys.
• The usage ledger: dates, token counts, tool names, model names, and the last segment of a repository path. Never a prompt, never a full path, never a command line.
• This computer’s device key. Its private half never leaves the computer — it is sealed to your Windows user, or kept in the macOS keychain.

What leaves your machine

On the free app, nothing but an update check: your computer fetches a file from GitHub, exactly as a browser would, and GitHub sees the computer’s IP address. There is no beacon, no crash reporter, and no “anonymous usage statistics”.

If you sign in for Plus:

• Signing in. You approve the computer in a browser with Google or GitHub. The app sends our account service this computer’s name (the computer name set in the operating system, i.e. its hostname — on a Mac, the Computer Name in Sharing settings), the kind of operating system and the device’s public key. If the computer’s name contains your real name, that goes too. We receive your email address and that account’s identifier — not your password.
• Staying signed in. On launch and about once an hour the app asks our account service for a short-lived pass, signed with the device key. That request carries the device’s number, a timestamp and the signature, and the answer says which plan you have and until when.
• Your other devices. Live sessions and the usage ledger travel between the devices on your own account, encrypted end to end. Each device keeps a copy of the others’ usage ledgers so totals still show while a device is off; a device you remove keeps its past usage until you choose “Forget its usage”. When no direct path exists, traffic passes through our relay, which sees only encrypted traffic and the addresses it connects. The app asks our service which devices on your account it may connect to.
• Finding each other. Each device publishes its public key and the relay it can be reached through (relay.natdal.app) to an address-lookup (DNS) service run by n0 (Number 0), and looks the others up there. It does not publish its IP address, but n0’s server sees the IP address a request comes from.

This website

guildlings.natdal.app and natdal.app, where this policy is published, use Google Analytics 4 to count visits: which pages are viewed, where visitors came from (a search engine or an AI assistant, for example), the browser and device type, and the approximate country. It sets first-party cookies (_ga, _ga_*) to tell visits apart; Google Analytics 4 does not store IP addresses. In the European Union, the United Kingdom and Switzerland the analytics script is not loaded at all. We use this only to see which pages help, and never connect it to a Plus account. Google’s side is covered by Google’s privacy policy. The app sends none of this. How to refuse the cookies is under “Cookies”.

What we keep about a Plus account

• Your email address and the sign-in provider’s identifier for you.
• Your devices: the name (the computer name the app sent when signing in) and operating system, their public keys, when they were added and last seen. You can remove a device at any time and it is cut off at once; the record of a removed device stays until the account is deleted.
• Your plan: which one, until when, and Paddle’s order, subscription and customer numbers.
• If you ask for a refund or end a trial: the reason you picked and anything you wrote with it, only if you chose to. We read them only to improve Guildlings and share them with no one; Paddle receives only the reason you picked.
• The agreements given on the buy screen and when, the buy screen’s language, and the record of the trial-ending email sent.
• A record of feedback sent from the app (feedback id, time, size) — used only to stop too-frequent sending, and deleted after 24 hours. The feedback text itself is not kept (see “Feedback from the app”).
• Access records: the account service uses the requesting IP address to rate-limit abuse, and a failed or rate-limited request may be written to the server log with its IP address and time.

That is all. We never receive what your agents do, read or write.

When you buy

The purchase happens on Paddle, our merchant of record. They take your payment details and billing address; we receive an order record and never see a card number. Paddle’s privacy notice covers that half.

Support email

If you write to [email protected] or [email protected], we process that mail — the address, your name, the message and any attachment — only as far as answering it needs.

• Mail is kept in Google Workspace (Gmail).
• To draft a reply, the message may be sent to Anthropic’s Claude. A person reads and edits every draft before it is sent, and the account is set so the content is not used to train models.
• We keep support mail sent to [email protected] or [email protected] for up to one year after the last reply, then delete it. Mail about a complaint or dispute over a payment or refund is kept for three years, as set out under “How long we keep it”. To have it deleted sooner, ask from the same address.

Transfer abroad. For this, the address, name and message are transferred over the network, when the mail arrives, to Google LLC and Anthropic, PBC in the United States, kept as above. If you prefer no transfer, you can reach us another way.

Feedback from the app

“Send feedback” in the Natdal app, or the natdal feedback command, sends feedback through your signed-in Natdal account. With it go:

• What you wrote, the category you picked (problem, idea or other), and which app it is about.
• The app version and operating system (name, version and architecture).
• The account’s email address (as the address to reply to), your Natdal account number and device number.
• Only if you tick “Include logs”, the app’s recent logs. Before they leave, the device masks home folder paths, your user name, email addresses, tokens and IP addresses, and you can see what will be sent.

We use this only to answer you and to fix problems. The account service does not store the feedback; it passes it on as one email to our support inbox (Google Workspace), and from there it is handled like “Support email” above — kept until one year after the last reply, then deleted. To draft a reply, only the mail’s body (what you wrote and the app and account details above) may be sent to Anthropic’s Claude, never the log attachment. Transfers abroad are as for support email, and logs go to Google LLC only.

How long we keep it

What	How long
The Plus account (email, sign-in identifier, devices, plan)	Until the account is deleted; on request we delete it within 30 days
Purchase, cancellation and refund records (Paddle order, subscription and customer numbers, plan and period, refund and trial-ending records with the reason picked), and the email address needed to know whose they are	Five years from the transaction — Enforcement Decree of the Korean Act on Consumer Protection in Electronic Commerce, Article 6(1)(2) (contracts and withdrawals) and (3) (payment and supply). After the account is deleted they are kept apart from everything else, for this purpose only
Support mail about a complaint or dispute over a payment or refund	Three years — the same Decree, Article 6(1)(4) (consumer complaints and disputes)
Other support mail (sent to [email protected] or [email protected], and feedback sent from the app)	One year after the last reply
Record of feedback sent (feedback id, account, time, size)	24 hours
Access records in server logs	Up to 30 days
Website visit statistics (Google Analytics 4)	Deleted by Google after the Google Analytics retention setting (2 months). The _ga cookie stays in your browser for up to two years and you can delete it at any time
Backup copies	Gone within 30 days of the original being deleted, as backups rotate

Paddle, as the seller, keeps its own order records under its own legal obligations (tax law and others).

How we destroy it

When a retention period ends or we receive a deletion request, we delete the rows from the account database without delay (a deletion request within 30 days), and the copies in backups disappear as the backups rotate. Records the law requires us to keep are held apart and deleted the same way when their period ends. Everything we keep is in electronic files and is deleted so it cannot be recovered; we keep no personal data on paper.

Who processes it for us

Processor	What for	Where
Vultr Holdings, LLC	Running the account service and relay servers (hosting)	Republic of Korea (Seoul data center)
Cloudflare, Inc.	Storing account database backups (R2); hosting the websites (Pages, Workers)	Backups in the Asia-Pacific region; websites at the Cloudflare data center nearest the visitor
Google LLC	Business email (Google Workspace); website visit statistics (Google Analytics 4)	United States and elsewhere
Anthropic, PBC	Drafting replies to support mail	United States

Who we give it to

Paddle.com Market Limited sells you Guildlings Plus as the merchant of record. It is not our processor: it handles personal data under its own responsibility. When a checkout opens we give Paddle your email address and Natdal account number, so the purchase lands on your account, and when you ask for a refund we give it the reason you picked. Paddle uses them to sell, take payment, handle tax and refund, and keeps them as Paddle’s privacy notice and its legal obligations say. Before a checkout opens, the buy screen asks for your separate agreement to this (you may refuse, but then you cannot buy). We give personal data to no one else unless the law requires it.

Transfers abroad

To make and perform our contract with you, we transfer personal data abroad as below (Korean Personal Information Protection Act, Article 28-8(1)). The transfers for support mail and app feedback are under “Support email” and “Feedback from the app”.

Recipient (contact)	Country	What	When and how	Purpose	Kept for	To refuse
Paddle.com Market Limited (privacy)	United Kingdom (affiliates in the United States and elsewhere)	Email address, Natdal account number, reason picked for a refund	When a checkout opens and when you ask for a refund, over the network	Selling, payment, tax and refunds	As Paddle’s policy and legal obligations say	Not buying means no transfer (and no purchase)
Cloudflare, Inc. (privacy)	US company; stored in the Asia-Pacific region	The whole account database (email, sign-in identifier, devices, plan, purchase and refund records)	Continuously as it changes and daily, over an encrypted connection	Backup	As the original, and up to 30 days after it is deleted	Not creating a Plus account means no transfer
Google LLC (privacy)	United States	Pages viewed, referrer, browser and device type, approximate country, cookie identifier	While you view the websites, from your browser	Visit statistics	The Google Analytics retention setting (2 months)	Refuse as under “Cookies”; the site works the same
n0, Number 0 (iroh.computer/legal)	Not confirmed from public information	Device public key, relay address, requesting IP address	Periodically while an app signed in to Plus runs, over the network	Letting your devices find each other	As n0 decides (address records expire unless refreshed)	Not using other-device connections (Plus) means no transfer
GitHub, Inc. (privacy)	United States	IP address	When the app checks for updates, over the network	Delivering update files	As GitHub’s policy says	Blocking the update check stops it, but then you get no updates

The account service servers (Vultr) are in the Republic of Korea and are not in the table above.

Cookies

The app uses no cookies. guildlings.natdal.app and natdal.app set Google Analytics 4 cookies (_ga, _ga_*) — never in the European Union, the European Economic Area, the United Kingdom or Switzerland. If you do not want them, block or delete this site’s cookies in your browser settings, or use Google’s Google Analytics Opt-out Browser Add-on. The site works the same either way. The Natdal account page (id.natdal.app) and sign-in page (accounts.natdal.app) use only the cookies needed to keep you signed in.

Children under 14

Nobody under 14 may create a Natdal account or buy Guildlings Plus. If we learn that personal data of a child under 14 has reached us, we delete it without delay.

Your rights and how to use them

You may at any time ask to see the personal data we keep about you, correct it, delete it, stop its processing, and withdraw any consent you gave. Write to [email protected] from the account’s email address. A legal guardian or someone you authorise may ask on your behalf with proof of that authority. We answer a request to see your data within 10 days and carry out a deletion within 30 days; where the law makes us refuse or delay, we tell you why and how to object. Records kept by law under “How long we keep it” cannot be deleted during that period.

For help with a privacy violation you can also contact the Korean Personal Information Infringement Report Center (privacy.kisa.or.kr, 118 in Korea) or the Personal Information Dispute Mediation Committee (www.kopico.go.kr, 1833-6972).

How we keep it safe

All traffic to the account service is encrypted with HTTPS, and traffic between your devices is encrypted end to end. Server administration is reachable only over a private network with password login turned off, and the servers’ secret key files are readable only by the administrator. The backup storage key works only for that one bucket and only from the server’s addresses.

Privacy officer

KIM DONG HUN (owner) · [email protected]. Questions, complaints and requests for redress about personal data go to this address.

Your data, your delete key

Deleting the .guildlings folder removes everything the app has kept on that computer. To delete a Plus account and everything we keep about it, write to [email protected] from the account’s email address; we do it within 30 days. The purchase and refund records under “How long we keep it” are kept apart for the period the law sets. Paddle keeps the order records that tax law requires them to keep.