Privacy Policy

Last updated: July 3, 2026

Overview

Kickbacks.ai ("we", "us", "our") operates the Kickbacks VS Code extension and the kickbacks.ai website. This policy describes how we collect, use, and protect your information.

Information We Collect

• Account information: When you sign in with Google or via an email magic link, we receive your email address and display name (where available) to identify your account and credit earnings.
• Device identifier: A per-installation client identifier is generated locally to associate impression events with your account. It is pseudonymous: it does not identify you by itself, but for signed-in users it is linked to your account so we can credit earnings.
• Ad interaction events: For each ad served we record event telemetry: the event type (impression rendered, viewable, view-duration ticks, clicks), the ad/campaign/creative identifiers, the surface it appeared on (spinner, status line, or overlay), on-screen visibility metrics, a per-event ID used to deduplicate events, timestamps, and the extension and host application versions. In signed-out preview ("demo") mode, this telemetry is not attributed to any user account.
• IP address: We process your IP address on a transient basis for rate-limiting, abuse-detection, and fraud-prevention purposes.
• Payment information: If you purchase ad inventory, payment is processed by Stripe. We do not store your full card details.

Information We Do Not Collect

• Your source code, file contents, file names, or project structure.
• Your prompts, AI responses, or chat history.
• Your browsing activity outside of our extension and website.

The extension's telemetry is structurally limited to the ad-event metrics described above — the data it transmits contains no field capable of carrying your code, prompts, or AI interactions.

Local Processing (Never Transmitted)

To detect when Claude Code is actively running and which session is on screen, the extension reads Claude Code's local session transcript files (~/.claude/projects/**/*.jsonl) on your machine. From those files it parses only three things: the session's entrypoint tag (which distinguishes a VS Code panel session from a terminal session), the name of the most recent tool invocation, and whether the current turn has finished. This is used solely to time ad display and to stop the billing clock when activity ends.

This processing happens entirely on your device. No transcript content — no prompt, response, code, or tool name — is ever transmitted to our servers, and our telemetry schema contains no field capable of carrying it. The extension's source is publicly mirrored at github.com/andrewmccalip/kickbacks.ai if you would like to verify this yourself.

Cookies & Tracking Technologies

This section is the single, canonical description of the cookies and tracking technologies the kickbacks.ai website uses (the extension is different — see the sections above). Where any other part of this policy refers to website analytics or advertising cookies, it refers back here.

Consent and your control. Strictly-necessary cookies (sign-in, security, and the record of your own cookie choice) are always active because the site cannot function without them. Everything else — analytics and advertising — loads according to your choice and your location:

• In the EEA and the UK, no analytics or advertising cookie is set until you give consent. Our banner offers "Accept all" and "Reject all" with equal prominence, nothing is pre-selected, and the site remains fully usable if you decline.
• In Switzerland we apply the same opt-in banner as a conservative choice; Swiss law provides for notice with the ability to refuse.
• In the United States and elsewhere, analytics and advertising cookies may load by default, but you can reject them at any time, and we honor a Global Privacy Control (GPC) signal from your browser as a valid opt-out without any further action from you.

You can review or change your choice at any time — as easily as you gave it — using the Cookie settings link in our footer, or the button below. Withdrawing consent stops the relevant cookies from loading on your next page view.

Session replay (Microsoft Clarity). Our analytics category uses Microsoft Clarity, which — in addition to aggregate usage metrics — can record a replay of a visit (mouse movement, clicks, scrolling, and page navigation) to help us diagnose usability problems. We enable Clarity's content masking so that text you type and other page content are obscured in these recordings, and we do not run session recording at all on sign-in, account, payment, or support pages. Where opt-in consent is required (see above), Clarity loads only after you consent to analytics; elsewhere it may load by default unless you reject it or your browser sends a GPC signal. See Microsoft's privacy statement for how Clarity processes data; Clarity data is retained by Microsoft for up to 12 months.

Advertising measurement (Meta & Reddit pixels). Our advertising category uses the Meta (Facebook) and Reddit advertising pixels to measure how well our own ad campaigns perform (for example, whether an ad led to an install). These pixels set cookies and share limited event data with Meta and Reddit and, depending on your jurisdiction, this may be considered "sharing" or "targeted advertising." Where opt-in consent is required they load only after you consent to advertising cookies; elsewhere they may load by default. In every region they are suppressed where you have rejected them or your browser sends a GPC signal.

Cookies we may set:

Google Fonts. We self-host the web fonts used on the site, so loading a page does not send your IP address to Google to fetch fonts.

Your Privacy Choices

Use the control below (or the "Cookie settings" link in the footer of any page) to review or change the website cookie and tracking choices described in Cookies & Tracking Technologies. We also honor browser-level Global Privacy Control signals automatically.

Your Privacy Choices

How We Use Information

• Credit earnings to your account based on ad impressions.
• Serve relevant ads in the extension spinner slot.
• Improve our service and detect fraud or abuse.
• Communicate important account or service updates.

Google User Data

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we:

• Only use your Google email and display name to identify your account and credit earnings.
• Do not use Google user data for advertising, retargeting, or profiling.
• Do not sell, rent, or share Google user data with data brokers.
• Do not use Google user data to train AI or machine learning models.

Data Sharing

We do not sell personal information for money. We may share data with:

• Stripe: For payment processing and, when payouts open, payout processing and related tax-information collection.
• Google Cloud: For infrastructure hosting, authentication, and data storage.
• Twilio SendGrid: For transactional email (sign-in links and account notices).
• Microsoft Clarity, Meta, and Reddit: For website analytics and ad-campaign measurement, only where you have consented, on the terms and with the controls described in Cookies & Tracking Technologies above.
• Advertisers (extension): Only aggregate, anonymized impression and click counts.

Data Retention & Deletion

Account data is retained while your account is active, and may be retained for up to 7 years after termination or last activity where needed for fraud prevention, financial reconciliation, and legal compliance. You may request deletion by contacting us at support@kickbacks.ai; upon deletion, personal identifiers are removed or anonymized within 30 days, while aggregated or anonymized data and financial records required by law may be retained.

Your Privacy Rights

Depending on where you live (including California and other U.S. states with privacy laws), you may have the right to request access to, correction of, or deletion of your personal information, and to opt out of the sale or sharing of personal information and of targeted advertising. We do not sell personal information for money. For website cookies and advertising pixels — including any related "sharing" or "targeted advertising" — use Your Privacy Choices, as described in Cookies & Tracking Technologies. Details for California residents are in Section 18 of our Terms of Service. To exercise any of these rights, email support@kickbacks.ai.

Security

We use industry-standard measures including encrypted connections (TLS), secure authentication tokens, and access controls to protect your data.

Changes

We may update this policy from time to time. Material changes will be communicated via the extension or email.

Contact

Questions about this policy? Email support@kickbacks.ai.