Privacy

End-to-end encrypted. We can't read your handoffs.

Everything you and Claude write in Dococ is sealed on your own computer before it leaves. Our server holds the locked copy and only the details it needs to tell each side whose turn it is. Here's exactly what that means, then the full policy.

Read the full policy

How the encryption works

Step 1 of 4
Your computer gets its own keys
When you sign in, Dococ makes a pair of keys on your computer. The private half stays in your Mac's login Keychain, on that machine only confirm where the Windows app keeps it. Our server only ever gets the public half.
Step 2 of 4
Each handoff is sealed before it leaves
Every document gets its own key, and each sealed field is locked with XChaCha20-Poly1305 and tied to its exact place in your project. A copy moved anywhere else simply won't open.
Step 3 of 4
Teammates get the key from a teammate
A project's key reaches a new member only when someone already on the project wraps it for their computer. A second computer of your own has to be approved from your first, with a 6-digit code.
Step 4 of 4
Recovery stays with your team
Your team keeps a 24-word recovery phrase. Our server holds only its public half. If your team loses the phrase and every computer, no one — including us — can unlock your documents.

Your Mac

Private key · stays in Keychain

Public key · sent to Dococ

Step 1 of 4
Your computer gets its own keys
When you sign in, Dococ makes a pair of keys on your computer. The private half stays in your Mac's login Keychain, on that machine only confirm where the Windows app keeps it. Our server only ever gets the public half.
Your Mac
Private key · stays in Keychain
Public key · sent to Dococ
Step 2 of 4
Each handoff is sealed before it leaves
Every document gets its own key, and each sealed field is locked with XChaCha20-Poly1305 and tied to its exact place in your project. A copy moved anywhere else simply won't open.
- 9f3a c1e0 77b2 04de
- e8c4 a19f 3d2b 6c07
- 5b1e 90fa c3d8 2e64
- a07c 4f19 d2e3 8b51
Step 3 of 4
Teammates get the key from a teammate
A project's key reaches a new member only when someone already on the project wraps it for their computer. A second computer of your own has to be approved from your first, with a 6-digit code.
Your Mac
Dococ server
What the server sees
Turn 3Frontend's moveRelease12 Oct 11:418 KB
e8c4 a19f …
Ciphertext — no key here
Checkout total skips tax
Theo's Mac
Opened with the wrapped project key
Step 4 of 4
Recovery stays with your team
Your team keeps a 24-word recovery phrase. Our server holds only its public half. If your team loses the phrase and every computer, no one — including us — can unlock your documents.
Recovery phrase
Only your team holds this
1. 01orbit
2. 02maple
3. 03canvas
4. 04ripple
5. 05anchor
6. 06velvet
7. 07harbor
8. 08lunar
9. 09cobalt
10. 10meadow
11. 11signal
12. 12ember
13. 13quartz
14. 14willow
15. 15summit
16. 16lantern
17. 17fabric
18. 18glacier
19. 19nectar
20. 20pilot
21. 21saddle
22. 22thrive
23. 23voyage
24. 24zenith

What's sealed, and what our server sees

No vague promises. This is the list, read from the code.

What	Sealed on your deviceEncrypted before it leaves your computer. Our server stores only ciphertext it has no key for.	Visible to our serverNeeded to route turns, run your account and keep the board in sync.
The full text of every handoff	Yes	No
Each handoff's filename	Yes	No
Headlines, summaries and what changed between turns	Yes	No
Thread titles	Yes	No
Every ask's title, effort, evidence and notes	Yes	No
Open questions, assumptions, answers and their options	Yes	No
Your account: email, name and profile picture, from Apple or Google	No	Yes
Team and project names, sides and who is a member	No	Yes
Email addresses you invite	No	Yes
Each computer's name, platform and public keys	No	Yes
Your browser or app version on each session	No	Yes
Whose turn it is, ask status, severity and ids like A-1	No	Yes
Timestamps, counts and who has seen a turn	No	Yes
Each document's size, rounded up to the nearest 4 KB	No	Yes
Whether two filenames or two documents are identical — never what they say	No	Yes

Never collected

Claude Code transcripts
Repo contents
Repo paths
Anthropic keys or tokens
Terminal output

Technical detail

XChaCha20-Poly1305 per field with authenticated data binding team, project, table, row and field; project keys wrapped per device with X25519, HKDF-SHA256 and XChaCha20-Poly1305; Ed25519 device signatures; blind indexes as truncated HMAC-SHA256. Implemented with the audited @noble libraries and checked against libsodium test vectors.

Privacy Policy

Last updated effective date

This policy explains what personal data Dococ collects, why, and what you can do about it. Dococ is made by Codeable's full legal name (“Codeable”, “we”, “us”), registered address and country. It covers the Dococ apps for macOS and Windows, the Dococ runner, our servers, and this website.

What we collect

In short:Your account, your team's structure, the activity that runs the board — and your handoffs, which we hold sealed and can't read.

This is everything Dococ stores about you and your team, where it comes from and why we need it. Anything marked sealed is encrypted on your computer before it reaches us: we keep the locked copy, but we have no key to open it.

What we collect
What	Where it comes from	Why we need it	Can we read it?
Account detailsYour email address and name, and your profile picture if you sign in with Google. If you use Apple's Hide My Email, the relay address Apple gives us.	Apple or Google, when you sign in	To create your account and sign you in	Yes
Team and project detailsTeam and project names, your team's sides (such as frontend and backend), members and their roles, and the email addresses you invite.	You and your teammates	To build your board and show each person the right projects	Yes
Your handoffsEvery document you publish and everything in it: filename, headline, summary, asks, evidence, notes, open questions and answers.	Dococ on your computer, after it seals them	To deliver each turn to the other side	No, it's sealed
Board activityWhose turn it is, each ask's status, severity and id (like A-1), counts, timestamps, who has seen a turn, and each document's size rounded up to 4 KB.	Created as your team uses Dococ	To sort the board and show what changed	Yes
Matching fingerprintsA keyed fingerprint of each filename and document, which tells us whether two are identical and nothing about what they say.	Made on your computer before anything is sent	To keep a reply on the same thread as the document it answers	Only whether two match
Devices and sessionsEach computer's name (its host name), platform and public encryption keys, and the browser or app version for each signed-in session.	Your computer, when it connects	To deliver keys to the right machines and keep your account secure	Yes

Account details
Yes
Your email address and name, and your profile picture if you sign in with Google. If you use Apple's Hide My Email, the relay address Apple gives us.
Where it comes from
Apple or Google, when you sign in
Why we need it
To create your account and sign you in
Team and project details
Yes
Team and project names, your team's sides (such as frontend and backend), members and their roles, and the email addresses you invite.
Where it comes from
You and your teammates
Why we need it
To build your board and show each person the right projects
Your handoffs
No, it's sealed
Every document you publish and everything in it: filename, headline, summary, asks, evidence, notes, open questions and answers.
Where it comes from
Dococ on your computer, after it seals them
Why we need it
To deliver each turn to the other side
Board activity
Yes
Whose turn it is, each ask's status, severity and id (like A-1), counts, timestamps, who has seen a turn, and each document's size rounded up to 4 KB.
Where it comes from
Created as your team uses Dococ
Why we need it
To sort the board and show what changed
Matching fingerprints
Only whether two match
A keyed fingerprint of each filename and document, which tells us whether two are identical and nothing about what they say.
Where it comes from
Made on your computer before anything is sent
Why we need it
To keep a reply on the same thread as the document it answers
Devices and sessions
Yes
Each computer's name (its host name), platform and public encryption keys, and the browser or app version for each signed-in session.
Where it comes from
Your computer, when it connects
Why we need it
To deliver keys to the right machines and keep your account secure

We don't store IP addresses. Our servers use them briefly, in memory, to slow down repeated sign-in attempts.

What we never collect

In short:No transcripts, code, repo paths, Anthropic keys or terminal output.

Dococ never collects your Claude Code transcripts, the contents of your repositories, where your repositories are on disk, your terminal output, or any Anthropic API key or token. Dococ never stores, forwards or proxies an Anthropic credential: the runner starts the Claude Code already on your computer, signed in with your own account, and an automated check in our build fails if any such credential handling is added.

What stays on your computer

In short:Your keys, your files and a few local working files. None of it is sent to us.

Your handoffs stay as plain markdown files wherever Claude wrote them, usually in your repository. When you press Implement, Dococ keeps a temporary working copy in its Application Support folder and deletes copies older than 7 days.

The runner keeps a small settings file and an outbox of pending sends (a file path and a checksum, never the text) in ~/.dococ. When it installs its Claude Code hook, it first backs up your Claude settings files and keeps the first backup and the latest four, on your computer only.

How we use it

In short:To run your account and the board. No ads, no selling, no training.

We use your data to sign you in, show your team's board, deliver turns between sides, keep your devices in sync, and secure the service. We don't sell personal data, we don't use it for advertising, and we don't use your content to train AI models — we can't read it.

Legal bases (EEA and UK)

In short:Contract for running Dococ; legitimate interests for security.

We process account, team and activity data to provide Dococ under our contract with you, and device, session and rate-limiting data under our legitimate interest in keeping the service secure. Where we ask for consent, such as for product news, you can withdraw it at any time.

How long we keep it

In short:For as long as your account and teams exist, then it's deleted.

Deleting a project or a team permanently deletes everything in it, including every encrypted document. Expired sessions are cleared every hour, and unused invitations expire after 14 days. backup retention period

Your rights

In short:See, correct, export or delete your data. Just ask.

Depending on where you live, you can ask to access, correct, export or delete your personal data, or object to how we use it. To delete your account, email privacy@dococ.app from your account's address and we'll delete it within 30 days. You can also complain to your local data protection authority.

International transfers

In short:Data may be processed outside your country, with safeguards.

Our providers may process data outside your country, including in hosting countries. Where the law requires it, we rely on safeguards such as the European Commission's Standard Contractual Clauses.

Children

In short:Dococ isn't for anyone under 16.

Dococ is a developer tool and isn't intended for anyone under 16. We don't knowingly collect data from children; if you think we have, contact us and we'll delete it.

This website

In short:No cookies, no trackers, no third-party requests.

dococ.app sets no cookies, runs no analytics or trackers, and makes no requests to third parties; fonts are served from our own site. Our hosting provider, Vercel, processes standard request data such as IP addresses to serve the site. If you use the contact form, we receive what you send and use it only to reply.

Changes to this policy

In short:We'll tell you before anything important changes.

If we make a material change, we'll tell you in the app or by email before it takes effect, and update the date at the top of this page.

Contact

In short:Questions go to a real person.

Email privacy@dococ.app, or write to Codeable's full legal name and registered address.