Privacy policy

Sidecar (“Sidecar”, “we”) runs the Sidecar plugin for Claude Code and the website and ad server at sidecar.lol. This policy covers both. Sidecar is independent and is not made or endorsed by Anthropic.

The plugin's source is public, and the docs list every call it makes. In short:

• On first run, the client name and your Claude Code version. We give the device a random token and a claim code.
• When a turn starts, which ad placements your terminal can show.
• While an ad plays, how long it has played, whether it is on screen, and how long ago you last typed, sent a prompt or command, or pressed the ad pane. That last figure is a number of milliseconds, not what you typed. We use it to count views only while you are at the keyboard (within 90 seconds of activity).
• When an ad ends, how long it played and why it ended.

The plugin never sends your prompts, Claude's responses, code, file names or paths, the transcript, your working directory, tool calls, environment variables, or anything about your Anthropic account.

• Account: your email address and, if you give one, your name. We email you a single-use link to sign in.
• Earnings: which devices you claimed, the impressions they showed, and the credits, holds and payouts that follow.
• Payouts: Stripe runs onboarding and identity checks through Stripe Connect. We store your Stripe account id and whether payouts are enabled, not your bank or identity documents. Stripe's own privacy policy covers what it collects.
• Advertisers: business name, campaign settings, creatives, and top-up records. Card payments go through Stripe Checkout; we never see card numbers.
• Network: our servers see your IP address, as any website does. We keep only the country Cloudflare derives from it, for advertisers' country targeting, and do not store the IP. To limit how many new installs one network can register, we keep a keyed fingerprint of it that changes every day and is deleted when the day ends; it cannot be turned back into the address. To stop fraud, each install also keeps a second keyed fingerprint of the network it came from for 30 days, so that we can block a network that abuses the service.
• Clicks: a click on an ad passes through our server so the advertiser's click count is right, then sends you on. We record that the impression was clicked and when.

We do not use third-party analytics or advertising trackers on the website, and we do not sell personal information.

• To run the auction, show ads, and decide which views qualify.
• To credit you, hold credits for 14 days for fraud review, and pay you out.
• To detect and stop fraud, such as automated or unattended viewing.
• To show advertisers aggregate results: impressions, clicks, spend and win rate. Advertisers never see your email, device token or identity.
• To email you sign-in links and messages about your account or payouts.

• Cloudflare hosts the website, database and files, and delivers sign-in emails.
• Stripe processes advertiser payments and viewer payouts.
• Authorities, when the law requires it.

Impression, ledger and payout records are kept as financial records for as long as the law requires. Unclaimed devices and their impressions may be deleted after a period of inactivity. If you delete your account, we remove your email and name and keep only what we must keep for accounting and fraud prevention.

• Pause ads any time with /sidecar pause, or uninstall the plugin. Nothing is sent while it is uninstalled.
• Ask us for a copy of your data, a correction, or deletion by emailing support@sidecar.lol. Depending on where you live, you may have further rights under laws such as the GDPR or CCPA, and you can complain to your local data protection authority.

Sidecar is not for anyone under 18, and we do not knowingly collect data from children.

We will post changes here and update the date above. For material changes we will email account holders before they take effect.

Questions about privacy: support@sidecar.lol.