Privacy Policy

Effective · Version 2026-10-15

We keep only what the Service needs to work and to stay secure. No advertising, no third-party analytics, no selling, no profiling.

1. Who we are and what this covers

  1. 1.1

    The operator of IntelliJ.ONLINE is responsible for the personal data processed in the Service, as defined in the Terms of Service: the home site at intellij.online, the workspace at workspace.intellij.online and the API at gateway.intellij.online.

  2. 1.2

    This policy explains what we collect, why, how long we keep it, who can access it and how you control it. Questions and requests go through Contact Support.

2. Our principles

  1. 2.1
    1. 2.1.1

      we collect only what the Service needs to work and to stay secure;

    2. 2.1.2

      we do not sell or rent data, show advertising, use third-party analytics or track you across websites;

    3. 2.1.3

      we do not build marketing profiles and do not use your code, messages or files to train machine-learning models;

    4. 2.1.4

      we delete data when it is no longer needed, on the schedules below.

3. What we never collect

  1. 3.1
    1. 3.1.1

      your password — only a salted one-way Argon2id hash is stored;

    2. 3.1.2

      payment card or bank details;

    3. 3.1.3

      your contacts, precise location, device identifiers or browser fingerprints;

    4. 3.1.4

      advertising or third-party analytics data of any kind;

    5. 3.1.5

      credentials for JetBrains or any other third-party service — we never ask for them.

4. What we collect and how long we keep it

  1. 4.1
    DataWhy it is neededHow long
    Nickname, email address, chosen avatar, password hash, registration dateYour account and sign-inWhile the account exists
    Version and date of the Terms you acceptedProof of the agreementWhile the account exists
    Projects, files, folders, project settings and run configurationsThe Service itselfUntil you delete them or the project, or while the account exists
    Local History: earlier versions of text filesRestoring earlier versionsAt most 80 versions per file and 30 days; cleared with the project or on request in Settings → Storage
    Build workspace, build output and per-account dependency cachesBuilding, running and testing your codeUntil cleared in Settings → Storage, removed with the project or account, or cleaned by us
    Program output of the current runShowing it in your open tabsIn server memory only, at most the latest 200 KB, discarded about 10 minutes after the run ends
    Open documents being editedLive saving and keeping several tabs in syncIn server memory only, discarded after 30 minutes of inactivity
    Sign-in sessions: random token (stored only as a keyed hash), IP address, approximate country, browser and system, created and last-seen timeKeeping you signed in, showing active sessions, preventing account abuseUntil you sign out or the session expires, at most 30 days
    Activity log: sign-ins, failed sign-ins, project, file, run, build, storage and support actions, with IP address, approximate country and browser where relevantAccount security, abuse prevention and investigating problems you reportThe latest 2,000 entries per account; security events such as failed sign-ins and blocked actions are kept while the account exists
    Sandbox log: actions blocked by the isolated environmentProtecting the Service and other usersWhile the account exists
    Presence: whether you are online, the page of the Service you have open, time spent active and last-seen timeShowing live state, operating and protecting the ServiceThe open page only while you are connected; active time and last-seen time while the account exists
    Support tickets: category, subject, related project, messages, attachments and their read stateAnswering you and keeping a record of the conversationWhile the account exists, including after the ticket is closed, unless support deletes the ticket earlier
    Registration cooldown: a keyed hash of your network addressStopping automated mass registrationAbout 40 minutes
    Technical web server logs: IP address, time, address requested, response and browserOperating, debugging and protecting the infrastructureRotated automatically, normally within 14 days
    Encrypted database backupsDisaster recoveryUp to the 7 most recent daily backups
  2. 4.2

    Approximate country is derived on our own servers from the IP address using an offline database; the IP address is not sent anywhere for this. IP geolocation by DB-IP (db-ip.com), licensed under Creative Commons Attribution 4.0.

  3. 4.3

    We do not collect anything not listed here.

5. Data kept in your browser

  1. 5.1

    Some things never leave your device. Interface and editor preferences, panel layout, open tabs, breakpoints, live templates and which release notes you have seen are kept in your browser's local storage. You can remove them by clearing site data in your browser.

  2. 5.2

    Encryption keys for the connection between your browser and the Service are created for each session and kept only in memory.

6. Why we use data and on what basis

  1. 6.1
    1. 6.1.1

      to provide the Service you signed up for — your account, projects, builds, runs and support — because it is necessary to perform our agreement with you;

    2. 6.1.2

      to keep the Service, your account and other users secure, to prevent fraud and abuse, and to enforce the Agreement — based on our legitimate interest in a safe service;

    3. 6.1.3

      to understand how the Service is used through aggregate counts computed on our own servers (for example numbers of users, projects and runs, or shares of browsers and countries) — based on our legitimate interest in running and improving it; no third-party analytics are involved;

    4. 6.1.4

      to meet legal obligations and respond to lawful requests.

  2. 6.2

    We do not make automated decisions that have legal or similarly significant effects on you. Automatic protections may stop a Program or block an action; decisions about blocking or closing an account are taken by a person.

7. Who can see your data

  1. 7.1

    Your projects, files, tickets and attachments are private. There is no public sharing, and other users cannot see them.

  2. 7.2

    Authorised Administrators can access account data, projects, files, history, logs, tickets and attachments only for the purposes listed in the Terms of Service under "Access by our staff". Access is limited to what is needed and is recorded.

  3. 7.3

    We disclose data to authorities only when the law requires it, or when it is necessary to prevent a specific, serious threat to people or to the Service.

  4. 7.4

    If the Service is sold or reorganised, data may move to the new operator, who must keep the commitments of this policy.

8. Service providers

  1. 8.1
    1. 8.1.1

      our hosting provider stores and processes the data on our servers;

    2. 8.1.2

      Cloudflare delivers and protects all addresses of the Service; it processes connection data such as IP addresses and request details to do so, under its own privacy terms;

    3. 8.1.3

      when your builds download dependencies or the Service downloads JDKs and build tools, the requests are made by our servers to the public repositories and vendors involved; they see our servers' address and the names of the packages requested, not your personal details.

  2. 8.2

    Providers process data only to operate the Service and are not allowed to use it for their own marketing.

9. International processing

  1. 9.1

    Our servers and providers may process data outside your country. Where the law requires safeguards for international transfers, we rely on mechanisms the law recognises, such as adequacy decisions or standard contractual clauses offered by our providers.

10. Cookies

  1. 10.1

    We use one cookie of our own, sid, which keeps you signed in. It is HttpOnly, Secure and SameSite=Strict, valid for intellij.online and its subdomains so the home site, the workspace and the API recognise the same session, and it expires after at most 30 days.

  2. 10.2

    Cloudflare may set strictly necessary technical cookies to protect the Service from bots and attacks.

  3. 10.3

    We use no analytics, advertising or tracking cookies, so there is nothing to accept in a cookie banner.

11. Deletion

  1. 11.1

    Deleting a file removes it from your project; its earlier text versions stay in Local History for up to 30 days unless you clear history.

  2. 11.2

    Deleting a project removes it immediately from the live system together with its files, Local History and build workspace.

  3. 11.3

    To close your account, open a ticket in Contact Support. When an account is closed, we delete its projects, files, history, sessions, activity and sandbox logs, tickets and attachments.

  4. 11.4

    Deleted data can remain in encrypted backups until they are rotated out, at most about 7 days, and is not restored into the live system except to recover from a disaster.

  5. 11.5

    We may keep the minimum information needed to enforce a block or closure, or where the law requires us to keep it.

12. Your rights and control

  1. 12.1

    Directly in the Service, without asking anyone, you can:

    1. 12.1.1

      download any file or a whole project as a .zip archive;

    2. 12.1.2

      delete files and projects;

    3. 12.1.3

      see storage use and clear Local History, build output and dependency caches in Settings → Storage;

    4. 12.1.4

      change your avatar in Settings;

    5. 12.1.5

      sign out to end your session.

  2. 12.2

    Depending on where you live, the law may give you further rights, such as access to your data, correction, deletion, restriction, objection, data portability and the right to complain to a data-protection authority. To exercise them, open a ticket in Contact Support. We may need to verify that the request comes from the account owner, and we answer within the time the law requires.

13. Security

  1. 13.1

    Protecting the data we hold is the one responsibility we fully accept. The measures are described in the Security Policy.

  2. 13.2

    If a security incident affects personal data, we act to contain it, assess its impact and restore security, and we notify affected users and authorities where the law requires it.

14. Children

  1. 14.1

    The Service is not intended for anyone under 16. If we learn that an account belongs to a younger person, we close it and delete its data.

15. Changes

  1. 15.1

    We may update this policy. The current version and its effective date are always published on this page, and material changes are announced in the workspace.

  2. 15.2

    We will never change this policy to start selling your data or using it for advertising.