PRIVACY.md

# Privacy Policy

**Effective date:** 12 August 2026  
**Publisher:** Lars Andersson

This policy describes the data practices of AWS CDK Project Init (the "Plugin").

## Data received by the publisher

The Plugin has no publisher-operated server, user account system, telemetry, advertising, cookies, or analytics. Lars Andersson does not receive or retain prompts, source code, AWS configuration, GitHub configuration, or generated project files through the Plugin itself.

## Local and third-party processing

When a user invokes the Plugin, Codex may read and write files in the user-authorized workspace. The initializer downloads the public Traceability `v1.0.4` starter from GitHub and installs packages from the npm registry. OpenAI, GitHub, npm, AWS, and any other service the user chooses to use process data under their own terms and privacy policies.

The generated project may later use GitHub Actions and AWS. That optional deployment workflow uses short-lived AWS credentials through GitHub OIDC and does not require users to store long-lived AWS access keys.

## Retention and deletion

Because the Plugin has no publisher-operated backend, Lars Andersson has no Plugin service database containing user data. Generated files remain in the user's workspace until the user changes or deletes them. Data retained by Codex or third-party services is governed by those services and the user's account controls.

## Support and security

Public support requests submitted through GitHub Issues are visible to the public. Never include credentials, tokens, AWS account IDs, secrets, private source code, or unnecessary personal information. Use the repository's private vulnerability reporting feature for security-sensitive reports when it is available.

## Changes and contact

This policy may be updated when the Plugin's behavior or legal requirements change. For non-sensitive questions, use the public support URL:

https://github.com/zipon/init-project-skill/issues