Axiom Lift keeps the context of your AI coding sessions so it can be brought back later. This page says what is collected, why, who else receives it, how long it is kept, and what you can do about it.
Who we are
Axiom Lift is run by Generation Adept Ltd, trading as Axiom Lift, registered in England and Wales (company number 15865635), registered office 5 Morse Road, Winchester SO22 6GQ. We are the controller of the personal data described here. Questions, requests and complaints: [email protected].
Two ways your history is kept: Local and Hosted
Local (Axiom Lift on your computer): your words live on your machine. Axiom may process them transiently to build intelligence, but it does not store them. The server retains the structure, relationships and derived intelligence, not your raw conversations.
On your computer: your sessions, the statements found in them and their wording, and a search over them, in one file only you can read (~/.axiom-context/journal.db).
On Axiom Lift: random ids (made on your computer, carrying no meaning), the links between them (what replaced what, what is still open), ratings and learned weights, and usage numbers for billing. No words and no names: a project or a person is a random id there; its name stays on your computer.
Read briefly, never kept: to find what a session settled, or which of your statements matter to a prompt, the text needed for that one request is sent over HTTPS and processed in memory. Nothing of it is written to a database or a log. Our model providers (OpenAI and TypeSafe, below) keep nothing beyond their 30-day abuse checks.
Encrypted backup: your journal can be backed up to Axiom Lift's storage, encrypted on your computer with a key from your own recovery phrase. Axiom stores bytes it cannot read; lose the phrase and the backup cannot be opened by anyone.
Leaving: your words are already on your computer. Ask us and the structure tied to your account is deleted too.
Hosted (how Axiom worked before Local, and still does for accounts that have not moved): your session history is uploaded to your account on Axiom Lift's server, as described below. Moving to Local brings your words home and removes the server's copy after an encrypted backup and your confirmation (set aside for 7 days, then gone).
What Axiom collects
Your AI session history. The Axiom program you install reads the session files that Claude Code, Codex and OpenCode already write on that computer and uploads them to your account, keys and passwords cut on your computer first. It does this only after you install it and connect the computer, and you can leave any project folder out (axiom exclude <folder>). Session history can hold personal data about you and about anyone who appears in your work.
What Axiom works out from it. Decisions, requirements, fixes and other statements, the Git branch and commit a session was on, the files and commands a turn touched, the model used, token counts and timings.
Your account. An @handle, a display name, an email address, a password (stored only as a salted hash) or your GitHub sign-in, your plan, and when you signed up. The address, country and browser you signed up from are kept with it; the address goes after 30 days.
Your computers. A name, operating system, time zone, language, Axiom version, last upload time, and the address and town it last connected from, for each computer you connect, so you can see and remove them.
GitHub, if you connect it. Your GitHub profile, the repositories you choose, and activity on them (commits, pull requests, checks). To suggest people to invite, Axiom also reads the public profiles of people you work with on GitHub.
Payments. Stripe handles card details; Axiom never sees them. We keep your Stripe customer id, plan, what you bought and when.
Sign-in records. When and from where each sign-in happened, successful or not, to protect your account. Kept for 400 days.
Visits to the website, and cookies
Axiom uses no third-party analytics. Its one advertising tool is X's (Twitter's) conversion pixel, which loads only if you press Accept: it tells X that someone who saw or clicked our ad on X visited the site, so we can see which ads work, and X may set its own cookies to do that (see X's privacy policy). Axiom keeps its own record of visits: the pages and app views opened and the buttons pressed, the country Cloudflare reports (and the town, only if you press Accept), the site that sent you (the full link only if you press Accept), the browser and device type, and your account name if you are signed in. The address you connect from is part of that record for 30 days and is then removed; the rest goes after 90 days.
The questions on the front page. If you answer them (which AI you use, where, how much, and what goes wrong), your answers and what you press are kept under a random id for that visit, with the country and the ad or link that brought you, so we can show you Axiom on your own setup and learn who it helps. No IP address or cookie is needed for this. The id goes into the install command it gives you and the email you ask for, so we can see whether the visit led to an install or an account; nothing else links it to you. It is deleted after 13 months.
Cookies:
axiom_session: keeps you signed in, for 14 days. Needed for the service.
axiom_consent: remembers your answer to the cookie notice, for six months. Needed for the notice.
A few short-lived ones that only work during sign-in, GitHub connection, an invitation, or for one day after you press sign-up on the front page (so the account is matched to the visit you started). Needed for those steps.
axiom_vid: only if you press Accept. A random visitor id that lasts a year and lets us see that visits on different days, and the account made later, were the same person, and which page or campaign brought you. The record it keeps (first page, referrer, campaign tags, timezone, language, screen size, number of visits) is deleted 13 months after your first visit. If you decline, or your browser sends Global Privacy Control, no visitor id is set and visits are counted for the day only.
axiom_ads, and X's own cookies: only if you press Accept. Remembers that you agreed to X's ad measurement, for six months, and loads X's conversion pixel. Decline, or Change your cookie choice below, and it is not loaded.
Account emails: confirming your address, password resets, receipts and plan changes, invitations you accept, and a notice whenever our operator changes something on your account.
"Email me the guide": if you leave an address on a phone or tablet, we send that one email. Only if you open the link in it do up to three reminders follow (after 1, 3 and 7 days), and they stop when you sign up or press stop. An address that says stop is never emailed again. The request, and the country, town and device it came from, is deleted after 13 months; the address it came from after 30 days.
Invitations from other users: if someone on Axiom invites you, we email you once on their behalf, with no reminders, and an address is only ever emailed one invitation, whoever sends it. The email has a link to stop all future invitations to that address.
A note about something you wrote on GitHub: Simon, who builds Axiom Lift, may email a developer once (and at most one follow-up) about a public GitHub issue or comment they wrote on a problem Axiom Lift deals with, using only an address they published themselves (their GitHub profile or own website). The link in that email is yours alone: opening it records when, the country and town, and the browser, before it opens the Axiom Lift page on GitHub, so we can see whether the note was useful and follow up only where it was. If the installer is downloaded from the same internet address within six hours of opening the link, we treat it as yours. What we keep is your GitHub name, the address, the issue it was about and that record; the address the click came from is deleted after 30 days. Reply "no thanks" and you are never contacted again.
Messages you send us through the contact form are kept for 13 months.
What is done with it, and on what basis
To provide the service you signed up for (contract): storing and searching your history, handing context to your AI tools, running the jobs you start, billing.
To keep it secure and working (legitimate interests): sign-in records, rate limits, abuse checks, basic visit counts, error logs.
To tell developers who wrote about a problem Axiom Lift deals with (legitimate interests): the one email about their GitHub issue, and whether its link was opened and used.
With your consent: the visitor-id cookie, and reminder emails after "Email me the guide". You can withdraw either at any time.
Because the law requires it: keeping payment and tax records.
Every statement is scanned for secrets (keys, tokens, passwords) and personal details. Flagged statements are left out of what Axiom's AI tools return, and keys and passwords are cut from session text on the way in and on the way out.
When you or your AI ask Axiom for context, a receipt records what was handed over, so you can see what an AI was given.
Patterns of life (part of the service; you can switch it off): Axiom notes the local time of your sessions and groups your prompts by meaning, so it can show you what you tend to work on and when, and answer your AI's questions about it. It is worked out on Axiom's server without any AI model, shown only to you, and never shared, reported or used in advertising. Prompts flagged as personal keep only their time. Switching it off in the app deletes all of it.
Your data is not sold, not used for advertising, and not used to train any model.
Who else receives it
OpenAI (USA), and Anthropic (USA) if our operator switches to it: only when you start a paid job that needs a model (a deep clean, reading your past history, linking sessions, a reconstruction), or when you take one of our free tests (the Claude Stress Test, the Context Loss Test) and say yes to the full result. The session text that job needs is sent to their API, with keys and passwords cut. Requests are made with storage turned off and batch files are deleted as soon as the results are back; the provider does not train on API data and may keep it for up to 30 days to check for abuse, then deletes it.
TypeSafe (USA, its Jev model): short one-sentence statements Axiom has already worked out from your sessions, in pairs, to judge whether a newer one replaces an older one. Never sessions, prompts or files, and nothing flagged as a secret or personal detail. TypeSafe does not train on what it is sent.
Stripe (payments), Resend (sending email), Cloudflare (carries every connection and sees your IP address), GitHub (only if you connect it), X (ad measurement, only if you accept cookies).
Other Axiom users, only when you choose: a public profile, a published context repository or solution, or something you share with a person.
Our operator. The person who runs Axiom can see account details, sign-in and visit records, usage, and, where needed to support you or fix a problem, the content of an account. Operator changes to an account (email, plan, a password reset) are logged and you are emailed about each one. The operator cannot set your password.
OpenAI, Anthropic, TypeSafe, Stripe, Resend, Cloudflare, GitHub and X are in the USA. Transfers to them rely on the UK Extension to the EU-US Data Privacy Framework where the company is certified, and otherwise on the ICO's International Data Transfer Addendum to their standard contractual clauses.
Where it is kept and for how long
axiomlift.ai runs on our own server in the United Kingdom, on an encrypted disk.
Your account and its context are kept until you delete them. Deleting your account removes everything held for it on the server, including requests and invitations tied to your email.
Nightly backups are kept on the same server for 14 days, and one a week for 8 weeks, so deleted data can remain in a backup for up to 8 weeks before it is gone.
Visit records: 90 days (addresses in them, 30 days). Visitor-id records: 13 months. Sign-in records: 400 days. "Email me the guide" requests and contact messages: 13 months. Payment records are kept by Stripe as the law requires.
How it is protected
Connections use HTTPS. Passwords are stored as salted PBKDF2 hashes, and every access token is stored only as a hash.
Sign-in and sign-up attempts are rate limited. Sessions are httpOnly cookies that only work from this site.
Each connected computer has its own token that can upload and read, but cannot pay, change your account, publish, share or remove text; you can remove a computer at any time.
Your rights
You can see and correct your details in the app, and delete your account yourself. Under Account you can ask for a copy of your data: we build it in the background and email you a link when it is ready. It holds your account details, your session conversations as captured (keys cut), the statements and State Axiom worked out, and your billing records. For anything else we hold about you, including visit records, email [email protected]. Under UK GDPR and GDPR you also have the rights to restrict or object to processing, to withdraw consent, and to complain to the ICO or your local data protection authority. The service is not for anyone under 16.
Changes
Changes to this page will be posted here with a new date at the top, and we will email account holders about any significant change.