Privacy Policy

Last updated: 2026-07-13

This Privacy Policy ("Policy") describes how ETZ-HADAAT Machine Learning Services LTD ("EH," "We," "Us," or "Our") collects, uses, stores, and shares information in connection with (i) the Co-Tower desktop application (the "Software") and (ii) the Co-Tower marketing website at etz-hadaat.github.io/Co-Tower (the "Website"). By installing or using the Software, or by visiting the Website, you accept this Policy in full. If you do not accept this Policy, do not install or use the Software, and do not use the Website beyond what is necessary to read this page.

This Policy is incorporated by reference into the Co-Tower End-User License Agreement ("EULA"). Terms defined in the EULA have the same meaning here.

Plain-language summary: Co-Tower has no company backend. Your GitHub data flows directly between your device and GitHub. The Software collects no telemetry or analytics of its own. Using Co-Tower currently also requires accepting the bundled Honeygain SDK, which relays third parties' traffic through your internet connection in exchange for compensation EH — not you — receives; see Section 4. The Website sets no cookies and runs no analytics.

1. INFORMATION WE COLLECT

The Software's own data handling is limited to what is needed to show you your GitHub Copilot activity. EH does not build analytics, telemetry, or crash-reporting into the Software.

GitHub account and org data. The Software calls GitHub, Inc.'s API directly from your device (there is no EH server in between) to retrieve your GitHub identity, organization memberships, repository and Copilot task/session/PR metadata, and, where applicable, org Copilot seat and usage data.
OAuth scopes. Signing in requests the scopes read:user, read:org, and repo. The first two support looking up your identity, org memberships, and Copilot activity. The repo scope is broader than the Software's read-only monitoring features: it grants access to your repositories, including private ones, even though Co-Tower only reads data to display it.
Organization-admin visibility. If the GitHub account you sign in with holds organization admin or billing rights, GitHub's API allows the Software to display other organization members' Copilot seat and activity data — login, last activity time, editor used, and team — because GitHub itself makes that data available to admins and billing managers.
Local device data. Your GitHub token is stored in your OS keyring/Keychain via Flet's secure storage. Task and PR metadata retrieved from GitHub may be cached locally on your device for display and offline reference.
Honeygain SDK data. See Section 4.
Website visitor data. See Section 11, which also sets out this Policy's scope over the Website.

None of the above is collected by or routed through an EH server, because EH does not operate one for the Software. Data described above either stays on your device or flows directly between your device and GitHub.

2. HOW WE USE INFORMATION

EH uses the information described in Section 1 only to:

display your Copilot tasks, sessions, diffs, pull requests, and (where applicable) org Copilot seat/activity data inside the Software;
operate the Honeygain bandwidth-relay feature described in Section 4, once you have consented to it;
resolve the current release version and download links shown on the Website (Section 11);
respond to support requests you send to support@etz-hadaat.xyz;
comply with applicable law and legal process.

EH does not use this information for advertising, behavioral profiling, or resale.

3. SHARING AND DISCLOSURE

EH shares information only as follows:

With GitHub, Inc. — because the Software's monitoring features work by calling GitHub's API directly from your device.
With Honeygain, through the bundled Honeygain SDK described in Section 4, and only once you have consented to it.
With law enforcement or regulators, when EH is required to do so under applicable law, legal process, or a court order.
With a successor entity, if EH's business or assets are acquired, merged, or restructured — the successor remains bound by this Policy.
With EH's own support team, if you email support@etz-hadaat.xyz — your message and any details you include.

EH does not sell information and does not share it with data brokers, advertisers, or analytics vendors, because the Software is not built to collect data for those purposes.

4. THIRD-PARTY SERVICES

The Software interfaces with two third-party services:

GitHub. GitHub, Inc.'s API is used to display your Copilot tasks, repositories, sessions, diffs, pull requests, and — for organization admins — seat and activity data. GitHub's own privacy policy and terms govern its handling of that data; EH does not control or influence GitHub's practices.

Honeygain. Using Co-Tower currently requires accepting the Honeygain SDK bundled with the Software, in addition to the Co-Tower terms (see Terms of Service Section 8A) — there is presently no way to use the Software without it. Honeygain is a closed-source residential-proxy / bandwidth-sharing client: once you consent, it uses your IP address and internet connection to relay other parties' requests — for purposes Honeygain describes as including web analytics, ad verification, brand protection, and price comparison. ETZ-HADAAT holds the Honeygain SDK API keys and is compensated by Honeygain for this; you receive no payment. Honeygain's own Terms of Service and Privacy Policy govern its processing, and per that policy Honeygain shares limited device data with its own sub-processors. EH does not control Honeygain's data practices and is not responsible for them. A version of the Software that does not require Honeygain is under consideration; EH makes no commitment as to whether or when that will ship. If your connection is metered or capped, running the Honeygain SDK may result in data charges from your provider; see EULA Section 8A.

5. DATA RETENTION

On-device data — your GitHub token and any cached task/PR metadata — persists on your device until you remove it, by uninstalling the Software, clearing its local storage, or revoking the GitHub OAuth grant. EH does not hold a separate copy, because there is no backend for the Software. If you email support@etz-hadaat.xyz, EH retains that correspondence only for as long as needed to handle your request.

6. SECURITY

EH applies technical measures it considers reasonable for a locally-run application with no backend, including storing your GitHub token in your OS keyring/Keychain rather than in plain text. No software can be guaranteed free of vulnerabilities, and EH makes no warranty that the Software or your device is immune from all security risks. Use of the Software is at your own risk, consistent with the EULA.

7. CHILDREN

The Software is not directed at children under the age of 16 (or the applicable age of digital consent in your jurisdiction). Separately — and because using Co-Tower currently requires accepting the Honeygain SDK — the Co-Tower EULA requires you to be at least 18 (or the age of majority in your jurisdiction, if higher) to accept it and to enable the Honeygain SDK; Honeygain's own Terms of Service require the same and require parental/guardian consent filed directly with Honeygain for anyone younger. See EULA Section 1A. EH does not knowingly target children or knowingly permit minors to enable the Honeygain SDK.

8. YOUR RIGHTS

EH does not operate a company backend or server for the Software, so EH itself holds almost no personal data. The data described in Section 1 lives primarily on your device or flows directly to GitHub.

To exercise access, correction, deletion, or portability over that data:

Uninstall the Software and delete its local application data to remove on-device data (your token, cached task/PR metadata); and
Revoke Co-Tower's GitHub OAuth grant at github.com/settings/applications to end GitHub-side access.

Where EH does hold data — for example, support-email correspondence under Section 5 — you may contact support@etz-hadaat.xyz with a privacy request. EH will respond within a reasonable time. EH will honor applicable statutory rights, including under the EU General Data Protection Regulation, the UK GDPR and the UK Privacy and Electronic Communications Regulations 2003 (PECR), the California Consumer Privacy Act, the Personal Information Protection and Electronic Documents Act (PIPEDA) if you are located in Canada, and Israel's Protection of Privacy Law, to the extent they apply to you.

9. SALE AND MONETIZATION OF DATA

EH does not sell personal information. EH's sole means of monetizing the Software is the Honeygain bandwidth-sharing arrangement described in Section 4 and in EULA Section 8A: with your consent, the Honeygain SDK relays third parties' traffic through your internet connection, and Honeygain compensates EH — not you — for this. EH does not license, rent, or otherwise transfer your personal information to third parties in exchange for payment.

If you are a resident of a jurisdiction that provides a right to opt out of the sale of personal information (such as California): EH does not sell personal information, so there is no sale to opt out of. You can stop the Honeygain relay using the tray's consent controls — note that, until the unbundling described in Section 4 ships, doing so also closes the Software, because acceptance of Honeygain is currently required to run it.

10. AUTOMATED PROCESSING

The Software does not make automated decisions about you and does not build behavioral profiles. Org Copilot seat/activity data described in Section 1, when shown, is retrieved and displayed as provided by GitHub's API, without additional automated analysis by EH.

11. COOKIES, TRACKING, AND THE WEBSITE

The Website (etz-hadaat.github.io/Co-Tower) sets no cookies and runs no analytics or tracking scripts. Its fonts are self-hosted — the Website does not make requests to Google Fonts or any other third-party font provider. The Website's home page calls GitHub's public REST API, client-side, to look up the latest Co-Tower release for its download buttons; making that call discloses your IP address to GitHub as the requesting party. The Website itself is hosted on GitHub Pages, which — as the host — logs visitor requests, including IP addresses, under GitHub's own privacy policy; EH does not control those logs.

The Software does not use cookies. It may store a small amount of local state on your device (for example, cached task data or your selected theme); this state is not transmitted to EH.

12. CHANGES TO THIS POLICY

EH may update this Policy to reflect changes to the Software, the Website, or applicable law. If a change is material, the Software will prompt you to re-consent before you can continue using it — the same version-digest mechanism used for the EULA. The "Last updated" date above reflects the most recent revision. It remains your responsibility to review this Policy periodically.

13. GOVERNING LAW

This Policy is governed by and construed in accordance with the laws of the State of Israel, without regard to conflict-of-law principles. Any dispute arising out of or in connection with this Policy shall be subject to the exclusive jurisdiction of the competent courts of Tel Aviv, Israel. Nothing in this Section limits any non-waivable statutory rights you may have as a consumer under the mandatory law of your country of habitual residence, to the extent such law applies notwithstanding this choice of law and forum.

14. DISCLAIMER

This Policy does not create contractual or legal rights beyond those required by applicable law. Nothing in this Policy constitutes a warranty, representation, or guarantee by EH regarding the collection, handling, or protection of any information. EH's liability in connection with this Policy is subject to the limitations set out in the EULA.

15. CONTACT

ETZ-HADAAT Machine Learning Services LTD
Email: support@etz-hadaat.xyz