Privacy Policy

Information you provide:

• Account information (email address, name)
• Everything in your workspace: the projects, canvases, notes, uploaded assets and generated files you create or submit while using the Service ("User Content")
• A record of each AI assistant you connect, including the access token that lets it reach your workspace, so you can see and revoke it
• If you use our free website check: the address you ask us to look at and the email address you want the report sent to
• What you write to us in a support message

Information collected automatically:

• Usage data (pages visited, features used, timestamps)
• Device and browser information
• IP address

Information we receive from Paddle:

• Your subscription status and the identifiers needed to match it to your account. We do not receive your card details.

This is worth stating plainly, because it is the opposite of what most tools in this category do. On our platform plan, the agents run inside the AI assistant you connect, such as your own Claude or Codex. It reads your canvas and writes to it directly.

We do not hold an AI provider account that your content passes through, and our servers do not send your projects, canvases or code to a model provider. What your assistant does with what it reads is governed by your own agreement with whoever provides it, not by us, so that provider's privacy policy is worth reading too.

• To provide, operate, and improve the Service
• To store your workspace and show it to you and to the agents you connect
• To publish your app when you ask us to, and to keep it running
• To manage your account and your subscription
• To send transactional communications (account activity, billing, support responses)
• To send the report you asked for from our free website check, one follow-up about it a few days later, and occasional email about the product. Every one of those has an unsubscribe link and you can opt out at any time.
• To detect and prevent fraud, abuse, or misuse of published apps
• To comply with legal obligations

When you publish an app, it goes to a public web address. Anyone who has that address can open it and search engines may index it. When you create a share link for a project, anyone holding that link can view it without an account.

Both are your choice and you can stop sharing. But treat them as public: do not put credentials, secrets, or other people's personal data into an app you publish or a project you share.

We work with the following service providers who process data on our behalf. We share only the minimum data necessary for each provider to perform their function.

• Supabase: database, authentication and file storage. Your account data and User Content are stored on Supabase infrastructure.
• Vercel: hosting for this site, and the infrastructure your published apps are deployed to.
• Paddle: payment processing, as merchant of record. We do not store your payment card details; all payment data is handled by Paddle.
• Resend: sending email, and the contact list behind our product and follow-up email.

The AI assistant you connect is not on this list, because it is yours rather than ours. We do not sell your personal data to anyone.

Your workspace is private to your account, and the database enforces that. A small number of people on our side can access account records and, where it is necessary, User Content, for three reasons only: answering a support request you have raised, investigating abuse or a security problem, and diagnosing a fault. We do not read projects out of curiosity and we do not use your work to promote the Service without asking you first.

• Your data is retained for as long as your account remains active.
• Accounts that have been inactive for 12 consecutive months may be deleted along with all associated data. We will make reasonable efforts to notify you before deletion.
• You may request deletion of your account and associated data at any time by emailing . Deleting your account removes your workspace, projects and files.
• An app you have published does not come down automatically when your account is deleted, because it lives on separate infrastructure. Tell us in the same message if you want it taken offline and we will remove it.

Depending on your location, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request deletion of your data
• Object to or restrict certain processing activities
• Withdraw consent to marketing email at any time
• Receive a copy of your data in a portable format

To exercise any of these rights, contact us at . You can export a project yourself at any time from the build window, which downloads it as a standard project you can keep.

We implement industry-standard technical and organizational measures to protect your data from unauthorized access, loss, or disclosure. However, no system is completely secure. We cannot guarantee the absolute security of your information.

The Service is not directed to individuals under 18 years of age. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected data from a minor, please contact us and we will delete it promptly.

We use essential cookies to maintain your session and authentication state. We do not use advertising or tracking cookies.

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the updated policy on this page with a revised effective date. Continued use of the Service after changes are posted constitutes your acceptance of the updated policy.

This Privacy Policy is governed by the laws of the United Arab Emirates, including applicable federal data protection regulations. Where the data protection law of your own country gives you rights beyond these, those rights still apply to you.

For privacy-related inquiries, contact us at [email protected].