Privacy Policy.
Last updated: August 12, 2026
This is the binding version. For the same ground in plainer language, see the FAQ.
What we store
- Your email address and username.
- A bcrypt hash of your password (never the password itself), if you set one.
- Nothing about your API keys — they are stored encrypted in your browser, never in our database.
- The apps you save: their code, the name you give them, an optional description you write, and their publish settings.
- Abuse reports submitted through the report form.
- Daily usage totals — for each day and model, how many builds and how many tokens. Not a list of individual builds, and no cost, no prompt, and no app content.
- An activity log of account and moderation events — that a publish or a report happened, and which admin action was taken. It records that something happened, never what you were building: no app names, no routes, no IP addresses.
What we don’t do
- No analytics trackers, no advertising, no fingerprinting.
- No selling or sharing of your data with anyone.
- No reading of your prompts or apps except as needed to operate the service or investigate an abuse report.
Cookies
Only what signing in needs. Three of them: one that keeps you signed in, one holding a CSRF token so another site can’t submit forms as you, and one remembering which page to return you to afterwards. The second two are set as soon as you open the sign-in page, whether or not you go through with it. Choosing “Continue with Google” adds up to three more, short-lived, whose only job is to tie the redirect coming back from Google to the request that started it.
All of them are set by the sign-in library, are marked HttpOnly so this site’s own JavaScript cannot read them, and go nowhere but our server. None of them track you. There is no analytics cookie, no advertising cookie, and nothing shared with a third party — which is why you were never shown a cookie banner. Consent is what tracking requires, and there is none here to consent to.
Three other things live in your browser’s own storage rather than in a cookie: your light/dark choice, whatever build you have in progress, and your encrypted API keys. Unlike a cookie, none of it is attached to requests automatically — a key is sent only when you press build, and only onward to its own provider.
We send exactly one kind of email: a password-reset link, only when you request one, delivered via SMTP2Go. No newsletters, no notifications, no marketing.
How your API keys are handled
Your API keys are stored encrypted in your browser — never in our database. Each request carries your key to the server only long enough to call your provider; it is never written to disk or logs, and it is sent only to its own provider (your OpenAI key only to OpenAI, and so on). You’ll need to re-enter keys on other devices, and clearing this site’s data deletes them.
Prompts and generations
When you generate an app, your prompt (and prior turns of that build) go to the model provider you chose, under their privacy terms. If you never save the result, nothing about the prompt is written down here — not the text, not a summary, and not which filter category it matched.
Your prompts are never stored. No table has a column for one. Saving an app stores the app: its code, the name you give it, and an optional description you write. That description is never prefilled from your prompt — it starts empty, and both fields are editable from My apps.
A description is optional unless you list the app in Explore, where it becomes a public catalog entry shown beside the name — so listing requires one. Names and descriptions are screened for slurs and profanity, because both are publicly visible once an app is listed.
Usage and activity metrics
Usage is kept as daily totals: for each day and each model, how many builds you ran and how many tokens went in and out. That is all — there is no row per build, so no record of the order or timing of individual builds, and nothing about what any of them were. You can see your own figures under Usage.
Cost is not stored at all. What a build cost is shown once, live, as it finishes, and then discarded. Only some providers publish prices, so a stored figure would be missing or estimated for many builds — and since you bring your own key, the real record already exists somewhere better. Your provider’s own API logs and billing page show every request with its exact charge; that is the authoritative account of what you spent.
The activity log is deliberately thin. It stores the kind of event and an internal id — “this account published app 12”, “the content filter declined a request” — and nothing that describes what you asked for or built. We don’t keep app names or routes in it, we don’t keep which category the content filter matched, and we don’t keep IP addresses anywhere. Nothing is copied to a separate log service, so the database is the only place any of this exists.
This used to be one row per build. It was changed to daily totals deliberately: a per-build log was a record of when and how often you worked, which is more than metering needs. Deleting your account removes your totals either way.
How long we keep it. Activity entries are deleted after 90 days and usage totals after 400 days, automatically — not on request. The 400 days exists so your month-by-month usage stays complete for a full year.
Published apps
An app published as “anyone with the link” is a public web page. We mark published apps noindex, and they appear in the public Explore catalog only if you opt in — otherwise anyone with the URL can view one, but nothing points to it.
Google sign-in
If you sign in with Google we receive your email address and its verified status — nothing else, and we never post or act as you.
Retention and deletion
Settings → Delete account removes your account, API keys, apps, and usage rows immediately; published URLs stop resolving at that moment. Activity-log entries are de-identified (detached from your account) rather than kept under your name. Routine database backups age out on their own schedule.
Contact
Privacy questions: the report form.