1sh.app

Privacy Policy.

Last updated: August 9, 2026

What we store

  • Your email address and username.
  • A bcrypt hash of your password (never the password itself), if you set one.
  • Your provider API keys, encrypted at rest with AES-256-GCM. They are decryptable by the server — that’s what lets it make requests on your behalf — so treat saving a key here like saving it with any third-party tool.
  • The apps you save and their publish settings.
  • Abuse reports submitted through the report form.

What we don’t do

  • No analytics trackers, no advertising, no fingerprinting.
  • No selling or sharing of your data with anyone.
  • No reading of your prompts or apps except as needed to operate the service or investigate an abuse report.

Cookies

One session cookie, used to keep you signed in. That’s all.

Email

We send exactly one kind of email: a password-reset link, only when you request one, delivered via SMTP2Go. No newsletters, no notifications, no marketing.

How your API keys are used

A key you save is sent only to its own provider (your OpenAI key only to OpenAI, and so on), and only when you request a generation or test the key. Remove any key at any time in Settings — removal deletes it immediately.

Prompts and generations

When you generate an app, your prompt (and prior turns of that build) go to the model provider you chose, under their privacy terms. We store the result only if you save or publish it.

Published apps

An app published as “anyone with the link” is a public web page. We mark published apps noindex, and they appear in the public Explore catalog only if you opt in — otherwise anyone with the URL can view one, but nothing points to it.

Google sign-in

If you sign in with Google we receive your email address and its verified status — nothing else, and we never post or act as you.

Retention and deletion

Settings → Delete account removes your account, API keys, and all your apps immediately; published URLs stop resolving at that moment. Routine database backups age out on their own schedule.

Contact

Privacy questions: the report form.