What we collect, why, and who else sees it.

Effective September 30, 2026. Written to be read, not skimmed past.

The short version

We collect what it takes to run your account and build your apps. Nothing more.
We don't sell your data, and we don't run advertising or tracking scripts on this site.
The AI model that builds your app sees your messages, screenshots and code. It never sees your passwords or the keys you save in Backend.
Delete your account in Settings and your projects, code, published apps and their data go with it.

What we collect

Account: your email address, and a password stored only as a salted one-way hash. If you use Google or GitHub, their account id for you.
What you build: your messages, the screenshots you attach, your project names, and the code, history and settings of each app. Keys and database addresses you save in Backend are stored encrypted so your app can use them. They are never sent to the AI model and never written to our logs.
Billing: what you bought, when, and your credit balance. Card details are handled by Stripe and never reach us.
Usage: how many AI credits and how much preview time each build used, and basic server logs (time, page, error) to keep the service running.
Error reports: when something breaks, on our servers or in your browser, we record a technical error report (the error text and the page it happened on, with email addresses and keys stripped out) on our own servers to fix it. A browser report holds only the error text, where in our code it happened and the page's path: no cookies and no page content. No outside company receives them.
Security activity: sign-ins, failed sign-in attempts, sign-outs, password resets, publishing, and which settings of your apps changed (variable names, never their values), with a scrambled form of the network address it came from. Kept for one year so a break-in can be spotted; you can see your own in Settings. Error reports are deleted 90 days after they last happened.
Your browser: one sign-in cookie that keeps you signed in, plus a few settings stored in your own browser (light or dark mode, an unsent message). No advertising or analytics cookies.

Who else receives it

Only these companies, and only for the job listed:

Anthropic (Claude): the AI model that writes and edits your app: it receives your messages, reference screenshots and your project's code. It never receives passwords or the keys you save in Backend.
Stripe: payments. Card details go straight to Stripe; we never see or store them. We keep a record of what was bought and when.
Google and GitHub: only if you choose "Continue with Google/GitHub": they confirm who you are and share your email address and account id with us.
Resend: sends account emails such as password-reset links (your email address and the message).
Cloudflare: carries traffic between your browser and our servers.

We'll also disclose information if the law requires it, or to protect people from fraud or abuse. We don't sell or rent personal information to anyone.

Apps you build and publish

If your published app collects information from its own visitors, like sign-ups or orders, that information belongs to you. We store and serve it on your behalf. You're responsible for telling your visitors how you use it. Apps that collect personal information need their own privacy policy.

How long we keep it

We keep your data while your account is open. Deleting a project deletes its code, history, previews and published app, including that app's database. Deleting your account deletes all of it, plus your credit history and sign-in details. We keep records of payments, without your account attached, where tax and accounting rules require them.

Your choices and rights

Export any app's full code from the builder, any time.
Delete your account yourself in Settings. Nobody has to approve it.
Ask us for a copy of the personal information we hold about you, or to correct it. Depending on where you live (for example California or the EU/UK), the law gives you these rights, and we honor them for everyone.

Children

This service is for adults (18 or older). It isn't directed to children, and we don't knowingly collect information from anyone under 13. If you believe a child has given us information, contact us and we'll delete it.

Security

Passwords are hashed, never stored in readable form. Each account can only reach its own projects, and a password reset signs out every other session. No system is perfectly secure. If we learn of a breach that affects you, we'll tell you.

Changes

If we change this policy in a way that matters, we'll update the date above and tell signed-in users before the change applies.

Contact

Questions or requests: support@zone51.app.