Privacy policy

[Company name], [registered address], is responsible for the personal data of people who make sites. For visitors' messages sent through a site's contact form, the site's owner decides what happens to them; we process them for the owner. Contact: [privacy email].

We store your email address, your name if you add one, your plan, and the sites, versions and photos you make.

Matches the code: supabase/migrations (profiles, sites, site_versions, site_assets)

We keep your conversations with the editing assistant for 90 days, then delete them.

Matches the code: pg_cron job purge-old-agent-messages

For each assistant request we keep a usage record: when it happened, the model used and the number of tokens. It doesn't contain what you wrote.

Matches the code: ai_usage table

When you upload a photo we remove its hidden details, such as camera location and device, before saving it.

Matches the code: lib/media/process.ts (metadata stripped)

Once per photo or video, a resized copy of the picture (960 pixels wide) is sent to Anthropic to describe it: a description for people who use screen readers, a caption idea, tags, the main colours, where the subject is and whether it looks blurry. For videos, only the poster picture and the video's title are sent, never the video or its sound. We ask the model never to identify or name people; names from video titles are removed from what it writes.

Matches the code: lib/media/analysis.ts, lib/media/analyze.ts, mediaAnalysisModel in lib/ai/config.ts

We keep what it found with the photo until you delete the photo. You can change or clear any of it; what you write is never replaced by a new analysis. Each analysis is logged for cost (time, model, token counts), never with its content.

Matches the code: assets.analysis, ai_usage purpose media_analysis

This only runs on Anthropic's paid service. Free plans get 30 analyses a month, Pro 300; past that your photos are still added, just not described.

Matches the code: lib/plans.ts (mediaAnalysesPerMonth)

Photos are stored at long, unguessable web addresses. They aren't listed anywhere, but anyone who has the address can open the photo, even if it isn't on a live site.

Matches the code: lib/media/photos.ts (128-bit random path), public bucket site-assets

When you delete a photo it is hidden at once. The files are removed once no saved version of your site has used it for 7 days. Copies may stay in browser and network caches for a while after that.

Matches the code: app/api/cron/photos, claim_unused_asset (lib/db/assets.ts)

When you add a YouTube or Vimeo link, we keep only the video's id. Our server asks YouTube or Vimeo for the video's public title and picture, and keeps a copy of the picture to show before anyone plays it. Once a day it checks the video is still public, and refreshes the title and picture at least every 25 days.

Matches the code: lib/media/videos.ts, lib/media/video-lookup.ts, /api/cron/videos

Visitors' browsers contact nobody about a video until they tap play. A note under each video says where it plays from and that it may set cookies; tapping play loads YouTube's privacy-enhanced player or Vimeo's player with tracking turned off.

Matches the code: templates/shared/video-player.tsx, lib/media/video-link.ts (embedUrl)

We don't record visitor analytics ourselves.

Matches the code: analytics_events exists but nothing writes to it

To stop abuse, we use your IP address to limit how often you can send forms. We only store a keyed scramble (hash) of it, never the address, and delete it within a day.

Matches the code: lib/rate-limit.ts, purge-old-rate-limits

A site's owner may add Google Analytics. It only loads after you choose Accept on that site's notice. Your choice is saved in your browser, not on our servers.

Matches the code: templates/shared/consent.tsx, integrations/ga4.ts

When you send a message through a site's contact form, we save your name, email address and message and email them to the site's owner. The owner can read them in their dashboard.

Matches the code: lib/forms/contact.ts, form_submissions

We delete saved messages after 90 days. Copies the owner received by email are theirs.

Matches the code: pg_cron job purge-old-form-submissions

Connecting, changing or turning off an app (like Google Analytics) is recorded with which app, what happened, who did it and when. The record holds no settings, IDs or messages, and is kept for security.

Matches the code: site_app_events (append-only), lib/apps/service.ts

Google Analytics runs under the site owner's own Google account; the owner is responsible for it.

If you report a site, we store what you wrote and, only if you give it, your email address. Our team's review screen doesn't show your email address.

Matches the code: abuse_reports, lib/db/admin.ts

Supabase: database, sign-in and photo storage. Region: [region].

Vercel: hosting for the app and every published site, and custom domains.

Our AI provider for chat, [Anthropic or Google]: reads your assistant requests to make the changes you ask for. Media descriptions always use Anthropic's paid service.

Matches the code: lib/ai/providers (AI_PROVIDER)

Resend: sends sign-in emails and contact form messages.

YouTube (Google) and Vimeo: only when a visitor taps play on a video, and for our daily check that a linked video is still public.

Matches the code: lib/media/fixed-fetch.ts (the only hosts our server contacts for media)

Google: only if you choose to sign in with Google.

Sentry (EU data region): error reports. We remove names, email addresses, phone numbers, IP addresses, messages and secrets before anything is sent; only error codes and record ids are kept. Visitors' browsers never contact Sentry.

Matches the code: lib/observability/scrub.ts, sentry.server.config.ts

Cloudflare R2: encrypted nightly backups.

Matches the code: .github/workflows/backup.yml

We make an encrypted backup of the database and photos every night and keep each one for 30 days. So data you delete can stay in a backup for up to 30 days before it is gone everywhere.

Matches the code: scripts/backup/backup.sh, R2 lifecycle rule (docs/deploy.md)

Deleted sites are removed for good after 30 days, with their photos and versions.

Matches the code: lib/versions/purge-sites.ts

[To close your account and delete everything, email [privacy email]. Your rights under the DPDP Act 2023 / GDPR, and how to complain to a regulator: to be written by a lawyer.]