Privacy Policy

1. What We Collect

• Account data: username, email address, and a password. Passwords are never stored in plain text — they are hashed with bcrypt before being saved.
• Profile data: optional bio and avatar you choose to add.
• Content: prompts you write, sketch code, thumbnails, comments, tags, likes, follows, and remix relationships.
• Usage data: view counts on sketches and basic request information used for rate limiting (such as IP-derived request keys).

2. How We Use Your Data

We use your data to operate the Service: authenticating you (via a signed cookie), displaying your public sketches and profile, sending password-reset emails when you request them, delivering notifications (likes, comments, follows, remixes), and protecting the Service with rate limiting. We do not sell your personal data or use it for advertising.

3. AI Processing

When you generate, fix, remix, or mash up a sketch, your prompt and the relevant sketch code are sent to Anthropic's Claude API to produce the result. This data is processed under Anthropic's privacy policy. Do not include personal or sensitive information in prompts.

4. Public Content

Sketches you mark as public are visible to anyone, including their title, prompt, code, thumbnail, and your username. Public sketches can be embedded on external websites and remixed by other users. Private sketches are visible only to you. Comments and likes on public sketches are public.

5. Cookies and Local Storage

We use an HTTP-only authentication cookie to keep you signed in (expires after 7 days) and browser localStorage for preferences such as your theme choice and unsaved sketch drafts. We do not use third-party tracking or advertising cookies.

We use Vercel Web Analytics to count page views and understand which pages are used. It is cookieless and does not build a profile of you or follow you across other sites.

6. Service Providers

The Service may rely on infrastructure providers to operate: hosting (e.g. Vercel), a managed PostgreSQL database, blob storage for sketch thumbnails, a transactional email provider for password resets, and a Redis provider for rate limiting. These providers process data only as needed to run the Service.

7. Data Retention and Deletion

Your data is retained while your account exists. You can delete your account at any time from the settings page, which removes your account and associated personal data. Password-reset tokens expire after one hour.

8. Security

Passwords are hashed with bcrypt, authentication uses signed HTTP-only cookies, sketch code runs in a sandboxed iframe, and sensitive endpoints are rate limited. No system is perfectly secure, so please use a unique password for your account.

9. Changes and Contact

We may update this policy from time to time; material changes will be reflected on this page. Questions? Contact the site operator through the project's repository or the contact information listed on the site. See also our Terms of Service.