Privacy Policy

Who processes your information

Controller: 【待填写：运营主体名称】. Email: 【待填写：联系邮箱】. Registered address: 【待填写：运营主体注册地址】.

The website and your live records both run on the same server in New Jersey, United States. The provider is Vultr. The database is only reachable from that machine, not from the public internet. Vultr’s legal entity and privacy contact: 【待核实：Vultr 运营主体全称与隐私联系方式】.

The law that applies follows where you are, not where the database is. In China: the Personal Information Protection Law. In the EEA, UK or Switzerland: GDPR and the local rules that sit next to it.

Legal basis (GDPR)

If GDPR applies to you, we rely on these bases — no extras invented:

• Contract (Art. 6(1)(b)): creating your account, keeping you signed in, building and handing over the ZIP you asked for.
• Consent (Art. 6(1)(a)): sending your content to a model provider; for users in China, the separate consent for storage in the United States. You can withdraw consent. That does not unwind processing that was already lawful.
• Legitimate interests (Art. 6(1)(f)): stopping abuse with short-lived request limits, keeping a record of who changed what. You can object. We then check whether we have a stronger ground to keep the processing.
• Legal obligation (Art. 6(1)(c)): only where a written law actually requires it.

What we collect

Only what we actually take and keep today. Features that are not live yet are not described as collection already happening.

• Account: email, whether it is verified, display name, role, status, timestamps.
• Sign-in: we do not keep the password as you typed it. We also keep a session token, expiry, and the IP address and browser string written when you sign in.
• One-time links for email verify, password reset, and email change.
• What you type: project name, original idea, target user, whether you plan to charge, clarified requirements, generated config.
• Generation jobs: who started them, which model, success or failure, error type. The idea text is not stored on those job records.
• Export ZIP files and a check that the file is intact. Default: keep at most 20, expire after 7 days.
• Quotas. We do not yet keep a line-by-line record of each model call’s cost.
• Audit log: who did what. Creating a project records the idea’s length, not the text. Deleting the account wipes idea text from historical audit summaries.

You cannot pay by card on the site, and we do not collect card numbers. Launch steps and operations notes are not being saved yet.

Why, and how

• Email and password: you type them to register, sign in, or edit your profile.
• IP and browser: written on sign-in so the session can be kept and disputed logins checked.
• Ideas and answers: you submit them on the site. No text, no project pack.
• Quota and jobs: so one request cannot burn through the limit.
• Audit: a trail of operator and user actions. Anything that looks like a secret is redacted. The idea text is not copied into the summary.

We do not buy mailing lists. We do not drop ad pixels. The pages have no analytics script and no ad script.

How long we keep it

• Account, projects, requirements, quotas: until you delete the account, or we close it under the terms.
• Sessions: 7 days by default, refreshed if you keep using the site. You can sign out other devices in Settings.
• Verify / reset links: they expire. The mail currently says 10 minutes (verify) and 1 hour (reset). The expiry we store is the one that counts.
• Export ZIPs: 7 days; at most 20 unexpired packs per account. After that the files are deleted.
• Audit rows stay after you delete the account. The actor field is cleared. Idea text in historical summaries is wiped.
• Database backups: once a day, stored on the same server, kept for 14 days. There is no off-site copy. After you delete the account, a backup may still hold your data for up to 14 days, until the rotation deletes it.

Who can see it

• You: project pages and Settings. Settings can download your profile, projects, versions and usage. No password. Nobody else’s data.
• Platform admins: email, role, status, quota, and whether generation jobs failed. Your idea is not put on a public board.
• Other customers: cannot see your email or projects.

Overseas recipients and transfers outside the EU

The website and the live database are on a Vultr server in New Jersey, United States. That is an overseas recipient (境外接收方) for users in China, and a transfer outside the EEA/UK for users in Europe.

If you are in China, writing personal information into that database is a cross-border transfer. It needs your separate consent (单独同意). Sign-up asks for two consents separately (terms and privacy policy; transfer abroad) and keeps a record — not bundled with agreeing to this policy.

Contractual transfer tools (standard contractual clauses or another valid mechanism): 【待确认：与境外接收方的标准合同条款或其他合法传输安排】

How you exercise rights against those recipients: Settings, or email 【待填写：联系邮箱】. They do not run a help desk for your access request; we do.

Your rights

• Access and copy: “Export my data” in Settings, or email us.
• Rectify: change your name in Settings; an email change waits until you click the new inbox link.
• Erase / delete your account (注销账号): Settings, with your password. It takes effect at once. Account, sessions, projects, versions, jobs, export packs and quotas go. Audit rows remain, actor cleared; idea text in historical summaries is wiped.
• Withdraw consent (撤回同意): email 【待填写：联系邮箱】 and say which processing you want stopped (for example: no new writes to the US servers, no more ideas to the model). Features that need that processing will stop. We cannot pull back what a vendor already received. Deleting the account is a full exit.
• Object / restrict (GDPR): email us. We will say whether we still have a ground to continue.

If you withdraw the China separate consent to store data in the United States, the product cannot keep serving you — the website and the live records are in the United States. We will export and/or delete rather than pretend we hold a copy in China. We do not.

Cookie

Cookie use is limited to the sign-in session. The name is better-auth.session_token, with an __Secure- prefix on HTTPS. Flags: HttpOnly, SameSite=lax, Secure when you use HTTPS. Block it and you sign in every time.

No advertising Cookie. No analytics Cookie. The pages do not embed a third-party analytics or ads script. To slow down repeated hitting of the site, the server briefly remembers your IP. A restart clears it. It is not kept in the database.

Children

This service assumes you can register, buy a server, and read the project you get. In China: under 14 needs a guardian; we do not try to collect children’s data, and we delete an account if we learn it belongs to a child. In the EU/UK the digital-consent age is 16, or 13–16 if your member state set a lower floor — we follow that floor, we do not pick a number to look strict.

Changes

Edits show up on this page. A new overseas recipient or a new purpose gets the consent the law requires. Until a lawyer signs off, treat this as a draft.

Complaints

Write to us first: 【待填写：联系邮箱】.

In China you may also complain to the provincial cyberspace administration where you are.

If GDPR applies, you have the right to lodge a complaint with your supervisory authority — the data protection authority of the EU/EEA country where you live, work, or where the issue happened (and the UK ICO if you are in the UK). A list of EEA authorities is on the European Data Protection Board site.