1. Overview
This policy explains what information IDEA ("we", "us") collects when you use this website and the IDEA builder (the "Service"), what we do with it, who else receives it, and the choices you have. It is written from what the Service actually does. We do not sell personal information, show advertising, or send marketing email.
2. Information you give us
Account details. Your name and email address, and a password if you register with one. Passwords are stored only as a salted hash; we cannot read them. If you sign in with Google or GitHub we receive your name, email address, profile picture and the provider's account ID for you. We never receive your Google or GitHub password.
Two-factor authentication. If you turn it on, we store your authenticator secret (encrypted) and your backup codes.
Project content. The briefs, prompts and chat messages you write, the files generated from them, restore points in a project's history, and records of deployments you start.
Credentials you choose to connect. AI provider API keys, database connection details, and authorizations for services such as GitHub, Vercel, Railway or Render. These are optional, are stored encrypted, and are used only to do what you asked: make AI requests with your key, connect a generated app to your database, or push and deploy your project.
Team information. If you use teams: your team, its members and roles, and the email addresses you send invitations to.
3. Information collected automatically
AI usage records. For each AI request made through your account we record the feature used, the AI provider and model, token counts, an estimated cost, and whether it succeeded. We use these to enforce usage limits and control our costs.
IP address. Used to apply rate limits to sign-up, sign-in, password reset and generation requests. The counters expire when their time window ends (an hour at most) and your IP address is not saved to your account. Like any website, the servers and hosting providers that deliver the Service also process IP addresses and request details in their logs.
Error reports. When error monitoring is enabled, a crash sends a report to Sentry containing the error, the page or API route involved, and browser and device details.
Honeypot field. Our forms contain a hidden field used to detect automated submissions. It collects nothing from people using the forms normally.
4. What is stored in your browser
The Service keeps the following in your browser's local storage. None of it is used to track you across other sites.
- Sign-in: your session token and a copy of your basic profile, so you stay signed in.
- Preferences: light or dark theme, the dashboard view you chose, and the width of the builder's chat panel.
- Work in progress: the project you are building, its chat transcript, the template you selected, and the ID of a generation that is still running, so a page reload does not lose your work.
- Guest sessions: a random token that lets you use the builder chat before signing in.
- Your analytics choice: whether you accepted or declined analytics.
Cookies. We set one short-lived cookie while you sign in with GitHub, to protect that sign-in from forgery. Google Analytics sets its own cookies, but only as described in the next section.
5. Analytics
We use Google Analytics 4 to understand which pages are visited and whether sign-ups complete. If you allow it, Google receives page addresses, approximate location derived from your IP address, and browser and device details, and sets cookies to recognise a returning browser.
If you are visiting from the European Union or European Economic Area, the United Kingdom or Switzerland — or if we cannot tell where you are — Google Analytics does not load at all unless you press Accept on the banner. To decide whether to show that banner we look up your country from your IP address; the result is used for that decision only and is not stored. Elsewhere, analytics is on by default and you can turn it off.
You can change your choice at any time: . If no button responds, analytics is not active on this site.
6. How we use information
- To run the Service: sign you in, generate and store your projects, and let you preview, refine, restore, export and deploy them.
- To send account email: address verification, password resets and team invitations. We do not send marketing email.
- To keep the Service secure and affordable: rate limits, usage limits, abuse prevention and debugging.
- To understand usage in aggregate, where analytics is allowed.
- To meet legal obligations and enforce our Terms of Service.
Where data protection law requires a legal basis: we process account and project data to perform our agreement with you, security and usage data on the basis of our legitimate interest in running a safe and reliable service, and analytics on the basis of your consent where consent is required.
7. Who receives information
AI providers. To generate or edit an application, your prompts and the relevant project content are sent to the AI provider handling that request — through our account, or through yours if you connected your own key. Their handling of it is governed by their terms.
Sign-in providers. Google or GitHub, if you choose to sign in with them.
Live preview. The in-browser preview of a generated app runs in a sandbox hosted by CodeSandbox, which receives the generated code in order to run it.
Destinations you choose. If you push or deploy a project to GitHub, Vercel, Railway, Render or a similar service, the project files are sent there under your authorization.
Service providers. Companies that host the website, API and database, deliver our email, and — when enabled — provide error monitoring (Sentry) and analytics (Google). They process data on our behalf.
Payments. The Service is currently free and we collect no payment details. If paid plans are introduced, they will be announced on the pricing page at least 30 days ahead, card payments will be handled by a payment processor, and this policy will be updated first.
Legal. We may disclose information when the law requires it, or to protect the rights and safety of our users or the Service.
8. Retention
We keep your account and project data while your account exists. Password reset links expire after one hour. Rate-limit counters expire with their time window. When you delete a project, remove a connected key or credential, or delete a team, it is removed from our database.
9. Security
Passwords are stored as salted hashes. Connected API keys, database credentials, service authorizations and two-factor secrets are encrypted before they are stored. You can add two-factor authentication to your account in Settings. No system is perfectly secure, and we cannot guarantee absolute security.
10. Your choices and rights
- Update your name and password, and manage two-factor authentication, in Settings.
- Delete projects, remove connected keys and credentials, and leave or delete a team from within the app.
- Accept, decline or withdraw analytics consent using the cookie settings link above.
- To delete your account, or to request a copy or correction of your data, email us at abhayraj27052005@gmail.com. Account deletion is handled on request; there is no self-service button yet.
Depending on where you live, you may have legal rights to access, correct, delete, restrict or object to the processing of your personal data, to receive it in a portable form, and to complain to your local data protection authority.
11. International transfers
Our providers, including AI providers, may process information in countries other than yours. Where the law requires safeguards for such transfers, we rely on those our providers make available.
12. Children
The Service is not directed to children and is not intended for anyone below the age of digital consent where they live. If you believe a child has given us personal information, contact us and we will remove it.
13. Changes to this policy
When what we collect changes, we will update this page and its effective date before the change takes effect.
14. Contact
Questions about this policy or requests about your data: abhayraj27052005@gmail.com.