Privacy
What this site keeps, and where.
Written from the database schema rather than a template, so it describes this site and not a generic one. If something here disagrees with what the app does, the page is the thing that is wrong — please say so.
The short version: there is no analytics, no advertising, no tracking, and nothing is sold or shared for marketing. You can use every model on this site without an account, and if you do, your work never leaves your browser.
Without an account
Your work stays in your browser.
Signed out, the site stores what you do in this browser's local storage and sends none of it anywhere. Clearing site data for this domain removes all of it, and nothing is left behind on the server, because nothing ever reached the server.
Kept in this browser under the key desk-v1.
Kept in this browser under the key workshop-v1.
Kept in this browser. Unit choices last for the session only.
With an account
What an account stores.
Signing in moves the same records onto the account so they follow you between machines. Signing in never merges an account that already holds work with what is on the device — the device copy stays where it is, and signing out shows it again.
Needed to sign you in and to tell your account apart from anyone else's.
Stored as a hash. The password itself is never written down, here or anywhere.
Each sign-in stores an expiry, and the IP address and browser user-agent that created it, so a session can be recognised and expired.
The same records as above, moved off the device so they follow the account.
The document you authored, so a draft opens on another machine.
One row per request, holding your account and the time. It is what enforces the hourly limit on a paid service, and it records that you asked — never what you asked for.
Feedback
What a message carries.
Required, so the message can be answered. Used for that and nothing else: no list, no marketing.
The message, and whether you sent it as a bug or a note.
So a report about a model can be read against that model.
Stored alongside the message, in the same database and the same backup.
So a reply is possible. Feedback can be sent signed out, and then it carries no account.
Cookies
One cookie, and it is the session.
Signing in sets a single cookie holding your session token. It is a __Host- cookie, which means the browser sends it only to this exact origin, only over HTTPS. It is not readable by scripts, it is not used to profile you, and there are no others. Nothing on this site sets an advertising or analytics cookie, so there is no consent banner to dismiss.
Other companies
Who else sees a request.
Vercel hosts the site and runs the database, so it processes every request in the ordinary course of serving pages.
Google Fonts serves the two typefaces. Your browser fetches them directly, which means Google sees the request and your IP address. Nothing else on this site is loaded from another company.
No analytics service, error reporter, advertising network or session recorder is present. Nothing you type into a model is sent anywhere: every calculation runs in your browser.
One exception. Build offers signed-in users a "Draft from a description" option. The description you type there is sent to a model provider — Anthropic or OpenAI, whichever this site is configured with — to produce a first draft, under that provider's own terms. It is the only text on this site that leaves your browser, the dialog says so before you send it, and nothing else you author goes anywhere.
Removing it
How to get rid of any of this.
- Device data: clear site data for this domain in your browser, or delete individual items from Project.
- Account data: delete individual favourites, projects, checks, reviews and drafts from Project and Build. To remove the account itself and everything attached to it, ask through Feedback.
- Feedback: ask through Feedback, quoting roughly when you sent it and what it said.
Contact
Asking about your data.
Requests about access, correction or deletion go through Feedback. It works signed out as well as signed in.
The form asks for an email address, so a reply is always possible. Send it signed in where you can and the address fills itself in — that also identifies the account without you having to prove anything.