What we hold, and why

Your email address, and your name if you give it. That's the account. There's no password to lose — you sign in with a provider you already use, or with a passkey on your own device. From a provider we keep the email and the account id it hands back, nothing else from your profile there. A passkey leaves its public key with us; the private half never leaves your device, and we couldn't read it if we wanted to.

A cookie holds a device session for 90 days, so you don't sign in on every visit. It's tied to that browser; signing out ends it. We record roughly when and from where each ceremony happened — enough to rate-limit sign-in attempts by IP address and spot someone hammering the door.

Everything about the order: what you typed while refining it, the work order itself, the quote, every message between you and the counter, any file you attach, and the build the factory produces. This is the product — we hold it so we can build it, deliver it, and quote a change round against it later.

The zip stays available on your order for 90 days after delivery, then it's deleted from storage. If your order ships to a git repository, you connect that repository yourself and can disconnect it at any time from GitHub — the access it grants is per-push and short-lived, and we never store a token for your account. We also keep our own copy of the build's history so a later change round can start from exactly what you received.

Card details never touch our servers. Checkout runs on Stripe, and what comes back to us is whether the payment succeeded and a reference for it. Their handling of the card is covered by their own policy.

The operator who takes your order — a named person, whose profile you can read before you accept a quote. The AI models that plan, write and review the build see your order's contents while they run. Beyond that: our email sender, our payment processor, and our hosting. Nobody buys this data from us, because we don't sell it, and nothing you send us is used to train a model.

Account and order records stay while your account is open — your order book is a record you can come back to. Delivered zips go at 90 days. Ask us to close your account and delete your data and we will, keeping only what we're required to keep for tax and accounting on orders you actually paid for.

Want a copy of what we hold, a correction, or deletion? Ask, from the email address on the account, and we'll do it. If something here doesn't match what you've seen, tell us — that's a bug in this page or in the product, and both are ours to fix.