Protected account access
Passwords are salted and hashed using scrypt. Sessions use HTTP-only cookies, and the production site uses HTTPS. Changing your password invalidates other active sessions.
YOUR CREATIVE SPACE, WITH CARE
Trust is part
of the foundation.
Practical protections, clear boundaries,
and a little less uncertainty about your data.
Isolated website previews
Generated code runs in a sandboxed frame. It cannot access your workspace cookies or make external network requests. We do not execute generated server commands on the application host.
Credentials stay on the server
AI and payment provider keys are configured on the server and are never included in exported projects or client-side application code.
Verified payments, bounded usage
Credits are issued only after verified payment notifications. Build reservations are checked atomically, and the same payment or invoice cannot credit an account twice.
Your work stays portable
Download individual project source files as a ZIP, export your account data, and delete projects or your account from Settings.
Clear AI boundaries
Live AI sends the current project and relevant conversation to the selected provider through OpenRouter. Local template demo does not send that content to AI providers.
Found something that needs our attention?
Report a suspected vulnerability privately. Include the affected feature, steps to reproduce, and the possible impact. Please avoid accessing anyone else’s data.
These are descriptions of current safeguards, not a certification or a promise that incidents are impossible. Review the Privacy Policy for data handling and retention.