Privacy policy

This page says what Anticode collects, why, who else handles it and how to have it removed. We collect as little as the service needs, and we don’t sell personal data or use it for advertising.

What we collect

• Your account: email address, and optionally a username, name and profile picture (from GitHub or Google if you sign in with them). Passwords are stored only as a salted PBKDF2 hash.
• Your work: projects, their version history, uploaded files, published sites, CMS content and connector settings. Connector URLs and keys are encrypted at rest.
• Usage: for each model build, the token counts and cost, so we can apply your limits and show receipts.
• Billing: your Stripe customer and subscription ids. Card details go to Stripe and never reach us.
• Messages you send us through the contact form.

We don’t store IP addresses or browser fingerprints. To slow down abuse, short-lived rate-limit counters use a one-way hash of your address.

Cookies

One cookie, set when you sign in, keeps you signed in for up to 30 days of inactivity. It’s HttpOnly, Secure and SameSite. There are no advertising cookies. If you arrive through an Anticode Partners link, a second cookie holds a random id for that visit for up to 30 days, so the partner who sent you can be credited if you sign up or buy; it holds nothing else, and we record that visit as a daily one-way hash, never your IP address. The builder also keeps your projects in your browser’s local storage.

Published sites and their visitors

For sites you publish, we count visits per day by where they came from (search, AI assistants, social, other sites or direct), with no cookies and nothing about the visitor kept. When a visitor sends a form on your site, we store what they typed, encrypted where they’re stored, so you can read it, email it to you if notifications are on, and send it to any connectors you’ve set up. For that data, you decide what is collected and why; we process it on your behalf.

Where your data is stored

This is Anticode EU. Your account, projects, files, published sites and your sites’ form submissions are stored only in the European Union, in Cloudflare’s EU jurisdiction. When the AI writes copy for you, your request is sent to Anthropic, which processes it in the United States.

Who else handles data

• Cloudflare hosts the service, its database and file storage.
• Anthropic receives your build requests and page plans, to write the copy for model builds.
• Resend sends sign-in, verification and notification emails.
• Stripe handles subscriptions and payments.
• GitHub and Google, only if you choose to sign in with them.
• Google Fonts and Unsplash serve fonts and stock photos to browsers that load our pages or your sites.

How long we keep it

You choose how long your sites’ form submissions are kept: until you delete them, or for 30 days up to 2 years, after which they’re deleted automatically. Every time submissions are viewed, exported or deleted, it’s recorded in the project’s access log, which you can see in the Console.

Account data stays until you delete your account. Deleting it removes your projects, files, submissions and published sites straight away. Sign-in sessions expire after 30 days without use; emailed sign-in links after 15 minutes. Free accounts keep the latest 50 versions of each project.

Your rights

You can see and change your projects in the dashboard, download any project’s code, and delete your account at any time. To ask for a copy of your data, a correction, or anything else about your privacy, use the contact form. Depending on where you live, you may also be able to complain to your data protection authority.

Changes

If this policy changes in a way that matters, we’ll update this page and the date above, and tell account holders by email.