隐私政策
This policy describes the personal data app-generator collects, stores, and uses.
1. Data collected
- At registration: username (arbitrary string), password (stored as bcrypt hash; never in plain text)
- During access: HTTP request metadata (URL / IP / User-Agent / partial request body) for monitoring and abuse detection
- BYOK: Anthropic API keys are stored AES-GCM encrypted. The master key lives only in server env, separated from the DB.
- Generation requests: free-form text input provided by the user at app generation
2. Third-party sharing
- Generation invokes Anthropic (Claude API). User input (description) is transmitted to Anthropic. See Anthropic's Privacy Policy for details.
- No other third-party sharing.
3. Administrator access
The operator (sena) has access to all data stored in the DB (request_logs / apps / users) for abuse detection and incident response. Treat all uploaded avatars and generated app content as potentially viewable.
4. Log retention
request_logs are retained for maintenance; oldest entries may be deleted when storage caps are exceeded.
5. Deletion requests
For account/data deletion, contact admin (sena) directly. There is currently no self-serve deletion.
6. Cookies
- session_token (login session, up to 30 days)
- csrf_token (CSRF protection)
- lang (language preference, up to 1 year)
Last updated: 2026-05-13