Privacy policy
Last updated
This policy explains what rwaft (“we”) collects when you use rwaft at rwaft.live and the sites it hosts, why we collect it, and who else handles it. We collect only what we need to sign you in, run your builds and keep the service working.
What we collect
- Your Google account details. When you continue with Google, Google tells us your name, email address, profile picture and a stable account ID. We never receive your Google password and we don't ask for access to anything else in your Google account.
- A sign-in session. Your browser keeps a random session token in its local storage. We store only a one-way hash of it. It expires after 30 days, or as soon as you sign out.
- What you submit and what we build from it. Your prompts, the repository URLs you paste, and the code, files and website produced from them.
- Build logs. The output of each build, so you can watch it live. Log history is kept for about 24 hours.
- Credits and purchases. Your credit balance and a record of each purchase. Payments are handled by Dodo Payments; we never see or store your card number.
- Technical data. Your IP address and basic request details, used to enforce rate limits, stop abuse and keep the service secure.
Cookies and local storage
We don't use advertising or analytics cookies. Your browser's local storage holds your session token, your light or dark theme and a list of your recent builds; the last two never leave your device. The Google sign-in button is loaded from Google and is covered by Google's own privacy policy.
How we use it
To sign you in, run and host your builds, stream your build log, keep track of your credits and purchases, prevent abuse and fix problems. We don't sell your personal information and we don't use it for advertising.
Who else processes it
We rely on these providers, each under its own terms and privacy policy:
- Google for sign-in.
- AI model providers (currently Google Gemini and OpenRouter), which receive your prompts and the code being generated, in order to write your app.
- Cloudinary, which stores your project files and the built website.
- Hosting providers (currently Render for the API and builds, and Vercel for this website), including the database that holds accounts and credits.
- Dodo Payments, which processes payments as the merchant of record. We share your name and email with it when you buy credits.
Your sites are public
Everything rwaft builds is published at a public URL, and anyone with the link can open it. Don't put personal or confidential information in a prompt or in a repository you deploy.
How long we keep it
- Build logs: about 24 hours.
- Sign-in sessions: up to 30 days, or until you sign out.
- Your account and credit balance: for as long as the account exists.
- Built websites and project files: until you ask us to delete them, or we remove them under our terms.
- Payment records: as long as accounting and legal obligations require.
Your choices
You can sign out at any time. To get a copy of your data, correct it, or delete your account and the sites you've built, message us on X at @soumya_7708. Deleting your account also removes any unused credits.
Children
rwaft is not meant for children under 13, or under the minimum age for online services where they live, and we don't knowingly collect their information.
Changes
When this policy changes, the date at the top changes with it.
Contact
Questions about this policy or your data: message us on X at @soumya_7708.