Privacy Policy

Effective date: September 18, 2026 · Controller: Smiling Bob Games LLC · Contact: contactus@smilingbob.games

1. What we collect

• Account data: your email address and authentication data, via our auth provider (Supabase).
• Build data: the descriptions ("intents") you submit and the apps

generated for you.

• Usage & billing data: credit balance and ledger, build metadata (timestamps, token counts,

status), and subscription/customer references from our payment processor. We do not store your card details — payments are handled by Stripe.

• Technical data: IP address, request logs, and similar operational data needed to run and secure

the Service.

2. How we use it

• To provide the Service: authenticate you, generate and deliver apps, meter and charge credits.
• To secure the Service: prevent abuse, enforce rate-limits, the private-beta gate, and licence terms.
• To operate billing through Stripe.
• To improve the Service. We do NOT use your descriptions or generated apps to train AI models. If

that ever changes it will require notice and, where required, consent.

3. AI processing and subprocessors

Generating an app sends your description to our AI model provider for processing. We rely on the following subprocessors; each receives only the data needed for its function:

• Anthropic — AI model that authors app content from your description.
• Supabase — authentication and database (accounts, credits, build records).
• Stripe — payment processing (card data goes directly to Stripe, not to us).
• Resend — transactional email (e.g., account confirmation).
• Fly.io — hosting the Service (US region).

4. Generated apps and marks

Every app generated for you carries a cryptographic signature and an encrypted, non-visible origin mark — on every build, on every plan. The mark encodes an identifier that resolves, only with our key, to the account and build that produced the app. It exists to establish provenance and enforce licence terms, not to track the end users of your app.

5. Storage, retention & security

• Build artifacts (binaries, previews, source manifests) are stored in private storage and served via

short-lived signed URLs.

• Retention (defaults, adjustable): account data while your account is active and up to 30 days after

you delete it; build records (metadata) up to 12 months; build artifacts (binaries, previews, manifests) up to 30 days; operational logs up to 90 days. Billing/tax records are kept as long as the law requires (typically up to 7 years).

• We use industry-standard measures to protect data, but no method is perfectly secure.

6. Your rights

Depending on where you live, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise them, contact contactus@smilingbob.games. You can delete your account, which removes your account and build data on the retention schedule in §5, except records we must keep for legal or accounting reasons.

7. International transfers

The Service runs in the United States (our hosting, database, and AI provider operate there), so your data is processed in the U.S. If you use the Service from outside the U.S., you consent to that processing. If we take on EU/UK users at scale we will add the appropriate transfer safeguards.

8. Children

The Service is not directed to anyone under 18 and we do not knowingly collect their data.

9. Changes & beta

This policy may change; material changes will be notified by email and/or an in-product notice. During the private beta, data handling may evolve as the Service does.

10. Contact

contactus@smilingbob.games

Smiling Bob Games LLC, 4331 Bethelview Rd, Suite 2, PMB 1006, Cumming, GA 30040