Privacy Policy

Last updated: 4 October 2026.

Controller and contact

Lord Henry Wotton, London, England, United Kingdom, operates Nativify and is the controller for account, billing, and service-operation data. Contact [email protected] for privacy requests or [email protected] for account support.

Information and purposes

We process account identifiers, email addresses, profile and language preferences, password hashes for local accounts, workspace membership, project settings, uploaded JARs, generated artifacts, compilation logs, API-key metadata, usage and credit-ledger records, and subscription and invoice references. Service requests can produce IP-address, browser, endpoint, status, latency, and security records. Avoid uploading secrets or unnecessary personal data inside code or logs.

We use account and build information to provide the service you request and administer your contract. We use limited operational and security records for our legitimate interests in preventing abuse, diagnosing failures, and keeping the service reliable. We retain records where needed to meet legal obligations, including applicable accounting requirements. We use your email for requested recovery links and essential service communications. We do not sell personal data or use uploaded code for advertising or model training.

Providing an account identifier and email is necessary to maintain an account. Uploading code is necessary to run a build. Optional profile fields can be left blank. Automated quotas and abuse controls can reject a request; contact support to challenge an error. We do not use personal data for automated decisions producing legal or similarly significant effects.

Providers and disclosure

Hosting and network providers process data needed to run and protect the service; the current infrastructure uses Hetzner and Cloudflare. If you choose Google or GitHub sign-in, WorkOS and your chosen identity provider process authentication information. If you purchase a plan or credits, Stripe handles checkout and payment-card information; Nativify receives billing references and payment status rather than your full card details. Email infrastructure processes recipients and recovery messages. We may disclose data when legally required or to address fraud or security incidents, limited to what is necessary.

Providers may process data outside the United Kingdom. Contact the privacy address for the current provider list, processing locations, and applicable safeguards. Where we process personal data inside uploaded customer material on an organisation's instructions, any required data-processing agreement must be agreed before that material is uploaded.

Storage and retention

The application retains account and workspace data while the account is active, unless you delete it sooner. Completed build files and records expire under the currently entitled plan: Free 24 hours, Hobby 7 days, Pro 30 days, and Team 90 days. Cleanup runs periodically, so expiry is not an exact deletion timestamp. Unsubmitted upload drafts expire after 72 hours. API request logs default to 90 days. Password reset links expire after 30 minutes and are single use; only their hashes are stored in the account database.

Billing, fraud-prevention, dispute, and legally required records may outlast account deletion for the period necessary for their specific purpose. Backups may also retain data until rotated. Deleting an account does not immediately remove data from backups or payment-provider systems.

Browser storage

The dashboard stores session tokens and necessary preferences such as language, theme, and active workspace in browser storage. These support authentication and requested settings. Cloudflare and external authentication or payment providers may use their own necessary cookies. The application does not include an advertising-cookie or optional tracking-consent system; optional tracking must not be enabled without an appropriate notice and consent where required.

Your rights

Depending on the circumstances, you can request access, correction, deletion, restriction, or portability of your personal data. You can object to processing based on legitimate interests. If a future optional activity relies on consent, you may withdraw it without affecting earlier lawful processing. Account settings provide profile updates and account deletion; email the privacy address for other requests. We may need proportionate information to verify your identity.

You may complain to the UK Information Commissioner's Office or your local supervisory authority. This service is intended for adults and does not knowingly solicit children's accounts. Material changes to this policy will be announced through the service or an appropriate account communication.