Security
We don't hold your keys. Here is how to check.
The design goal is that a compromise of this website cannot reach your apps or your accounts.
Keys and accounts
- Every vendor key (Anthropic, Cloudflare, Expo, Supabase, Resend, Apple, Google) lives in your GitHub secrets or your console's vault. We never receive, store, pool or proxy any of them.
- Support will never ask you for a key. If someone does, it isn't us.
- We never create vendor accounts for you and never run store uploads for you. The workflows run in your repo, as you.
- Your prompts and code go to Anthropic under your own agreement with them. Anthropic's current docs say commercial API data is not used for training by default; read their terms yourself.
Calls to this site: the complete list
| Call | When | What is sent |
|---|---|---|
Release feed read (/releases.json) | Update-available banner. A setting, on by default, disclosed. | Nothing about you. |
| Revocation check | Only if you turn it on. Off by default. | Your license key. |
| License-gated download | When you install or click Update. | Your license key and the version you want. We log order id and version for support. |
With both settings off, the console makes no request to this site. Your license is verified offline against a public key built into the installer. If your update window lapses, nothing stops working.
What's built in to the output
- A security-gate stage reviews generated code and database policies before anything ships.
- A budget file gates vendor spend (Supabase, EAS builds, runtime AI keys, SMS). Claude's own build spend is capped per run and by your Anthropic limit.
- Generated apps still need your review. We make no guarantee that AI-written code is free of vulnerabilities.
Report a problem
Email [email protected] with "security" in the subject. Please don't include secrets.