Last updated: October 22, 2026
Using apps without an account
Standalone apps can save progress in localStorage or IndexedDB on your device. Clearing browser storage removes that local copy. Features that fetch information, sync data, or call external services require network requests; an app being free does not mean all of its data stays on your device.
Accounts and connected apps
When you sign in through GitHub, Google, Apple, or an email magic link, the platform stores an account identifier and profile information such as your login, name, avatar, and email when provided. Sign-in providers process their own authentication requests. Some features request a date of birth for an age check; if supplied, it becomes part of your platform account.
Connected apps can save per-user data on the platform, manage friendships and roles, send email, and use realtime rooms. Per-user key-value storage is scoped to your account and app. Collections are public, queryable data: do not put private information into a public collection. Realtime room messages are relayed to the room's participants and are not persisted as message history by the rooms service.
Browser storage and cookies
The platform uses localStorage for session tokens and preferences, and apps may use local storage for their own content. We do not use advertising cookies on the storefront. Authentication providers and third-party services may use their own cookies or browser storage; their policies also apply when you use them.
Permissions and notifications
Apps may ask your browser for camera, microphone, location, notifications, or device access. Each listing explains the permissions detected or declared for that app. A permission allows the app to use that feature; it does not by itself tell you whether the app transmits the resulting data.
If you subscribe to push reminders, the platform stores the browser subscription endpoint, encryption key material, and your reminder schedule. Reminders use your browser's push service. The platform sends an empty push payload; the app's service worker supplies the notification text. You can unsubscribe or cancel reminders in the app.
API keys and AI builders
API keys saved to the platform vault or an app's secret store are encrypted at rest. The platform decrypts and injects them when making the requested upstream call. The app does not receive the plaintext key from the vault. The upstream provider receives the request and applies its own data policy and usage charges.
VibeCode sends your prompts, relevant source code, and build context to the selected AI provider to build or update your app. Published app repositories and their source code are public on GitHub. Do not put secrets or private personal data in app source or build prompts.
Analytics, diagnostics, and infrastructure
The storefront can use Cloudflare Web Analytics when its beacon is configured. App analytics settings can also load Cloudflare analytics or creator-configured third-party tags. What those services receive depends on the app's configuration. The platform's compliance checks reject known tracking SDKs in submitted source, but that is not a promise that every network request or configured integration collects no data.
The platform processes operational information needed to serve requests, investigate errors, measure app quality, and prevent abuse. SDK error logs can be uploaded to the platform and are pruned after seven days by the scheduled cleanup. Hosting, authentication, fonts, avatars, email, analytics, AI, and other requested integrations involve service providers such as Cloudflare, GitHub, and Google Fonts. Request metadata can be processed by those providers.
Managing and deleting data
Use an app's controls to manage its content and permissions. Signing out clears the local session; it does not delete the server account. The SDK profile menu supports account deletion, which removes the account's keys, per-user storage, owned documents, friendships, roles, logs, push subscriptions, and reminder schedules from the active database. Published apps and shared counters are retained. Clearing browser storage only removes local data, and copies may remain in operational backups.
Children and age-restricted features
The platform's date-of-birth flow rejects ages under 13. Individual apps can have stricter age requirements. We do not claim that every app or feature is suitable for every age.
Changes and contact
This page describes the platform's current features and will be updated as they change. For questions, use the contact options on our GitHub organization. Do not include secrets or private personal information in public issues.