Short version: your designs and API keys stay in your browser. We count visits with analytics. We have no upload storage. Without credits there is no account; if you choose Craft Apps credits for the AI panel, you have an account with us (your email), and each AI request passes through our service to the AI provider; we keep neither what you send nor the result.
Your Files
The editor runs in your browser. Files you open are read on your device, edits happen on your device, and saving creates a download on your device. The Site has no upload endpoint and no storage for documents.
AI Panel
When you use the AI panel, your browser sends the prompt, and any design you chose to revise, directly to the provider you selected (OpenAI, Google, OpenRouter, or the custom endpoint you entered), authenticated with your API key. These requests do not pass through our servers. The provider’s privacy policy applies to that data.
Your API key is stored in your browser: in sessionStorage (cleared when the tab closes) by default, or in localStorage if you tick “Remember my key on this device”. “Forget all keys” in the panel deletes it.
AI With Craft Apps Credits
If you use the AI panel with Craft Apps credits instead of your own key, the panel sends your prompt and any design you send to the Craft Apps service at api.artcraft.run, which we operate. The service passes them through OpenRouter to the model you chose (Google Gemini, OpenAI GPT, Anthropic Claude, GPT Image or ByteDance Seedream), returns the result to your browser and does not store the content you sent or the result. OpenRouter’s and the model provider’s API terms and privacy policies apply to their processing.
The Craft Apps account is shared by the Craft app sites that offer credits. For it we keep your email address (and your Google account name and picture if you sign in with Google), your sign-in sessions, your credit balance and its history (purchases and, for each AI request, the site, the model, its size in tokens or units, its cost and the time), and your orders. Sign-in codes are sent by email through Cloudflare. Payments are processed by Stripe, which receives your email and payment details under its own privacy policy; we never see your card number. On this site the panel keeps your sign-in token in localStorage until you sign out. To delete your account and its data, email us.
Data Stored in Your Browser
The editor keeps its preferences in your browser’s localStorage, and its Data Recovery copies of modified documents there too, so it can offer them back after a crash. The AI panel stores your chosen provider and models there. None of it is sent to us. Clearing this site’s data in your browser removes all of it.
Analytics
We use Umami, which does not use cookies, and Google Analytics, which does set cookies, to count page views and a few anonymous events such as opening the AI panel or running an AI request (provider name and success or error only). Events never include your designs, prompts, file names or keys. Google’s use of this data is described in its privacy policy.
Hosting
The Site is served by Cloudflare, which processes standard request data such as IP addresses to deliver pages and protect against abuse.
If you email us, we receive your address and message and use them only to reply.
Changes
We will post any changes to this policy on this page with a new effective date.