Privacy Policy

Account data: When you sign in with Google we receive the basic profile your Google account shares, such as your name, email address and profile picture. If you register with email/password we store your email and a secure hash of your password.

Usage data: The apps you create, the instructions (prompts) you provide, generated content, your credit transactions and basic usage logs.

Assistant conversations: Messages you exchange with the in-product DevKitty Assistant are stored so we can support you and improve the product. They are readable only by DevAny administrators, are never used to train models, and are deleted automatically after 90 days.

Technical data: Session cookies, your language and theme preference, and standard logs needed to operate the service.

To create your account and sign you in.

To generate, store and host the apps you request.

To manage your credit balance and usage.

To keep the service secure, prevent abuse and meet our legal obligations.

Legal basis for each purpose (GDPR Art. 6 / KVKK Art. 5): account creation, generation, hosting and billing — PERFORMANCE OF A CONTRACT; keeping transaction and invoice records — LEGAL OBLIGATION; security, abuse prevention and service improvement — LEGITIMATE INTEREST (balanced against your rights); usage measurement and marketing communication — CONSENT (collected separately, withdrawable at any time). The service is never conditioned on consent.

We do not carry out solely automated decision-making or profiling.

To generate apps, your instructions are sent to third-party large language model (LLM) providers. These providers process your instruction only to produce the response; the resulting content is stored by us, associated with your account.

We recommend not including secrets, personal health/financial data, or sensitive third-party data in your prompts.

Payments are processed by Stripe. Your card number, expiry date and security code NEVER reach our servers; the payment screen is Stripe's own page, and only Stripe sees and stores those details.

Your billing details (billing address, tax ID if provided, payment method details and invoice history) are held by Stripe. What stays on our side is: your sign-in identity (email, display name), which plan you are on, your credit balance, and the records accounting requires — amount paid, date, and the invoice/customer identifiers Stripe issues.

You reach your invoices and payment method through the Stripe customer portal, opened from the Billing page in your account.

We do not sell your data. We share it only with the infrastructure providers needed to deliver the service: authentication and database (Supabase), hosting (Cloudflare), payments (Stripe), email delivery (Resend) and AI model providers.

We may disclose data to authorities where required by law or a valid legal request.

International transfers: the company and its infrastructure providers are established mainly in the US and the EU, and your data is processed there. Transfers from the EEA/UK rely on our providers' Standard Contractual Clauses (SCCs) and, where available, their EU-US Data Privacy Framework participation; for transfers from Türkiye see the KVKK Notice. The current subprocessor list is published on the Subprocessors page.

We retain your data while your account is active. You can delete your account yourself from Settings, or request deletion at the address below; deletion removes your account, apps and content.

Periods by data type: account and app data — until account deletion; invoice and transaction records — the minimum statutory period required by tax and commercial law; server/security logs — limited, reasonable technical periods; measurement data — the provider's configured retention. Records whose statutory period has passed are deleted or anonymized.

We protect data with industry-standard measures including encryption in transit and at rest, row-level security (RLS) and access controls. No system is 100% secure, but we exercise reasonable care.

You have the right to access, correct, delete, restrict processing, OBJECT to processing, and receive your data in a structured, machine-readable format (portability). Where processing relies on consent, you may withdraw it at any time with future effect.

To exercise these rights, write from the address linked to your account to contact@devany.ai; we answer within 30 days at the latest, free of charge. You can also download a copy of your data yourself via "Download my data" in Settings.

If you are not satisfied with our answer you may lodge a complaint with a supervisory authority: the Personal Data Protection Board (KVKK) in Türkiye, your national data protection authority in the EEA, or the ICO in the UK.

Alongside the strictly-necessary cookies that keep you signed in, we use first-party functional cookies to remember your interface preferences (such as language, theme, tone, accent color, layout, and tour state). We also use Google Analytics (GA4) and Google Ads conversion tracking to measure use of the site and of the signed-in console — but only with your explicit consent; without it no measurement cookie is written. We do not profile you, sell your data, run social-media pixels, or track you across other sites for advertising.

Functional cookies are only written with your consent; see the Cookie Policy (devany.ai/cookies) for the full list and preference management.

We may update this policy from time to time. For material changes we will update the effective date and notify you where appropriate.

Questions? Reach us at contact@devany.ai.