Privacy Policy

What we collect

The connector stores what its tools are given: the site name you pass to create_site, and the page HTML you pass to publish_website — including the lead-form field configuration derived from any form in it. Separately, we store the photos and videos you upload through your site’s assets page, along with the name, folder, caption, and file size you give each one. We do not collect conversation history or prompts.

Signing in. Connecting the tool to Claude, and opening your site’s assets or leads pages, both require signing in with an existing account at an identity provider. We never see or store your password: the provider tells us only your account’s identifier and email address, and we keep those two things to record who owns which site. Everything the tool can reach is limited to sites owned by the account you signed in with. Your browser session is a cookie you can clear by signing out.

Each site is also issued two secret URLs — one naming the site when editing it through Claude, one for the private pages. Neither is a password on its own: both additionally require you to be signed in as that site’s owner, so forwarding either does not by itself give anyone access.

Photos and videos you upload

Uploaded files are stored with our hosting provider (Vercel Blob) and served publicly at their own URL. If your page includes an asset block, they also appear on the public site. Anyone with a file’s URL can view it, whether or not it appears on the page, so upload only what you are willing to publish.

We store uploads as you send them and do not strip embedded metadata. Photos taken on a phone often carry EXIF data including the date and the GPS coordinates where the photo was taken, and that metadata stays in the publicly served file. If a photo’s location matters to you, remove the metadata before uploading, or turn off location tagging in your camera app.

Lead form submissions

If a site publishes a lead-capture form, we store the field values its visitors submit (for example a name, email address, or message) on the site owner’s behalf, solely so the owner can read them on their private leads page. Submissions are never displayed publicly. We do not store visitors’ IP addresses or set cookies. Site owners can delete individual submissions at any time from that page; visitors can request deletion of their submission via the contact below.

How it is used and stored

Site name, HTML, CSS, and uploaded media are stored for one purpose: serving the public website at the URL returned by the connector. Anything you publish through publish_website or upload to your assets page is publicly visible, so do not publish content you want to keep private.

Your account identifier and email are used for one purpose: deciding whether you may open a given site’s private pages. They are never published on your site, shown to your visitors, or used to contact you.

Third-party sharing

We do not sell, share, or transmit stored data to third parties. Uploaded files are held and delivered by our hosting provider (Vercel Blob) acting on our behalf, which is how they reach your visitors; no one else receives them. When you sign in, your browser visits your identity provider directly and that provider learns you are signing in to this service — it is the only thing we send you to, and we send it nothing about your site. Published pages may reference Google Fonts via CSS @import, in which case visitors’ browsers fetch fonts from Google under Google’s privacy policy.

Data retention and deletion

Site content is retained until you overwrite or remove it with publish_website, or request deletion; lead submissions until deleted from your leads page. Uploaded media is retained until you delete it from your assets page, which removes both the record and the stored file immediately; its URL stops working right away, though a browser that already loaded the file may keep it cached. Your account identifier and email are retained for as long as you own a site here. To have a site, a lead, all its uploads, or your sign-in record removed entirely, contact us with the site URL and we will delete them within 30 days.

Contact

Questions or deletion requests: arwong09@gmail.com.