Privacy Policy
How IdeaMade handles information across our website, accounts, AI app builder, hosted applications, support, and billing.
Last updated: November 5, 2026Who we are
IdeaMade is operated by Shanghai Yunzuo Information Technology Co., Ltd., established in China, with a contact address at 5-6/F, No. 380 Xinsong Road, Minhang District, Shanghai 201100, China. Contact [email protected] for privacy questions and requests. This policy covers information we process for our own service operations and explains our role when hosting data for an app creator.
Account, project, and payment information
We process your email, account identifiers, authentication records, language preferences, and records of acceptance of our terms. Supabase Auth handles passwords and email verification. We store requirements, blueprints, conversations, images you paste or drop into the builder, generated code and app configuration, versions, build results, and publishing records. We receive subscription, transaction, refund, and usage information from Paddle. Payment-card details are collected by Paddle and its payment providers rather than through IdeaMade project forms.
Google sign-in
If you choose to sign in with Google, Google and Supabase Auth provide the account identifiers, email address, and basic profile information, such as your name and profile picture, needed to create or authenticate your IdeaMade account. We use this information for sign-in, account management, and security. Signing in with Google does not by itself connect Google Calendar; a calendar connection requires a separate authorization.
Google Calendar connections
If an app creator chooses to connect Google Calendar, we access their calendar list to let them select a calendar they own. For that selected calendar, the connected app can read, create, and update ordinary events. The data processed can include Google account and calendar identifiers, calendar names and time zones, and event identifiers, titles, descriptions, locations, start and end times, and version information. Preview and production connections are managed separately. The current integration does not provide event deletion.
Google data storage and control
Calendar OAuth tokens are encrypted on our servers and are not embedded in generated app code or AI prompts. We retain connection details and the request identifiers, event identifiers, write results, and operational records needed to maintain the connection, prevent duplicate writes, resolve conflicts, and troubleshoot failures, subject to this policy's retention and deletion practices. Disconnecting in project settings removes that project/environment's active credentials and calendar selection; it does not delete events already in Google Calendar or automatically erase retained operational records. You can also revoke IdeaMade's access through https://myaccount.google.com/connections and contact [email protected] to request deletion of retained Google data.
Google data use and sharing
We use Google user data to provide the sign-in and connected calendar features you request. Calendar data is returned to the connected app and can be displayed to its users according to that app's configured access rules. Our hosting and infrastructure providers process data on our behalf to deliver and protect these features. We limit other access, use, and transfers to those permitted by the Google API Services User Data Policy, such as necessary security or legal purposes. We do not sell Google user data, use it for advertising, or use it to train generalized AI or machine-learning models, and we do not transfer it to others for those purposes. These Google-specific restrictions also apply where other sections describe our general AI processing or service providers. IdeaMade's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements: https://developers.google.com/terms/api-services-user-data-policy.
Information collected during use
We process request identifiers, timestamps, browser and device information available in requests, IP addresses or derived abuse-prevention identifiers, authentication and security events, and operational logs. If you choose optional analytics, PostHog receives limited page and feature events, locale, campaign attribution, and performance or error categories. Our analytics integration disables automatic element capture and session recording and does not deliberately send project prompts, code, images, email addresses, or message bodies as analytics events.
AI processing
To answer requests and build or modify apps, we send relevant prompts, conversation context, reference images, selected-component information, code, and technical diagnostics to model providers. Current integrations include DeepSeek and Zhipu AI / BigModel. The provider and context depend on the task and configured model routing; an image may be sent to a vision-capable provider. Processing may occur outside your country, including in China. Providers apply their own service terms, retention practices, and account settings. We do not promise zero retention or that every provider excludes all submitted data from training. Do not send secrets or regulated information unless the applicable arrangements support your use. We do not currently train our own foundation models on customer projects.
Why we process information
We use information to authenticate accounts; generate, edit, preview, host, and publish apps; retain project history; provide support; allocate and settle Credits; manage subscriptions, refunds, and fraud; maintain security; diagnose failures; and meet accounting or other legal obligations. Optional analytics helps us understand product use. Marketing communications are separate from essential account, security, and billing messages and can be unsubscribed from.
Service providers and other disclosures
Providers include Supabase for authentication and related configured services, hosting and database/object-storage providers, DeepSeek and BigModel for AI processing, Resend for email, PostHog for optional analytics, and Cloudflare for network or security services where enabled. Paddle acts as Merchant of Record and processes purchase information under its own privacy notice. We may disclose information to comply with law, protect rights or safety, or as part of a business transfer with appropriate notice and safeguards. We do not sell personal information or share it for cross-context behavioral advertising.
Data in apps you create
App creators decide what their apps collect and how that information is used. When we host that data on a creator’s instructions, our role is generally that of a service provider or processor, subject to the applicable arrangement. The creator is responsible for its notices, permissions, lawful use, and responses to its users. If you use an app created with IdeaMade, contact its operator about that app’s data. We assist with requests within our role; we do not use this distinction to exclude our own legal obligations. A separate data-processing agreement may be needed before processing regulated or enterprise customer data.
Public content and publishing
Publishing an app or sharing a blueprint makes the content you choose to expose available to others. App pages may be public even where some app records require authentication. Review access controls and remove confidential content before publishing. We do not make private project conversations public merely because you have an IdeaMade account.
Storage, cookies, and privacy signals
Essential cookies and browser storage support sign-in, security, language preferences, blueprint drafts, and navigation. Optional analytics is controlled through Cookie settings. When your browser sends Global Privacy Control (GPC), our website treats optional analytics as rejected. Legacy Do Not Track signals do not independently change our processing. See the Cookie Policy for more detail. Clearing browser drafts does not delete copies already submitted to our servers or providers.
Retention and deletion
We retain project content while needed to provide the workspace, version history, and hosting you request. Deleting a project removes workspace access; it is not an immediate erasure of all production data, files, logs, or backups. Contact us at [email protected] for account or personal-data deletion. We review applicable obligations and coordinate deletion or de-identification across systems and providers. Security, fraud, tax, billing, dispute, and consent records may be retained where needed or required. Backup copies remain for the applicable backup lifecycle and are restricted from routine use. Retention depends on the purpose, account or project status, legal requirements, and operational necessity.
International processing and security
Our systems and providers may process data in the United States, China, and other countries, depending on deployment and provider location. These countries may have different privacy protections and government-access laws. Where required, appropriate transfer arrangements must apply. We use measures such as access controls, tenant isolation, secret redaction, and security logging; no system is completely secure. Public production access should use HTTPS. We do not represent that a development or HTTP test environment is suitable for confidential production data.
Your privacy choices and requests
Email [email protected] to request access, correction, deletion, or a portable copy of your personal information. Depending on applicable law, you may also have rights to restrict or object to processing, withdraw consent, limit certain sensitive-data uses, appeal a refusal, or use an authorized agent. We may verify identity or authority using proportionate information and will respond within applicable legal time limits. If we deny a request, we explain available reasons and appeal routes where required. We do not discriminate for exercising protected privacy rights. Rights and exceptions depend on your location and whether a law applies to our business.
Children and sensitive data
IdeaMade does not impose a blanket minimum age for using the service. Applicable children’s privacy laws still apply. If you are a parent or guardian with a question or request about a child’s personal information, contact [email protected]. App creators remain responsible for any age-specific obligations of their own apps. Do not put passwords, API secrets, full payment-card numbers, or unnecessary personal information in AI prompts or images. Processing health, financial, children’s, or other regulated information may require additional agreements and controls; standard access does not certify suitability for those uses.
Changes and contact
We will update this policy and its date when practices change, provide additional notice where required, and obtain consent where the law requires it. A policy update does not authorize us to disregard promises governing information already collected. Contact [email protected] or 5-6/F, No. 380 Xinsong Road, Minhang District, Shanghai 201100, China.
Paddle Privacy Policy · Paddle Buyer Terms · Paddle Refund Policy