Privacy Policy

Last updated 25 October 2026.

CreateStuff.ai is a free AI app builder. This page explains, in plain language, what the service collects, why, and what you can ask us to do about it. Questions: fashionistas1979@gmail.com.

What we collect

• Your account — the email address and display name you sign up with, and your password, which is stored only as a salted PBKDF2-SHA256 hash (100,000 rounds). We never store or log the password itself.
• What you build — the prompts you write, the apps and files they produce, and your project's version history. This is what makes "your apps" and "go back to a version" work at all.
• Usage records — request times, build durations and error logs on our servers, used to keep the service running and to find faults.
• Contact form messages — your name, your email address and what you write on the contact page, kept only so we can reply. They reach our inbox through FormSubmit, a form-delivery service.

What is sent to AI providers

To write your app, your prompt and the current state of your app's code are sent to the AI providers that power generation — currently Groq, OpenRouter, OpenCode Zen and Cloudflare Workers AI. They process that content to return code; we do not control how they handle requests beyond their own terms. Do not put secrets, private keys or personal data into a prompt or an app you build here.

When your app is public

Pressing Put online publishes your app to a public web address on sites.createstuff.ai. Anyone who has that address — or who guesses the project number in it — can open the app and anything it displays. Treat a published app the way you would treat a public page.

GitHub

If you bring a project in from GitHub, the repository you name is read so its files can become a project here. We do not store your GitHub token on our servers.

Cookies and advertising

Signing in uses a token kept in your browser's storage, not a cookie, and signing out clears it. The marketing pages carry advertising by Google AdSense, which may set its own cookies and use identifiers to serve and measure ads. You can opt out of personalised advertising in your Google Ads Settings.

Where things are stored

Accounts, projects, files and build history are stored in Cloudflare's D1 database and object storage, and short-lived state in Workers KV, all on infrastructure operated by Cloudflare.

How long we keep it

Until you ask us to delete it. Deleting a project removes its files and takes its published address offline. There is not yet a self-service "delete my account" button — email the address above and we will remove the account and its data.

Your rights

You can ask for a copy of your data, a correction, or deletion, by emailing fashionistas1979@gmail.com. If you are in the EEA or the UK, you may also raise a complaint with your local supervisory authority.

Changes

When this policy changes, the date at the top changes with it. Continuing to use CreateStuff after a change means you accept the revised policy.