What we collect, and why.

Reverse AI ("we," "us") builds a tool that turns URLs, screenshots, and prompts into production frontend variations. To do that we collect the minimum amount of personal data we need to run accounts, take payments, and call Claude on your behalf.

• We do not sell personal data. We do not run ad-tracking pixels.
• We share with the third parties named in section 04 — and nobody else.
• You can delete your account and all associated projects on request (section 08).

This document is plain English, not a legal contract. For the binding version see Terms of Service.

Only what the product needs to work:

• Account data — name, email, hashed password or Google ID — collected by Clerk when you sign up.
• Inputs — the URLs, prompts, and images you submit to the studio. Stored against your account in Postgres.
• Outputs — the variations Reverse generates from your inputs, plus refinement history and starred favorites.
• Billing data — anonymized Stripe customer ID, subscription ID, current plan, and renewal dates. We never receive your card number, CVC, or expiry.
• Operational logs — request timing, error traces, IP address at submit time. Retained 30 days for debugging, then deleted.

• To run the product — authenticate you, enforce plan limits, call Claude on your inputs, store the variations you create.
• To take payment — pass billing events to Stripe, react to Stripe webhooks, switch your plan when you upgrade or cancel.
• To reply to support — when you write to /contact we keep the thread so we can answer.
• To debug — operational logs help us find and fix bugs you hit.

We do not use your inputs to train models. We do not fine-tune on your projects. We do not surface your generations to anyone outside your account.

Reverse AI runs on managed infrastructure. The named third parties below process specific data on our behalf:

Each provider has its own privacy policy. We pass only what they need to do their job — Stripe sees billing, Clerk sees auth, Anthropic sees the input you submit and the output it returns.

Every Generate, Refine, and image-vision call sends your input (URL, prompt, screenshot, or refinement instruction) to Anthropic's Claude API. Anthropic processes that content per its commercial data policy — at time of writing, no training on commercial customer content and a 30-day retention window for trust-and-safety review.

• The recreation we build from your input — the study doc and the generated HTML — is stored against your account in our Postgres database.
• The model providers (Anthropic, OpenRouter) never receive your billing data, your account email, or any other Reverse-side identifier.
• If you delete a project, its study and recreation are removed from our database. The providers' own retention is governed by their policies and is outside our control after the API call returns.

We use first-party cookies for two things only:

• Authentication — Clerk sets session cookies so you stay signed in.
• Theme preference — your light/dark choice is stored in localStorage so the site doesn't flash on reload.

We do not run Google Analytics, Facebook Pixel, Hotjar, or any third-party tracker. We do not show ads.

• Accounts & projects — kept as long as your account is active.
• Operational logs — 30 days, then deleted automatically.
• Stripe billing records — Stripe retains these per their own compliance requirements (typically 7 years for tax purposes). We don't control that retention.
• Support email threads — kept until the conversation is clearly resolved, then archived for up to 12 months.

You have the right to:

• Access — request a copy of the personal data we hold about you.
• Delete — request full account deletion. We complete deletion within 7 days. Stripe billing records remain per Stripe's compliance retention.
• Export — every project is already exportable from inside the product as HTML, React, a Next.js zip, or design-token JSON.
• Correct — update your name or email at any time from your account.
• Withdraw consent — cancel your subscription and delete your account. Both can be done without contacting us, though we're happy to help.

To exercise any of these rights, email us — see section 13.

Reverse AI runs on Vercel (United States edge regions) and stores data in Supabase (region depends on your project, but typically United States or Europe). Anthropic processes Claude calls in the United States. If you access Reverse from outside the US, your data is transferred to US infrastructure under the standard Vercel and Supabase contractual safeguards.

• Database connections use TLS end-to-end via Supabase's Supavisor pooler.
• Passwords are never stored by us — Clerk handles hashing with industry-standard algorithms.
• Card data never reaches our servers. Stripe Checkout collects it directly.
• Anthropic API keys, Stripe secrets, and database credentials live in Vercel encrypted environment variables — not in source control.

No system is unbreakable. If we discover a breach affecting your data, we'll notify you within 72 hours.

Reverse AI is built for professional designers and engineers. It is not intended for users under 16. We do not knowingly collect data from anyone under 16. If you believe a child has signed up, email us and we'll delete the account.

When we change this policy materially — adding a new service provider, changing what we collect, changing retention — we'll update the "Last updated" date at the top and email anyone with an active subscription. Continued use after the change means you accept the revised policy.

Questions, deletion requests, or anything else privacy-related:

• Email hello@reverse-ai.app
• Or use the form at /contact and pick "Other" as the topic.