Privacy Policy
Last updated 9 September 2026
Levers is in beta. This page was written in plain English by the people who build Levers, not by a lawyer. It describes exactly what the product does today. Before Levers charges anyone money, a lawyer should review both this page and the Terms of Service, and add the operating entity and governing law.
Levers (levers.build) is a tool for building web apps by describing them in plain English. This page explains, without jargon, what we store about you, who else sees it, and how to get rid of it. If anything here is unclear, email support@levers.build and we will explain it.
The short version
- We store your email address, the apps you build, and your chat with the AI.
- Your AI provider key is encrypted before it is saved, never shown in full, and never written to a log.
- Your prompts go to the AI provider you connect, using your key. Nowhere else.
- We do not sell your data, show you ads, or use your projects or chats to train any AI model.
- Ask us to delete your account and we delete everything in it.
What we store
Your account
Your email address and an account id. Signing in is handled by Clerk, our login provider — we never see or store your password. If you sign in with Google, Google tells Clerk your email address and basic profile information; the only thing we keep is your email address.
What you build
The names and descriptions of your builds, every file the AI writes for you, your messages in the Blueprint and Workshop chats, the Brief (the short note the AI keeps about your project's goals and decisions), and snapshots of your files so you can restore an earlier version from the Logbook.
Your AI provider key
If you connect a key, it is encrypted with AES-256-GCM before it is written to our database. The encryption key lives in our hosting environment, never in our code or our database. Your key is decrypted only in server memory at the moment a request is made, and then discarded. It is never written to a log, never sent to your browser, and never displayed beyond its last four characters. You can delete it yourself at any time on the API keys screen; deletion is immediate.
Operational records
We keep an append-only log of sensitive actions (which action, which project, which provider, a last-four hint) and a per-request usage record (which role and model ran, token counts, estimated cost, how long it took, and whether it succeeded). Neither contains your prompts, your replies, your files, or any key. Sharing anonymous, aggregated versions of those usage numbers is off by default for every account.
What we do not store
- Your password, and your API key in readable form.
- Payment details — Levers is free during beta and takes no payments.
- Recordings of your screen. Session replay is deliberately switched off, because people type API keys into this app.
We do not use your projects, files, or chats to train any AI model, and we never will without asking you first.
Where your prompts go
When you build, your message and the relevant files are sent to the AI provider you have connected — Anthropic, OpenAI, or any OpenAI-compatible provider whose address you enter — using your own key. That provider's own privacy policy and terms govern what it does with that request, so it is worth reading them; providers on free tiers in particular may use what you send to improve their models. We show you that warning on the screen where you connect the key.
When the AI checks that your app actually works, the app's own HTML is sent to Browserless, which runs it in a real browser and returns a screenshot and any errors. The screenshot is shown to you in the chat and to the AI so it can fix what it sees.
Who else processes your data
| Service | What it does for us | What it sees |
|---|---|---|
| Clerk | Login and accounts | Your email address and login activity |
| Supabase | Our database | Everything we store, listed above |
| Railway | Hosting for the app | Requests to the site, server logs without personal content |
| Sentry | Error reports so we can fix crashes | Error messages and stack traces; personal data reporting is switched off and session replay is disabled |
| PostHog | Product analytics — which screens get used | Page views and feature events; a profile only for signed-in users |
| Browserless | Runs your app in a real browser to check it works | The HTML of the app you are building |
| Your AI provider | Builds and plans your app | Your prompts and the relevant project files, under your own key |
These providers are based in the United States, so your data may be processed there.
Cookies and local storage
A session cookie from Clerk keeps you signed in — the app cannot work without it. PostHog sets an analytics cookie. Your Fast / Balanced / Best preference is kept in your own browser and never leaves it.
How we protect it
Every table in our database has row-level security, which means the database itself refuses to return one person's rows to another. Keys are encrypted as described above. Keys and secrets are never written to logs. An automated test runs on every change we make and tries to read another account's rows; if it ever succeeds, the change is blocked.
Deleting your data
- An API key: delete it yourself on the API keys screen. It is gone immediately.
- A build: archive it in your dashboard, or ask us to delete it outright.
- Your whole account: email support@levers.build from the address you signed up with and ask us to delete it. We remove your account, your builds, your files, your messages and your keys within 30 days and reply to confirm. There is no self-serve delete button yet; it is on our roadmap and this page will be updated when it exists.
You can also ask us for a copy of what we hold about you. Your own files are always yours to take: use Export on any build to download a ZIP.
Children
Levers is not intended for anyone under 16, and we do not knowingly collect their data.
Changes
If we change what we collect or who we share it with, we will update this page and change the date at the top. During beta, that may happen often.
Contact
Questions, deletion requests, or anything else: support@levers.build. See also our Terms of Service.