Privacy Policy

Last updated: 2026-07-31

This Privacy Policy explains what DevDroid AI (the "Service") collects, what it does not collect, and how long it is kept. Where the Japanese version and this English version differ, the Japanese version prevails.

1. Information We Collect

• Account information: email address and username obtained via GitHub / Google OAuth
• Repository information: the name and structure of repositories you register
• Usage data: how many AI fixes and builds you have used (for plan limits)
• FCM token: to deliver push notifications
• Your request text: the wording you type when asking the Service to create or change an app. This is stored on our servers (see Sections 4 and 5 for details, retention and masking). It is also used to improve the Service.
• Execution history: the outcome of each request (success or failure, the paths of changed files, processing time). It does not include the contents of your source code.
• Chat display history: the conversation shown in the app, stored in a local database on your device

2. How We Use Information

• To provide the Service and its features
• To enforce plan limits
• To send push notifications such as build and fix completion
• To improve the Service and fix defects
• To respond to enquiries

3. Third-Party Services

• Supabase: authentication and database
• Cloudflare: application hosting and storage
• Anthropic Claude API: AI processing
• GitHub: repository access
• Stripe: subscription payments
• Firebase (Google): push notifications and APK distribution
• ElevenLabs: text-to-speech

4. Storage and Protection

4-1. What we store on our servers: your request text

When you ask the Service to create or change an app, the request text you typed is stored on our servers (Cloudflare Workers KV). We use it for two things:

• Running your request and showing progress: displaying status, resuming after an app restart, and the "run again" action.
• Improving the Service: analysing which ways of phrasing a request succeed and which do not, so that more requests succeed. We give this back to you as the "what did not work and what did" section of your weekly report.

Before storing it, we automatically replace strings that look like API keys or tokens (values beginning with sk-, ghp_ or AIza, JWTs, private key blocks, api_key=... assignments and similar). This masking is best effort and we do not guarantee that it catches every secret. Please do not type passwords, API keys or personal information into your requests.

4-2. What we do not store: your source code

We do not store the source code of your repositories on our servers. Code is read from GitHub and held in memory only while a request is being processed, and is gone once processing ends. What we persist is the paths of changed files and a summary of the result — not the contents of the code. (Only the built APK is kept, for up to 7 days, so that you can download it; it is then deleted automatically.)

4-3. Report storage

When you create a weekly or monthly report, its HTML is stored privately in our storage (Cloudflare R2). The report includes parts of the request text you typed (with the masking described above applied). Viewing it requires signing in, and you can only see your own reports. It is retained for 90 days and then deleted automatically. It is not committed to your repository. This runs only when you tap the button in the app; it never runs automatically.

4-4. Transmission for AI processing

• What is sent: to perform AI analysis and changes, your request and fragments of the target files are sent to Cloudflare Workers and third-party AI services such as the Anthropic Claude API (see Section 3). Their handling of that content is governed by their own privacy policies.
• Not stored in the app: our own secrets, such as API keys, are held only inside Cloudflare Workers and are never stored in the app.
• All communication is encrypted with HTTPS (TLS).
• The chat history shown in the app is also stored locally on your device and is cleared when you sign out.

5. Retention

Request text is kept for the following periods depending on what it is used for, and is deleted automatically when the period ends.

• Account information: kept until you delete your account
• Usage data (plan limit counters): reset monthly on paid plans. On the Free plan the AI agent fix count is cumulative and is not reset
• Chat display history (on your device): kept until you reset it
• Built APK files: up to 7 days
• Irreversible value used to detect re-registration: retained after account deletion (see Section 6-3)

6. What Happens When You Delete Your Account

When you delete your account, the following applies. Not everything is erased, so please read this section.

6-1. Deleted

• The request text you typed (every store listed in Section 5; as a rule, deleted immediately rather than waiting for its period to end. Before deleting a record, we verify that it belongs to you. Because of this, a record whose owner cannot be identified as you — for example because the record is corrupted — is left in place rather than deleted on the spot, so that another user's data is never deleted by mistake. Any record left this way is still deleted automatically within 30 days at most; nothing remains indefinitely)
• The weekly and monthly reports you created (the HTML stored in R2 is deleted)
• Account information, connected GitHub tokens, push notification tokens
• Usage counters and app settings
• Any paid plan is cancelled immediately

6-2. Anonymised, not deleted

• Execution history (result statistics): this is not deleted. It is converted into a form that cannot identify you and retained. What remains is whether a request succeeded or failed, the paths of changed files and processing time; the link to you is removed. We use it for aggregate quality improvement.

Please check whether you have used the report feature before deleting your account.

6-3. Retained after deletion (a value that cannot be reversed)

After account deletion we retain only a one-way, irreversible transformation of your external provider (GitHub / GitLab) account identifier, solely to detect re-registration by the same account. This value cannot be used to identify you, your account, or your email address. Your name, email address, repository information and other personal data are deleted when you delete your account.

7. Your Rights

You may:

• Request disclosure of the data we hold about you
• Request correction or deletion of that data
• Delete your account (which deletes the associated data as described in Section 5)
• Withdraw consent to processing

8. Contact

For questions about this Privacy Policy, please contact us at the address shown on the Service.