Privacy Policy

Last updated: 2026-09-19

This Privacy Policy explains what DevDroid AI (the "Service") collects, what it does not collect, and how long it is kept. Where the Japanese version and this English version differ, the Japanese version prevails.

1. Information We Collect

• Account information: email address and username obtained via GitHub / Google OAuth
• Repository information: the name and structure of repositories you register
• Usage data: how many AI fixes and builds you have used (for plan limits)
• FCM token: to deliver push notifications
• Your request text: the wording you type when asking the Service to create or change an app. This is stored on our servers (see Sections 4 and 5 for details, retention and masking). It is also used to improve the Service.
• Execution history: the outcome of each request (success or failure, the paths of changed files, processing time). It does not include the contents of your source code.
• Chat display history: the conversation shown in the app, stored in a local database on your device
• App version number: we record the version number of the app you use, to fix bugs and to guide you to updates (kept up to 180 days; deleted when you delete your account).

2. How We Use Information

• To provide the Service and its features
• To enforce plan limits
• To send push notifications such as build and fix completion
• To improve the Service and fix defects
• To respond to enquiries

3. Third-Party Services

• Supabase: authentication and database
• Cloudflare: API processing, application hosting, and APK and report storage and delivery
• Anthropic Claude API: AI processing
• GitHub: repository access
• Google Play (Google): in-app purchases (subscriptions and additional purchases) and purchase verification (we check the purchase token, order ID, and product ID)
• Stripe: management of subscriptions previously purchased on the web (no new sign-ups are accepted)
• Firebase (Google): push notifications
• ElevenLabs: text-to-speech

4. Storage and Protection

4-1. What we store on our servers: your request text

When you ask the Service to create or change an app, the request text you typed is stored on our servers (Cloudflare Workers KV). We use it for two things:

• Running your request and showing progress: displaying status, resuming after an app restart, and the "run again" action.
• Improving the Service: analysing which ways of phrasing a request succeed and which do not, so that more requests succeed. We give this back to you as the "what did not work and what did" section of your weekly report.

Before storing it, we automatically replace strings that look like API keys or tokens (values beginning with sk-, ghp_ or AIza, JWTs, private key blocks, api_key=... assignments and similar). This masking is best effort and we do not guarantee that it catches every secret. Please do not type passwords, API keys or personal information into your requests.

4-2. What we do not store: your source code

We do not store the source code of your repositories on our servers. Code is read from GitHub and held in memory only while a request is being processed, and is gone once processing ends. What we persist is the paths of changed files and a summary of the result — not the contents of the code. (Only the built APK is kept, for up to 7 days, so that you can download it; it is then deleted automatically.)

4-3. Report storage

When you create a weekly or monthly report, its HTML is stored privately in our storage (Cloudflare R2). The report includes parts of the request text you typed (with the masking described above applied). Viewing it requires signing in, and you can only see your own reports. It is retained for 90 days and then deleted automatically. It is not committed to your repository. This runs only when you tap the button in the app; it never runs automatically.

4-4. Transmission for AI processing

• What is sent: to perform AI analysis and changes, your request and fragments of the target files are sent to Cloudflare Workers and third-party AI services such as the Anthropic Claude API (see Section 3). Their handling of that content is governed by their own privacy policies.
• Not stored in the app: our own secrets, such as API keys, are held only inside Cloudflare Workers and are never stored in the app.
• All communication is encrypted with HTTPS (TLS).
• The chat history shown in the app is also stored locally on your device and is cleared when you sign out.

5. Retention

Request text is kept for the following periods depending on what it is used for, and is deleted automatically when the period ends.

• Account information: kept until you delete your account
• Usage data (plan limit counters): retained as needed to manage plan limits. Paid plan allowances renew every month from the subscription date; Free AI agent fixes are counted in total
• Purchase records (purchase token, order ID, product ID, status, expiry, units granted, timestamps): retained to prevent duplicate grants and fraudulent charges and to handle refunds. Retained after account deletion (see Section 6-4). We do not store card details
• Chat display history (on your device): kept until you reset it
• Built APK files: up to 7 days
• App version number: up to 180 days (deleted when you delete your account)
• Irreversible value used to detect re-registration: retained after account deletion (see Section 6-3)

6. What Happens When You Delete Your Account

When you delete your account, the following applies. Not everything is erased, so please read this section.

6-1. Deleted

• The request text you typed (every store listed in Section 5; as a rule, deleted immediately rather than waiting for its period to end. Before deleting a record, we verify that it belongs to you. Because of this, a record whose owner cannot be identified as you — for example because the record is corrupted — is left in place rather than deleted on the spot, so that another user's data is never deleted by mistake. Any record left this way is still deleted automatically within 30 days at most; nothing remains indefinitely)
• The weekly and monthly reports you created (the HTML stored in R2 is deleted)
• Account information, connected GitHub tokens, push notification tokens
• Usage counters and app settings
• The record of your app version number
• Auto-renewal of any paid plan is stopped immediately (including Google Play subscriptions; the remaining period is not refunded)

6-2. Anonymised, not deleted

• Execution history (result statistics): this is not deleted. It is converted into a form that cannot identify you and retained. What remains is whether a request succeeded or failed, the paths of changed files and processing time; the link to you is removed. We use it for aggregate quality improvement.
• In-app inquiries and your ratings of fix results: the text you wrote is retained with the link to your account removed. We use it to improve the service.
• Improvement candidate records (proposal titles and size estimates): retained with the link to your account removed.

Please check whether you have used the report feature before deleting your account.

6-3. Retained after deletion (a value that cannot be reversed)

After account deletion we retain only a one-way, irreversible transformation of your external provider (GitHub / GitLab) account identifier, solely to detect re-registration by the same account. This value cannot be used to identify you, your account, or your email address. Your name, email address, repository information and other personal data are deleted when you delete your account.

6-4. Retained after deletion (transaction records)

Purchase records (purchase token, order ID, product ID, status, expiry, units granted, timestamps) are retained after account deletion to prevent duplicate grants and fraudulent charges and to handle refunds. We also keep a record of the deletion itself (request and completion times, and, if you subscribed on the web, the contract IDs at the payment provider) for refunds and accounting. We do not store card details (payments are processed by Google Play or Stripe).

7. Your Rights

You may:

• Request disclosure of the data we hold about you
• Request correction or deletion of that data
• Delete your account (which deletes the associated data as described in Section 5)
• Withdraw consent to processing

8. Contact

For questions about this Privacy Policy, please contact us at the address shown on the Service.