Privacy

If you have an account

Sign-in is handled by Clerk, a separate company. We keep the identifier Clerk gives us, your email address, and your name in our database, so we can tell your rooms apart from everyone else's and know who to bill. We never see your password. Clerk uses its own cookies to keep you signed in.

If you joined from a link

Guests do not have accounts. When you open an invite link we make up a random identifier and a display name — yours to change — and keep both in a cookie on your device for 30 days, so you are still the same person when you refresh. A second small cookie remembers that you have already been asked for a name.

That identifier and name also go into the room's member list, and onto any prompt you send, so the room remembers who asked for what. Your name is visible to everyone in the room, and anything you type there is treated exactly like a signed-in member's — including the next section.

Children

Coform is a tool for building software. It is not aimed at children, and nothing here is designed for them. We do not ask anyone's age, so we do not knowingly hold information belonging to a child — whether they made an account or opened a room link somebody sent them.

If you believe a child has given us something, email office@usefrontierdigital.com and we will delete it. That is the same procedure as deleting an account, described further down, and it does not require you to have one.

What you type is sent to an AI company

This is the disclosure that matters most. To build anything, we send the prompt, the room's recent conversation — with the names people go by in the room — and the project's files to the outside company whose AI model writes the code. We do not name that company here, and that is a deliberate choice rather than an oversight: which model builds your app is the part of how this works that we keep to ourselves. What they do with what they receive is covered by their privacy policy, not this one. If you need to know who it is before you type anything into a room, ask and we will tell you.

There is no way to build without this, so if you would not hand something to an AI company, do not type it into a room.

What your room makes

The prompts everyone writes, the conversation, and the code the AI produces are all stored so the room still exists tomorrow. Everyone in the room can see all of it — that is the point of the product — and so can anyone an invite link is forwarded to. Nobody else can, unless the owner publishes the app. Who is typing and where their cursor sits is shared live but not stored.

Each build is also archived as a version you can step back to. Free rooms keep the last 5; older archives are deleted, not just hidden. Paid rooms keep all of them.

The text of a prompt is kept for 180 days. After that a nightly job blanks it, and what remains is that a build happened, when, who asked for it and what it cost — the record we need to bill and to run the service, with the writing taken out. The room's own conversation and its archived versions are not affected; those go when the room does.

Who else is involved

Coform is assembled from a few outside services. Each one is a separate company with its own privacy policy, and each receives only the part of your data its job needs:

• Vercel — hosting. Every request to this site reaches their servers, which means your IP address and the headers your browser sends.
• Clerk — sign-in. Holds your email, your name, and how you prove you are you.
• Neon — our database. Accounts, rooms, who is in them, every prompt and who sent it, version records, and build balances.
• Cloudflare — the live room. The conversation, the shared draft, and the current state of the files.
• A model provider — writes the code. Receives prompts, conversation, and files, as described above.
• E2B — the sandbox where the app being built actually runs and is previewed.
• Cloudflare R2 — the archived copy of each version, and published sites.
• Stripe — payments. Your card details go directly to Stripe and never pass through us; we send them your email and name and keep a reference to your subscription.
• Resend — email. Receives the address and the message whenever a published app tells somebody that a form on it was filled in.
• PostHog — product analytics, and only if it is switched on for this deployment. Receives which pages you opened and a handful of named steps — reaching the access gate, making a room, sending a request, publishing a site — each with your user id once you are signed in. It does not receive what you typed, what was built, your name or your email. Session recording is off, and so is the automatic capture of clicks and form values.
• GitHub — only if you connect it. Receives the code of the app you built, pushed one way to a repository you name.

That list is everything. The app contains no advertising, and nothing in it shares your information with anyone beyond the services above. The one analytics tool is named in that list rather than left to be discovered: it counts steps, not people, and it is never sent the contents of a room.

Publishing

Publishing puts your app on a public address that anyone on the internet can open. Only the owner of a room can do this, it never happens automatically, and taking the site down removes the files.

If you used an app somebody built here

This part is for people who have never been in a room. Published apps are made by the people whose rooms they came out of, and run on our machines. Two quite different things can happen to what you type into one, and the page cannot show you which is which, so it is written down here.

Who is answerable for it is the person whose app it is, not us. They decided to collect it and they decide what happens to it; we store it for them and do as they ask. So the first place to take anything about it is whoever runs the page you were on. There is a shorter version of this section written for you rather than for them, and every form built here links to it.

Whatever the app saves as part of what it shows everybody — a tally, a schedule, which seats have gone — is kept in the open. Anyone with the link can read it and anyone with the link can change it. Whatever you send through a form goes somewhere else entirely: a mailbox that cannot be read from the page at all. That arrives back in the room the app was built in, and the people who build there read it. A view-only link does not open it.

A form holds its most recent 500 submissions and lets older ones go as new ones arrive. Everything an app collected is deleted with its room, and the room's owner can empty a form whenever they like.

You can also take back what you sent, without an account and without asking anybody. When an app emails you a confirmation, that email carries a link that deletes everything you submitted to that app from that address and stops it writing to you again. Holding the link is the whole of the proof it needs, because it arrived in your inbox and nowhere else — which is also why it destroys and never shows you anything. If you did not get a confirmation, or the link has expired, the people running the app can remove it.

An app can send email. It can tell the room that something arrived, and it can write back to you — but only at an address you typed into it yourself, only for 90 days after you typed it, and never to anybody else. What it says is the app's to decide.

If an app keeps something that is yours — a booking to come back to, a list only you can see — it does that without an account by having your browser hold a long random key and send it along. We keep only a fingerprint of that key and never the key itself, so holding it is the whole of being you here: anyone who has it sees what it holds, and losing it loses them. When an app emails you a way back to your own things, the key is in that link.

If an app takes a payment, it does so through a Stripe account the room's owner connected themselves. The charge is on their account and the money goes to them. We never hold it and never see your card, and all the app is told afterwards is whether the payment went through and for how much.

If what you paid for is a number to wait for, we keep one small record of it: the reference Stripe gave that payment and the number it was handed, so that reloading the page you landed on shows you the same number instead of giving you a second ticket. It holds nothing you typed, and no name, card or address — but the reference is Stripe's own, so the people you paid can look you up from it on their own account. We delete our copy 30 days after the payment.

Deleting things

Deleting a room deletes its conversation, its archived versions, its sandbox, its published site, and everything that site collected. That happens immediately and cannot be undone. Rooms nobody has opened in 7 days have their sandbox shut down to save resources; the archived versions stay, so the room can still be restored.

There is no button for deleting your whole account yet, and doing it by hand is a real procedure rather than a promise: the subscription is cancelled first, then every room you own is taken down exactly as deleting one takes it down, and then the account and everything hanging off it goes. Email office@usefrontierdigital.com and it will be done by hand.

Changes

If this changes in a way that matters, we will say so here and update the date at the top rather than changing it quietly.