Privacy Notice
1. Controller
Fier-Forge is operated by Alaimo Aleandro, Grabenstrasse 6, 45888 Gelsenkirchen, Germany. Contact: support@fier-app.de.
2. What we process
- Google account data: name, email address, profile picture and Google account identifier, used only to sign you in and display your profile.
- Project data: the apps you create, their files, chat messages, settings, legal data you enter and export archives, stored to provide the service.
- AI provider credentials: API keys you connect, encrypted at rest with AES-256-GCM. They are never returned to the browser and are used only to call the provider you selected.
- Usage metadata: provider, model, token counts, request status and optional cost estimates, used to show your counters and prevent abuse.
- Technical data: session cookies, IP-derived identifiers, user agent, timestamps and security logs needed to operate and protect the service.
3. Purposes and legal bases
We process data to perform the contract with you (Art. 6(1)(b) GDPR), to secure the service and prevent abuse (Art. 6(1)(f) GDPR), and to comply with legal obligations (Art. 6(1)(c) GDPR). Where consent is required for optional push notifications, you may withdraw it at any time in Settings.
4. AI providers and third parties
When you generate an app, the prompt and relevant project context are sent from our Worker to the AI provider you configured, using your key. That provider processes the data under its own terms and privacy policy. We do not operate a shared AI account and do not resell tokens. Hosting, database, storage and security services are provided by Cloudflare. Google provides sign-in. If you configure email or payment providers for a generated app, those providers are selected by you.
5. Retention
Account and project data are kept while your account is active. When you delete your account, projects, files, messages, provider keys, notifications and usage history are deleted. Security audit metadata may be retained where required by law or for the establishment, exercise or defence of legal claims. Provider usage metadata is kept for up to 180 days. Push subscriptions inactive for 30 days are removed.
6. Your rights
You have the right to access, correct, export and delete your data, to restrict or object to processing, and to lodge a complaint with a supervisory authority. You can export your data and delete your account from Settings, or contact us at the address above.
7. International transfers
Cloudflare and the AI provider you choose may process data outside the EU/EEA. Transfers rely on the safeguards offered by those providers (for example standard contractual clauses) and their applicable data processing terms.
8. Security
Traffic is encrypted with HTTPS/HSTS. Session tokens are stored as hashes in HttpOnly cookies. Provider keys and integration secrets are encrypted at rest. Access to projects is scoped to the signed-in user and enforced server-side. No system is perfectly secure; report a suspected issue to the contact above.
9. No sale of data
We do not sell personal data and do not use it for advertising. We do not use your prompts or generated code to train models.