Privacy Policy

Last updated 16 October 2026.

Setherion builds and hosts web applications from written instructions. This policy explains who is responsible for your personal data, what we hold and why, who else handles it, how long we keep it, and what you can ask of us. It is written to be read. The company responsible, and how to reach it, are at the end.

Two different roles

When you use Setherion to build, we decide how your account data is handled. We are the controller, and this policy governs it.

When people use an application you published here, you decide what that application collects and why. You are the controller of their data, and we process it on your behalf, under the data processing terms in our Terms of Service. You are responsible for telling those people what you collect, in your own privacy policy. What we hold for your apps is listed below, under Your apps' visitors.

What we hold, and why

For each kind of data, the reason we hold it and the legal basis for that under the GDPR (and the UK GDPR):

• Your account. Your email address, the sign-in methods you connect (email and password, Google, GitHub, Apple) and, if you turn it on, your two-step sign-in. We never see your password: it is stored hashed by our authentication provider. Basis: the contract with you.
• The devices you sign in on. For each sign-in, the browser it came from, its IP address and when it was last used, which you can see and end in Settings, Security. Basis: our legitimate interest in keeping your account secure.
• Your profile. Display name, handle, avatar, cover image and bio, if you fill them in. You choose whether your profile is public. Basis: the contract.
• What you build. Your instructions and chat, the files you upload, the code generated for you, earlier versions of each project, and preview screenshots. A voice message you dictate is sent to be turned into text and is not kept by us. Basis: the contract.
• Payments. Your plan, your credit balance and the history of credits spent and added, and the identifiers our payment provider gives your account. Card details go to Stripe directly; we never see or store your card number. Basis: the contract, and our legal obligation to keep accounting records.
• Support. What you write to us, anything you attach, your email address, and the page and browser you wrote from, so we can reproduce the problem. Basis: the contract, or our legitimate interest in answering people who write to us without an account.
• Emails. Your choices in Settings, Preferences, Emails: warnings before a limit (on unless you turn them off) and news (off unless you turn it on). Basis: the contract for warnings; your consent for news, which you can withdraw there at any time.
• Workspaces. The people you invite and their roles, and a log of what members did in a workspace, for its admins. Basis: the contract.
• Connections. Access tokens for services you connect, such as GitHub, Figma, Google or Microsoft. They are encrypted before storage and never sent to your browser. Basis: the contract.
• The Telegram bot. If you link it: your Telegram chat id, username and the messages you send it. Basis: the contract.
• Questions to Setherion AI in the docs. The question, the page you were on, whether the documentation held the answer, and your thumbs up or down. Kept for ninety days, without your name or account. Basis: our legitimate interest in improving the documentation.
• The waitlist. If you join it before Setherion opens: your email address, the day you joined, and where the link came from, such as Reddit. We use it to tell you that you are on the list and, once, that Setherion is open. Nothing else. Every one of those emails has a link that takes you off the list. Basis: your consent.
• Security and abuse. Counters that enforce our usage limits, some of them keyed by IP address, and the result of the bot check on our open forms. Basis: our legitimate interest in keeping the service available and safe.

We do not sell your data, we do not use it for advertising, and nothing about you is decided by automated means in a way that has legal or similarly significant effects on you.

Who else handles it

Setherion runs on other companies' services. These are all of them, and what each receives:

• Supabase: accounts, sign-in, the database and file storage.
• Vercel: hosting the Setherion website and connecting custom domains to published apps.
• Cloudflare: storage and delivery of published apps, media and project versions; the bot check on sign-up, sign-in, the waitlist and the support form; screenshots of published apps for app store listings.
• Stripe: payments, invoices and receipts, and the billing portal. It receives your email address and what you buy.
• Resend: the emails we send you (confirmation, password reset, support replies, warnings, news) and the emails your published apps send.
• Anthropic, OpenAI and Google: the AI models that turn your instructions into code, answer in the chat and in the docs, read the documents and images you attach, and, at OpenAI, turn a dictated voice message into text.
• fal.ai: generating images, video and game art when you ask for them. It receives the description.
• Pixabay: stock photos. It receives the search words, never who you are.
• thum.io: preview pictures of published apps on public profiles. It receives the app's public address.
• Telegram: only if you link the Setherion bot.
• Services you connect yourself, such as GitHub or Figma, receive what the feature you use sends them, under their own terms.

Some of these companies process data outside the European Economic Area and the UK, mainly in the United States. Where they do, the transfer is covered by the EU-US Data Privacy Framework where the company is certified under it, or by the European Commission's Standard Contractual Clauses (with the UK addendum). You can ask us for a copy of the safeguards that apply.

What the AI providers see

To build anything, your instructions and the relevant parts of your project have to reach a model. We send them over the providers' business APIs, under terms that do not permit your content to be used to train their models. We do not use your projects to train anything of our own either.

Cookies and storage in your browser

Setherion uses only what it needs to work. There are no advertising cookies and no analytics or tracking cookies on the Setherion website, so there is nothing to consent to.

• Sign-in cookies (named sb- and a project id): keep you signed in, until you sign out.
• Sign-in with another service: a short cookie that protects the step where you come back from Google, GitHub or a connected service. It lasts ten minutes or less.
• Before launch: a cookie that lets people we invited past the coming-soon page, for 30 days.
• Private apps: a cookie that remembers you were let into a private published app, for 8 hours.
• Your browser's storage keeps preferences such as the last sign-in method, the workspace and model you picked, and editor settings. It stays on your device.

The bot check (Cloudflare Turnstile) sees your IP address and browser characteristics for that check only. It does not track you across sites.

Your apps' visitors

For apps you publish, we store on your behalf, and only for you:

• visit statistics: the page, where the visitor came from, their country, device and operating system, and a random visitor number kept in their browser. No IP address is stored;
• errors the app reports, so you can fix them;
• the accounts of people who sign in to your app (email address and a hashed password), and what your app saves for them;
• messages sent through your app's forms, game scores, and a record of the emails your app sends;
• a record of the AI requests your app makes through your own keys, without their content.

If you connect Google Analytics to an app, its visitors' data goes to Google under your own agreement with Google.

How long we keep it

• Your account and projects: for as long as you have the account.
• Projects you delete: in your trash for 30 days, so a mistake can be undone, then gone.
• Files in your Assets: until you delete them or close your account. Deleting a project does not delete the files it used.
• Project versions: the 30 most recent of each project, plus those you name or mark.
• The working record of each build: its files after 7 days, the record itself after 90 days.
• Docs questions and your apps' email records and AI request records: 90 days.
• Your apps' error reports: 30 days. Visit statistics: 200 days.
• Workspace activity logs: 13 months.
• Support conversations: kept after they close, so we can see what happened before if you write again. Ask us and we delete yours.
• Payment and credit records: for as long as Romanian accounting and tax law requires, up to 10 years.
• The waitlist: until Setherion opens and we have told you, or until you take yourself off it.
• Counters for usage limits, including those keyed by IP address: 8 days.

Deleting your account

Deleting your account, which you can do at any time in Settings, Account, cancels any paid plan, takes your published apps offline, and removes your projects with their saved versions, what your apps hold about their visitors, your profile, uploads, connections, API keys, workspaces you own and your sign-in. It cannot be undone, so you may want to use Download your data first. Emptying a project from the trash removes the same for that one app.

Some records stay where the law requires them or where they no longer identify you: payment and credit records, support conversations, workspace activity logs with your name taken out, Stripe's own records, and daily usage counts per app, which hold no one's details.

Your rights

Under the GDPR and the UK GDPR you can ask us to:

• tell you what we hold about you and give you a copy. Most of it you can download yourself, in Settings, Account, Download your data;
• correct anything that is wrong;
• delete it;
• limit what we do with it while a question about it is settled;
• give it to you, or another service, in a machine-readable form;
• stop using it where we rely on our legitimate interests;
• and, where we rely on your consent, you can withdraw it at any time, without affecting what was done before.

Write to support@setherion.com from the address on your account. We answer within one month, and tell you if we need longer. We may ask you to confirm it is you.

You can also complain to a data protection authority. In Romania that is the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (dataprotection.ro); in the UK, the Information Commissioner's Office (ico.org.uk); elsewhere in the European Economic Area, the authority where you live or work. We would rather hear from you first, so we can put it right.

Security

Everything travels encrypted. Passwords are hashed, and access tokens for connected services are encrypted before they are stored. Two-step sign-in is available to every account, and you can see and end your signed-in devices. Access to our systems is limited to the people who need it to run the service. If a breach puts your data at risk, we will tell you and the authority as the law requires.

Children

Setherion is not meant for anyone under 16, and we do not knowingly hold their data. If you think a child has given us data, write to us and we will delete it.

Changes

If this policy changes in a way that matters, we will tell you by email before it takes effect rather than quietly editing this page. The date at the top says when it last changed.

Who we are, and how to reach us

Setherion is run by NETIXDAV SRL, a company registered in Romania, which is the controller of the personal data described here. Write to support@setherion.com about anything in this policy and a person will answer. We have not appointed a data protection officer, as the law does not require one for us.