Privacy Policy

Last updated: October 2026

The short version

Nothing you have to sign in to in order to use the editor, the templates or the exporter, and no profile or saved history. The sites you build stay in your own browser until you export them. If you buy a pack of generations we do keep a short record of it, because otherwise we could not give you what you paid for: the account number of the Google or GitHub account you sign in with and how many sites are left on it. No email, no name and no card. That record lives in a key-value store, it is the only thing we hold about anybody, and it is deleted on request.

What we collect

Your sections, copy, colours, uploaded video and audio are held in your browser's local storage (IndexedDB) on your own device. Nothing there is sent anywhere on its own.

Six things can leave your browser. Four of them carry nothing that identifies you; the other two are named as such below:

• Export requests. When you export, the section text and settings are sent to our server so it can build the HTML, and returned to you. They are not written to any database or log.
• Rewrite requests, only if you ask for one. The editor can rewrite your copy from an instruction you type. Doing so sends that instruction and the section text to Sarvam AI, which returns the rewritten words. Nothing is sent unless you press Rewrite, and this instance only offers the button when it is configured with a key. The request is not written to any database or log.
• Four counts, so we can tell whether this works.Vercel Web Analytics, and a counter of our own, record how many people open the editor, make a first edit, start an export and finish one, plus which catalogue template was opened and how many seconds an export took. Our counter keeps only a running total per day, in the same Upstash store used for rate limiting. That is the whole list. Your headings, body copy, site name, custom CSS and uploads are never part of it, and a site you named yourself is counted only as "custom".
• Writing a site from a description, only if you ask for one. On the home page or the Describe page, the words you write and any photographs or document (such as a PDF menu or resume) you attach are sent to Anthropic, which writes the site and returns it. Photographs are reduced to 1024 pixels on your own device first. None of these are stored by us: they are sent once, used to write that site, and not kept. A video you attach never leaves your device: its frames are taken in your browser and kept there as the background. Nothing is sent unless you press the button to write the site, and this instance only offers it when it is configured with a key.
• A purchase, only if you buy more sites. The first two sites are free. A pack of five is paid for on Dodo Payments' own page, so the card details, the name, the email and the billing address go to them and never to us. They tell us that a payment was made and which account it was for. We keep how many sites are left on that account, and nothing else about the purchase.
• Ordinary request logs. Our host records the usual server access logs, including IP addresses, which we also use to rate-limit the export, rewrite, counting, site-writing, licence and checkout endpoints so one visitor cannot exhaust them for everyone. Writing a site costs us real money per request, so that one is limited tightly: three a minute and twenty a day from one address.

Uploaded video is never sent anywhere. Frames are extracted from it inside your browser.

The Claude Code plugin runs on your own computer and sends nothing to ScrollCraft. The pages it builds load their typefaces from Google Fonts, as exports do.

Third-party services

• Vercel — hosting, and Web Analytics for the four counts above. Request logs may be retained under their policy.
• Sentry — error reports, when enabled. These carry a stack trace, not your content.
• Upstash — rate limiting and the daily counts above, when enabled. It stores a counter keyed by IP for limits, and counters keyed by date for the four steps.
• Anthropic — writes a site from your description, when enabled. It receives that description and any photographs or document you attach, and only when you ask for a site. It never receives videos.
• Google: sign-in, if you choose it. Google tells us your account number, your name, your email address and your profile picture; we keep only the number, and we keep it so your credits can find you in another browser. We never ask for access to your Gmail, Drive, contacts or anything else.
• GitHub: sign-in, if you choose it. GitHub tells us your account number, your username, your email address and your avatar; we keep only the number, and we keep it so your credits can find you in another browser. We never ask them for your repositories or anything else.
• Dodo Payments — the merchant of record for a pack of sites, when the shop is enabled. You pay on their page, so they receive your card, email and billing details directly and we do not. They tell us only that a payment succeeded and which account to credit.
• Sarvam AI — the rewrite assistant, when enabled. It receives the instruction you type and the copy of the site you are editing, and only when you press Rewrite.
• Google Fonts — templates load webfonts, which discloses your IP to Google. Exported sites do the same unless you self-host the fonts.

Cookies

Two, both around the site writer and neither readable by scripts: a random name for this browser, so your free sites are yours rather than shared with everybody on the same network, and, if you buy a pack, the hash of your licence key so this browser can spend what you paid for. A third is set only while you are signed in, and holds the signed session. No advertising or analytics cookies are used. See our Cookie Policy.

Your rights

If you never signed in, there is no account to delete and nothing of yours for us to hold. If you did, what we hold is the account number of the Google or GitHub account you sign in with and how many of your paid sites are left; email hs1663531@gmail.comand it is deleted, along with any unused credits. To remove what ScrollCraft has stored on your device, clear this site's data in your browser — that erases every unexported site, so export anything you want to keep first.

Contact

Questions? Email hs1663531@gmail.com.