Security & privacy
What Alloy stores, how it is protected, and what you can do to keep your projects and customers safe.
What we store
| Data | Why | Protection |
|---|---|---|
| Account (name, email, sign-in method) | To sign you in | Passwords are hashed, never stored in plain text |
| Projects, versions and prompts | To show and revise your projects | Only visible to your account |
| Git access tokens | To push and import for linked projects | Encrypted at rest; used only for that project |
| Usage (counts and dates) | Quotas and the Usage page | No prompt content in usage logs |
| Payments | Handled by Lemon Squeezy | Alloy never sees card numbers |
How generated code is kept safe
- Secrets are never written into generated code; apps ship an
.env.exampleinstead. - The generated
.gitignoreexcludes.envfiles. - Repositories are created private by default.
- Live runs your project in an isolated browser sandbox, not on your machine.
Your part
- Do not paste passwords, API keys or customer data into prompts.
- Store production secrets in your host settings (Vercel, Netlify), not in the repository.
- Disconnect Git providers you no longer use from Manage Git and from the provider settings.
- Rotate a key immediately if you ever committed it by mistake.
AI and your data
Prompts and project files are sent to alloy-1.5flash only to generate and revise your project. We do not sell your data or use your private projects to build products for others.