Terms & Privacy

Webzy turns a written or spoken description into a working web application. You describe what you want, a large language model writes the source files, and those files are bundled in your browser so you can see the result immediately. You can then keep talking to it, click elements on the page to change them, edit the source by hand, restore an earlier checkpoint, or deploy the result to a public URL.

The applications Webzy produces are ordinary Vite + React projects using plain JavaScript and Tailwind CSS. There is no Webzy runtime inside them and no proprietary framework — the only Webzy-specific file is a small bridge script that powers click-to-edit inside the preview, which is stripped from any export.

Webzy is operated as a hosted service. Using it requires an account.

You can sign up with an email address and password, with a one-time magic link, or through GitHub or Google. When you sign up we create a profile record holding your user id, email address, and — if your identity provider supplies them — your display name and avatar URL.

You are responsible for what you generate through your account. Do not use Webzy to build anything unlawful, to impersonate another person or organisation, to produce material that targets or harasses a private individual, or to attempt to extract other users' data.

We may suspend an account that is being used for those things. Where practical we will tell you why.

When you purchase a Premium subscription, ownership of the output transfers to you. That transfer covers everything generated on your account, including work produced earlier while you were on the Free plan, and it survives cancellation: code you owned at the end of a paid period stays yours.

Two things are always yours regardless of plan. The first is your input — the prompts you write, the images you attach, and any code you type into the editor yourself. The second is anything you brought with you. Webzy claims nothing over those.

Webzy also claims nothing over the open-source software the generated projects depend on. React, Vite, Tailwind and the rest remain under their own licences, which travel with the code.

Projects deployed on the Free plan carry a small “Built with Webzy” badge in the corner of the running application, linking back to this site. It is part of the Free plan's terms rather than a decoration.

Removing, hiding, obscuring, or programmatically suppressing the badge while on the Free plan is a breach of these terms and, because the underlying code is not yours on that plan, also a breach of the licence above.

Premium removes the watermark from all of your deployments, including ones published before you upgraded.

Webzy stores the following, all of it scoped to your account and readable only by you:

• Profile — user id, email, display name, avatar URL, plan.
• Projects — name, slug, description, template, timestamps, and whether the project is public.
• Files — the full current source of every project.
• Messages — every prompt you send and every reply, including attached images and element selections, the model used, and token counts.
• Checkpoints — a complete snapshot of the file tree after each generation, so any turn can be restored.
• Skills — the reusable instruction blocks you write.
• Settings — theme, default model, reasoning effort, voice preferences, editor font size.
• Deployments — the URL and status of each deploy.
• Connectors — which third-party services you have connected, plus the encrypted credential itself.

Every one of these tables has row-level security enabled with owner-scoped policies, enforced by the database rather than by application code.

We do not sell your data, and we do not use your prompts or generated code to train models.

To generate or change an application, Webzy sends the following to Anthropic's API: a fixed system prompt, any skills you have enabled, the current contents of your project files, a trimmed history of the conversation, and your new message together with any attached image or selected element.

This means your project source leaves our infrastructure on every turn. If a project contains a secret, that secret is included. Do not paste production credentials into generated files — use the connectors feature, which is designed for exactly this.

Anthropic's handling of that data is governed by their own terms. Voice input is different: dictation uses your browser's built-in speech recognition, and only the resulting text is sent anywhere.

When you connect a third-party service — GitHub, Supabase, Vercel, Stripe, Resend, OpenAI, Anthropic, or a Postgres database — the secret you paste is encrypted with AES-256-GCM before it is written to the database.

The column holding that ciphertext has read access revoked from the browser-facing database roles entirely. The browser can write a credential; it cannot read one back, even for your own account. Decryption happens server-side, only at the moment a credential is actually needed — for example when deploying to Vercel with your own token.

Non-secret configuration you supply alongside a credential, such as a team id or project URL, is stored in the clear.

Deploying sends your project files to Vercel, which builds and hosts the result at a public URL. Anything at that URL is visible to anyone who has it.

If you have connected your own Vercel account, the deployment is created under it and is yours to manage or delete. If you have not, it is created under Webzy's account, and we may remove deployments that are abandoned, that breach these terms, or that consume disproportionate resources.

Webzy sets cookies for one purpose: keeping you signed in. These are set by Supabase Auth, are required for the service to function, and are refreshed as you browse. There are no advertising cookies and no third-party trackers.

Your browser also holds a small amount of local state, such as your theme preference.

You can export any project as a standard Vite application from the code panel at any time, on any plan — subject to the ownership terms above.

Deleting a project permanently removes its files, messages, checkpoints, and deployment records; this cascades in the database and cannot be undone. Settings contains a control to delete every project at once.

To delete your account entirely, or to request a copy of what we hold about you, contact us and we will action it. Depending on where you live you may have additional statutory rights over your personal data, including rights of access, correction, portability, and erasure.

Every table is protected by row-level security with owner-scoped policies. Ownership checks run through a security-definer helper so policies cannot recurse, and the trigger-only database functions have their remote-procedure surface revoked.

The click-to-edit bridge injected into previews only ever posts element metadata — a selector, computed styles, and geometry — to the parent window. It never receives or evaluates code.

No system is perfect. If you find a vulnerability, please report it rather than exercising it, and give us a reasonable chance to fix it before disclosing.

We may update these terms. When a change materially affects your rights — particularly anything about ownership, watermarks, or pricing — we will notify account holders before it takes effect. The date at the top always reflects the current version.

Questions about any of this, including data requests, go to legal@webzy.online.