Terms & Privacy

Webzy turns a written or spoken description into a working web application. OpenAI's Astra drafts each change, then reviews and revises it in a separate pass before Webzy applies it to the project. You can follow the progress and preview the reviewed result, then keep talking to it, click elements on the page to change them, edit the source by hand, restore an earlier checkpoint, or deploy the result to a public URL.

The applications Webzy produces are ordinary Vite + React projects using plain JavaScript and Tailwind CSS. There is no Webzy runtime inside them and no proprietary framework — the only Webzy-specific file is a small bridge script that powers click-to-edit inside the preview, which is stripped from any export.

Webzy is operated as a hosted service. Using it requires an account.

You can sign up with an email address and password, with a one-time magic link, or through GitHub or Google. When you sign up we create a profile record holding your user id, email address, and — if your identity provider supplies them — your display name and avatar URL.

You are responsible for what you generate through your account. Do not use Webzy to build anything unlawful, to impersonate another person or organisation, to produce material that targets or harasses a private individual, or to attempt to extract other users' data.

We may suspend an account that is being used for those things. Where practical we will tell you why.

Your prompts and code you bring to Webzy remain yours. Generated output can resemble work generated for other users; ownership does not guarantee originality or remove third-party licence obligations. The Terms of Service explain these rights.

Two things are always yours regardless of plan. The first is your input — the prompts you write, the images you attach, and any code you type into the editor yourself. The second is anything you brought with you. Webzy claims nothing over those.

Webzy also claims nothing over the open-source software the generated projects depend on. React, Vite, Tailwind and the rest remain under their own licences, which travel with the code.

Projects deployed on the Free plan carry a small “Built with Webzy” badge in the corner of the running application, linking back to this site. It is part of the Free plan's terms rather than a decoration.

Removing, hiding, obscuring, or programmatically suppressing the badge while on the Free plan is a breach of these terms under the Free plan. This branding requirement does not change your ownership of the generated code.

Paid plans let you remove the watermark in project settings. Existing deployments may need to be published again to reflect that change.

Webzy stores the following for your account. Account access controls apply, and the providers described below process data needed to run the service:

• Profile — user id, email, display name, avatar URL, plan.
• Projects — name, slug, description, template, timestamps, and whether the project is public.
• Files — the full current source of every project.
• Messages — every prompt you send and every reply, including attached images and element selections, the model used, and token counts.
• Checkpoints — a complete snapshot of the file tree after each generation, so any turn can be restored.
• Skills — the reusable instruction blocks you write.
• Settings — theme, reasoning effort, voice preferences, editor font size.
• Deployments — the URL and status of each deploy.
• Connectors — which third-party services you have connected, plus the encrypted credential itself.

Project data uses owner-scoped database policies alongside server-side identity and ownership checks.

We do not sell your data, and we do not use your prompts or generated code to train models.

Each AI-generated change uses OpenAI for drafting, review and revision. OpenAI receives the project files, instructions and relevant conversation context needed for those stages, including your prompt and any supplied attachments or element selection. A separate review pass receives the draft. Webzy applies the reviewed result after that sequence completes; review can still miss errors.

This means your project source leaves our infrastructure during generation. If a project contains a secret, that secret is included. Do not paste production credentials into generated files — use the connectors feature, which is designed for exactly this.

Provider data retention and abuse monitoring policies apply; Webzy does not promise zero retention. Optional dictation uses your browser's speech recognition service, which may send audio to its provider. Webzy receives the resulting text. The Privacy Policy lists the processors used for generation, assets and hosting.

When you connect a third-party service — GitHub, Supabase, Vercel, Stripe, Resend, or a Postgres database — the secret you paste is encrypted with AES-256-GCM before it is written to the database.

The column holding that ciphertext has read access revoked from the browser-facing database roles entirely. The browser can write a credential; it cannot read one back, even for your own account. Decryption happens server-side, only at the moment a credential is actually needed — for example when deploying to Vercel with your own token.

Non-secret configuration you supply alongside a credential, such as a team id or project URL, is stored in the clear.

Deploying sends your project files to Vercel, which builds and hosts the result at a public URL. Anything at that URL is visible to anyone who has it.

If you have connected your own Vercel account, the deployment is created under it and is yours to manage or delete. If you have not, it is created under Webzy's account, and we may remove deployments that are abandoned, that breach these terms, or that consume disproportionate resources.

Webzy uses Supabase Auth cookies to keep you signed in. Authentication and payment services may use cookies needed for their features. Webzy does not run third-party advertising trackers.

Your browser also holds a small amount of local state, such as your theme preference.

Project source-code downloads from the code panel require an active Pro plan or higher. Ownership of generated output applies on every plan, subject to the terms above.

Deleting a project removes its saved files, messages, checkpoints, and deployment records from Webzy. Export anything you want to keep first. Published deployments and copies sent to third-party services have their own deletion and retention processes. Settings contains a control to delete every project at once.

To delete your account entirely, or to request a copy of what we hold about you, contact us and we will action it. Depending on where you live you may have additional statutory rights over your personal data, including rights of access, correction, portability, and erasure.

Project data is protected by owner-scoped database policies and server-side access checks. Connected credentials are encrypted at rest and excluded from browser-facing responses.

The preview includes a bridge for selecting and editing elements. It is removed from exported and published projects. AI-generated code still needs testing before use.

No system is perfect. If you find a vulnerability, please report it rather than exercising it, and give us a reasonable chance to fix it before disclosing.

We may update these terms. When a change materially affects your rights — particularly anything about ownership, watermarks, or pricing — we will notify account holders before it takes effect. The date at the top always reflects the current version.

Questions about any of this, including data requests, go to legal@webzy.online.