Privacy

Last updated 1 November 2026.

このページは英語で提供されています。日本語でのご質問は お問い合わせページ からお願いします。

freebuild is a small tool for building and editing code with an AI agent. The web builder is ad-supported; Freebuild Terminal is a paid subscription. This page explains what the service stores and why. It is a plain description of the current implementation, not legal advice.

What we collect

• Terminal account. Terminal buyers sign in with an email magic link. We store the normalized email address, a hash of the single-use sign-in token, an expiry time, and a signed session cookie. The magic link itself is emailed and is not stored in readable form.
• Terminal license and billing. We store the license key, its plan and status, the install identifier reported by the terminal, the Stripe customer and subscription identifiers, and the subscription status Stripe sends us. The key is a bearer credential used to meter usage and to cut off access when a subscription ends.
• Broker usage. Each request through the broker records the license, model name, prompt and completion token counts, whether the response was streamed, the status, and a timestamp. The prompt and generated text are not stored by the broker. Usage records are used for quota enforcement, abuse investigation, and sponsor reporting.
• Checkout and email. Stripe processes payment details; we do not receive or store card numbers. We send account and purchase emails through Resend, which receives the destination address and message.
• Sponsor panel. The terminal panel fetches sponsor content from this server. Those requests include the license and install identifier and may be logged with the time and result so impressions can be attributed.
• GitHub sign-in data. If you sign in, GitHub gives us an OAuth token and your public login. The token is stored in a signed, HttpOnly cookie and is used server-side to list, clone, and push repositories you choose.
• Repository and workspace content. We clone repositories you select and store the agent's edits on the server so you can preview, download, push, or open a pull request. Guest app files are also stored.
• Prompts and results. The prompt you submit and the agent's output are kept with the job so the result can be shown to you. Completed queue results are kept for about two hours.
• Network data. We use the request IP address to enforce daily task and new-workspace limits. The limiter stores a keyed hash of the address, not the raw address. The web server may keep short-lived access logs.
• Contact messages. If you use the contact form, we store your name (optional), reply email (optional), topic, message, a keyed hash of the IP address used to send it, and the time. We use this to reply and to limit spam. The destination address is kept on the server and is not shown on the page.
• Product notifications. If you ask to be notified when Freebuild is available for another coding agent, we store your email address, the agents you selected, a keyed hash of the IP address used to sign up, and the time. We send a confirmation email first and only send launch emails for the agents you confirmed. Every notification email includes an unsubscribe link.
• Page link emails. If you use the "On mobile?" form, we use the email address only to send that one page link. We do not store the address for this feature.
• Language detection. If your browser does not already prefer Japanese, the page may ask ipapi.co for your country code so it can choose Japanese by default. That request is made by your browser, includes your IP address, and the result is kept only in your browser session. freebuild does not store the result on its servers. The language selector overrides it.
• Ad data. The ad slots are served by Adsterra and HilltopAds. Those networks may set cookies or similar identifiers and receive standard request data such as IP address, user agent, and page URL. Their privacy policies apply to that processing.
• Analytics data. We use Google Analytics 4 (measurement ID G-K1W4DNJE60) to understand aggregate traffic: pages viewed, approximate location, device and browser type, and referral source. Google may set cookies such as _ga and _ga_*. Google's privacy policy applies to that processing.

How long we keep it

• Guest workspaces: about 7 days after last use.
• Repository workspaces: about 30 days after last use.
• Completed queue results: about 2 hours.
• Contact messages: about 90 days, unless needed to resolve an open request.
• Product notification requests: unconfirmed requests are removed after about 30 days; unsubscribed addresses after about 90 days; confirmed addresses are kept until the notification is sent or you unsubscribe.
• Broker usage records: about 90 days by default. Operators can change this window or keep records longer; pruning never restores or changes monthly quota.
• Account sign-in tokens: 15 minutes, single use. Account sessions: up to 30 days.
• License and subscription records: kept while the subscription is active and afterward for billing, tax, and dispute records.
• Daily limit counters: until the next UTC day; the state file is replaced.

Workspaces may be deleted sooner when the service is cleaned up or when you ask. A repository on GitHub is not deleted by freebuild.

Cookies

• fb_account: signed, HttpOnly account session for terminal buyers.
• fb_token: signed GitHub token for your session.
• fb_oauth_state: short-lived GitHub OAuth state value.
• fb_access: only present while the private preview code is enabled.
• Third-party ad cookies set by the ad networks.
• _ga and _ga_*: Google Analytics cookies.

What we do not do

We do not sell your personal data or use your repository content to train a model. We do not receive your card number. Google Analytics is used only for aggregate traffic measurement, not for ad targeting. Prompts and code are sent to the model provider only to perform the task you requested.

Your choices

You can sign out at any time. On /account you can reveal your own license key, rotate a stolen key without losing the remaining quota, and open the Stripe billing portal to cancel. Cancelling stops future charges; broker access continues until the end of the paid period. You can block Google Analytics with an ad blocker, a browser tracking-protection setting, or the Google Analytics opt-out add-on. To request deletion of a workspace, account, or usage history, or to ask a privacy question, use the contact page. If you are in a jurisdiction with a statutory privacy right, include enough detail for us to identify the workspace or account.

Children

freebuild is not intended for children under 13.

Changes

We may update this page as the service changes. The date at the top is the latest revision.