Information under Art. 13 GDPR · last updated 14 September 2026
This deployment has not been configured with operator details, so it should be treated as an unpublished prototype. See the Impressum.
You write a description of what you want produced. That text is sent to a language model to be turned into a structured brief, and is stored with your project so you can come back to it.
If you attach a design, the file is stored on the server that runs this site. If you use dictation, your browser — not this site — sends the audio to its own speech service; this site receives only the text.
No analytics, no tracking, no advertising. The only cookie this site sets is the one that keeps you signed in, and it is only set once you sign in. That is why there is no cookie banner: there is nothing to ask you about.
Your email address and a hash of your password are stored. The password itself is never stored and cannot be recovered from the hash. Your projects then belong to you and stop being visible to anyone else.
The session cookie is technically necessary for signing in, so it rests on Art. 6(1)(b) GDPR — performing the service you asked for — rather than on consent.
A language model provider. Your project description is sent to OpenRouter, which routes it to a model provider. This can mean processing outside the EU, including in the United States. If that matters to you, do not put confidential or personal information into a project description.
The hosting provider. This site and its database run on Railway, which necessarily processes what is stored on it.
A tracing service, where the operator has switched it on. When configured, Langfuse records what each step of the agent received and returned, which includes your project text.
OpenStreetMap, only if you open the map. Searches for nearby businesses are made by this site’s server, so looking at the list sends nothing about you anywhere. The map is different: opening it makes your browser fetch tiles from OpenStreetMap, which means they see your IP address. It loads only when you ask for it, and the panel says so at that moment.
Fonts are served from this site rather than from Google, so simply opening a page contacts nobody but us.
It does not contact any company for you. When you choose to write to a partner, the message opens in your own email, under your own address, and is sent by you. No supplier email addresses are stored here.
Plainly: indefinitely. Projects, uploads and accounts are kept until they are deleted on request. There is no automatic deletion schedule yet, and this notice says so rather than implying one exists.
Write to the address above to have a project, an upload or an account deleted, and it will be.
You have the right to access, rectification, erasure, restriction, data portability and objection (Art. 15–21 GDPR), and the right to complain to a supervisory authority — in Berlin, the Berliner Beauftragte für Datenschutz und Informationsfreiheit.