What we keep, and for how long

Who is responsible

Garboard at garboard.dev is operated by AEOSearch, LLC, which is the controller of the data this page describes. Write to paintedalways@gmail.com for anything on this page: a copy of your data, a correction, a deletion, or a question.

What we collect

• An account: your email address, your name if you give it, and either a hash of your password or the email Google confirms when you sign in with Google. We store no password in readable form.
• Your projects: the description you type, your answers in the intake interview, the facts you give us about your business, and the pages you compose.
• What we make for you: the plan, the generated code, the checks that ran and their results, the receipt for each build, and the files of any site we host for you.
• A model key you choose to bring for your own account. It is encrypted at rest with AES-256-GCM and used only to run your builds.
• A brief sent through the quote door: your name, email, the site or company, what you want built and the retainer you expect.
• Request logs at our host, with IP addresses, for keeping the service running.

Cookies

One cookie, named garboard_session, is set when you sign in and expires after 30 days. It holds a random token and nothing about you. We set no analytics cookies and load no advertising trackers, so there is no banner to click.

Who processes it for us

We run on other companies’ machines, and each one sees only what its job needs.

• Vercel hosts the site and the application, and keeps the request logs.
• Neon holds the database.
• Anthropic receives your description, your intake answers and the facts you gave us, because its model is what writes the plan and the code. Where the operator has configured them, OpenAI and Google receive the same for the same purpose, and OpenAI generates images.
• E2B runs the generated code in an isolated sandbox so the checks are real. It sees the code, not your account.
• Resend sends the email that tells you a build is ready, so it sees your address.
• Stripe takes payment when paid builds open, and holds your card details, which we do not see.
• Google confirms your identity when you choose to sign in with Google.

We do not sell your data, rent it, or share it for advertising. An email address joins no marketing list unless you ask to be on one, and it leaves the moment you ask.

How long it stays

Your account, projects, intake answers, plans, generated code and receipts

While the account stands. Deleted within 30 days of your request.

A site we host for you

While the retainer runs, and 90 days after it ends, so you can export the code. Then deleted.

A brief sent through the quote door

24 months after our last contact if no build follows. With your account if one does.

A key you bring for your own model account

Until you remove it, or with the account. Encrypted at rest.

Payment and invoice records

7 years from the payment, as tax law asks. Stripe keeps its own record under its own policy.

Your sign-in session

30 days, then it expires on its own.

Request logs at our host, including IP addresses

30 days.

A deletion reaches our database backups when the provider’s point-in-time window rolls over, within 7 days.

Your rights

You can ask for a copy of everything we hold about you, have it corrected, or have it deleted, and you can export the code of your site from the app at any time without asking. Email the address above and we answer within 30 days. If you are in the EU, the UK or California, the law gives you these rights by name; we give them to everyone.

Children

Garboard is for businesses and the people who run them. We do not knowingly keep an account for anyone under 16, and we delete one on sight.

Changes to this page

This page carries its effective date at the top. A change to what we keep or for how long is written here before it takes effect, and the schedule above is the one source: a period stated anywhere else on the site that differs from it is a mistake, and this page wins.