Privacy Policy

1. Local-First Credential Vaults & Encryption

Direct API keys for Anthropic Claude and Google Antigravity/Gemini are stored strictly within client-side encrypted storage using 256-bit AES-GCM encryption with PBKDF2 key derivation.

Your master secret keys are never transmitted to, harvested by, or logged on GnamiAI servers. Keys are only provided in flight over TLS directly to the designated inference providers.

2. Google Authentication & Identity Data

When you authenticate with Google, we access solely your primary email address, public profile name, and avatar image. We do not inspect, index, or store your Google Drive, email inbox, or search history. Session state is retained securely in encrypted HTTP-only session cookies protected by Cloudflare Zero Trust.

3. Cloudflare Edge Telemetry & Rate Limiting

To protect the integrity of the network against distributed denial-of-service (DDoS) and credential stuffing attacks, Cloudflare Workers log IP addresses and request frequencies for authentication endpoints. Login requests exceeding 5 calls per 60 seconds trigger automatic rate limit blocks. These operational metrics are purged after 24 hours.

4. Code & Virtual Workspace Privacy

Files and virtual git micro-commits authored inside GnamiAI WebContainers remain inside your browser sandbox. They are never ingested into global machine learning training sets or shared with unauthorized third parties.

5. PayPal Billing Data

GnamiAI processes all subscription checkouts exclusively through PayPal REST API integrations. We do not collect, process, or store credit card numbers or banking credentials. Transaction verification is conducted entirely via PayPal subscription IDs.

6. Developer Rights & Data Erasure

You maintain total ownership of all code generated within GnamiAI. You can purge local storage, revoke OAuth tokens, and erase all virtual git snapshots at any time by clearing your browser cache or selecting “Sign Out” from the Account settings modal.