Privacy Policy

Who we are

Launchpad is operated by Galax (“we”, “us”). We are the data controller for the personal data described in this policy. You can reach us about anything in this document at privacy@launchpad.app.

What we collect

We collect and store the following categories of data:

• Account data — your email address, display name, and authentication identifiers from the sign-in provider you choose.
• Content — the projects you create: prompts, chat messages, files the agent writes, uploaded images, and anything you choose to publish.
• Billing data — your plan, credit ledger, and purchase history. Card details are collected and stored by Stripe; we never see the number.
• Technical data — IP address, browser type, and request logs used for security, rate limiting, and debugging.

What we use it for

We process your data to provide the service (running your sandboxes, storing your projects, streaming agent turns), to bill you (the credit ledger exists so every charge is explainable), to secure the platform (rate limits, abuse detection, content policy enforcement), and to improve the product using aggregated, pseudonymized usage data.

What we will never do

We do not use your content — your prompts, your chat history, your code, your published apps — to train foundation models, and we do not permit our sub-processors to do so under our agreements with them. We do not sell personal data. We do not show advertising.

Who touches your data

We use a small number of sub-processors, each bound by a data-processing agreement:

• Anthropic — runs the model that powers the agent. Your messages are sent there to generate responses, under terms that prohibit training on them.
• Vercel — hosts the application and the sandboxes your projects run in.
• Supabase — databases, including ones you connect to your own projects.
• Stripe — payments and card storage.
• Cloudflare — networking and DDoS protection.

We will notify account holders before adding a sub-processor that handles content.

How long we keep it

• Account data — kept while your account exists, deleted within 30 days of account deletion.
• Project snapshots — retained 30 days; you can delete a snapshot immediately from project settings.
• Chat messages — retained on a 12-month rolling window.
• Backups — expire within 90 days of the data they contain being deleted.

Your rights

You can access, export, correct, or erase your data. Export and account deletion are self-service in Settings — the export produces your actual projects as real repositories, because ownership is the product's whole thesis. For anything the UI doesn't cover, email privacy@launchpad.app and we will respond within 30 days. If you are in the EU/EEA, these are your GDPR rights and you also have the right to complain to your supervisory authority.

Security

Data is encrypted in transit and at rest. Secrets you connect — API keys, database credentials — are envelope-encrypted in a vault so that a database dump does not become a credential dump. Sandboxes are isolated per project at the kernel level. The complete isolation model, including what we deliberately cannot read, is documented on our Security page.

If something goes wrong

If we confirm a personal-data breach that affects you, we will notify affected users and, where required, the relevant supervisory authority within 72 hours of confirmation, with what we know, what we've done, and what you should do.

Children

Launchpad is not directed at children. You must be at least 13 years old to use it (16 where the EU's age of digital consent applies). If we learn we hold data on a child below these ages, we delete it.

Changes

When this policy changes materially, account holders get 30 days' notice by email before the change takes effect. Every version of this document is tracked in version control, so you can see exactly what changed between any two dates.