Privacy Policy

Effective October 13, 2026

Phluffle (“Phluffle”, “we”, “us”) is a tool that turns prompts and screenshots into clickable prototypes. This policy explains what we collect when you use phluffle.com, why, who helps us process it, and the choices you have. If anything here is unclear, email support@phluffle.com.

The short version

We collect your account details, what you build (prompts, uploaded images, generated prototypes) and basic usage information.
To generate prototypes, your prompts, uploaded images and the current prototype are sent to an AI model through OpenRouter.
We don't sell your personal information or use it for advertising.
Prototypes are private unless you create a share link.
You can delete prototypes at any time and ask us to delete your account.

1. What we collect

Information you give us

Account details: your name, email address and password (stored only as a secure hash). If you sign in with Google, we receive your name, email address, Google account ID and profile photo from Google.
Profile photo: if you upload one, or the one from your Google account.
What you create: your prompts, screenshots and other images you upload, design references, and the prototypes and versions Phluffle generates for you.
Messages to us: for example, a note you add when requesting more credits, or emails you send us.

Information collected automatically

Usage and billing records: when each prototype or change was generated, the AI model used, the number of AI tokens processed, its cost, and the credits charged.
Technical data: IP address, browser type and pages requested, recorded in our server logs and used for security and troubleshooting.
Analytics: how visitors use our pages, through Google Analytics (see Cookies and analytics).

Please don't include sensitive personal information (such as health, financial or government ID details, or other people's personal data) in prompts or uploads. Phluffle is built for designing interfaces and doesn't need it.

2. How we use it

To create and run your account, including reviewing new accounts before they're activated.
To generate, store, display and let you share your prototypes.
To track and manage credits, and to understand what generations cost.
To send service emails, such as account approval and credit updates.
To keep Phluffle secure, prevent abuse, and fix problems.
To understand how Phluffle is used and improve it.
To comply with the law.

We don't sell your personal information, share it for cross-context behavioral advertising, or use your prompts, uploads or prototypes to train AI models.

3. AI processing

When you create or change a prototype, we send your prompt, any images attached to it, your design references and the current version of the prototype to OpenRouter, which routes the request to the AI model selected for that prototype (for example, models from Anthropic, OpenAI or Google). These providers process the content to generate the response and handle it under their own terms and privacy policies. AI-generated output can be inaccurate, so review prototypes before relying on them.

4. Service providers

We use these companies to run Phluffle. They process data on our behalf, only as needed to provide their service:

Vultr: hosting of the servers and database where your account and prototypes are stored (United States).
OpenRouter and the AI model providers it routes to: generating prototypes.
Google: “Continue with Google” sign-in (if you choose it) and Google Analytics.
Cloudflare: domain name (DNS) services.
An email delivery provider: sending service emails.

Your prototypes are private to your account. If you create a share link, anyone with that link can view the current version of that prototype, but not your prompts, version history or uploads. You can turn a share link off at any time. Shared prototypes are marked so search engines don't index them.

We may also disclose information if required by law, to protect the rights, safety or property of Phluffle or others, or as part of a merger, acquisition or sale of assets, in which case this policy continues to apply to your information.

6. Cookies and analytics

Essential cookies keep you signed in and protect forms from forgery. Phluffle doesn't work without them.
Browser storage: if you start a prototype before signing up, your prompt and screenshots are kept in your browser (not on our servers) until you sign in. Your preview size preference is also stored in your browser.
Google Analytics uses cookies to tell us how many people visit, which pages they use and which features (like creating a prototype) they try. We don't send Google your name, email or prompts. You can opt out with Google's browser add-on or by blocking cookies in your browser. Learn more in how Google uses information from sites that use its services.

7. How long we keep data

Account information and credit history: while your account is open.
Prototypes, versions and uploaded images: until you delete them or your account is deleted. Deleting a prototype deletes its versions and images.
Server logs: kept for a limited period for security and troubleshooting.

When an account is deleted, we delete its prototypes, uploads and profile photo. Backups are overwritten on a rolling basis.

8. Your choices and rights

You can update your name, email, password and photo in Settings, and delete prototypes yourself.
You can download any version of a prototype as HTML.
To access, correct, export or delete your personal information, or to close your account, email support@phluffle.com. We'll respond within 30 days and may need to confirm your identity first.

Depending on where you live (for example, California or the European Economic Area), you may have additional rights, such as to object to or restrict certain processing or to complain to a data protection authority. We'll honor those rights as the law requires. If you're outside the United States, your information is processed and stored in the United States.

9. Security

We use encryption in transit (HTTPS), hashed passwords, private storage for uploads, sandboxed previews, and access controls. No service is perfectly secure, so please use a strong, unique password and keep your account to yourself.

10. Children

Phluffle isn't for children. You must be at least 16 to use it, and we don't knowingly collect personal information from anyone younger. If you believe a child has given us information, contact us and we'll delete it.

11. Changes

We may update this policy as Phluffle changes. We'll post the new version here with a new effective date, and for significant changes we'll let account holders know by email or in the app.

12. Contact

Questions or requests about privacy: support@phluffle.com.