Privacy

CreativePower is operated by Greg White, an individual — there is no company. Postal address: [To fill in before launch: postal address]. Support email: [To fill in before launch: support email]. Write to the support email about anything on this page.

Your account and everything you make are stored in a Supabase database. Specifically:

• Your sign-in (auth.users). Your email address, and either a password or your Google identity if you sign in with Google. Your password goes from your browser straight to Supabase; CreativePower's own server never receives it. If Google provides your name and picture, those are kept too. [Unverified: what Supabase Auth itself records about each sign-in, such as IP addresses]
• Your profile (profiles). A display name and a picture link. The display name is your name from Google, or — if there is none — your email address.
• Your projects (projects, design_md_files). Each project's name and description, and every version of its DESIGN.md.
• Every page you generate (generation_manifests). A record of every generation is kept, whether or not you save the page: your brief, the settings you chose, the model used, the exact DESIGN.md that was sent, which motion patterns were offered, the complete generated page, whether it finished or failed, when, and how many tokens it used.
• Pages you arrange from sections (remix_pages). The sections you put on a remix page: their order, the words you write into them, and which library items you placed as whole pages. You can remove sections in the editor; the page itself is kept with the project.
• Library items you favourite (library_favourites). Which library items you marked as a favourite, and when. Only you can see your own list; the count shown on a card is a total across everyone and never says who. Remove a favourite and the row is deleted.
• Library items you vote for (library_votes). Which library items you gave a thumbs up, and when. Only you can see your own votes; the count shown on a card is a total across everyone and never says who. Take a vote back and the row is deleted.
• Items you submit (library_submissions). If submissions are ever opened to subscribers, what you submit: its title, the licence you declare for it, the licence notice and credit you give, and the review status. Only you and the owner can see your submissions. Submissions are switched off at present, so this table is empty.
• Skills you apply (library_skill_uses). Which library skill you applied, and when, so the Skills page can show how many times each has been used. Only you can see your own rows; the count on the page is a total across everyone and never says who.Patterns made from your references (remix_candidates). The recordings and screenshots you give Remix from reference are read once and are not stored. When what they showed matches nothing in the library, the page built from it is queued for review by the owner of CreativePower, together with what was read from the reference (a description of its technique, not the file) and your edits to it. It is not published.
• Your own media (my_media). The images and videos you upload to My media, and the frames made from them: each file's name, type, size and place in private storage. Only you can open them, through short-lived links. Delete a file and its row and its stored copy are removed.
• Extra storage you buy (media_topups). Which storage top-ups you have bought and whether each is still active. Card details stay with our payment provider.
• Media published with your pages (published_media). When you export a page as a link or a ZIP, a copy of each of your files it uses is published at a permanent public address so the page keeps working; this records which file was published where. Anyone with the page's address can see those copies.
• Pages you save (generations). The prompt and the page, when you choose to keep one in your history.
• Your usage (generation_daily_usage). How many pages you generated each day, to apply the limit.
• Your usage (generation_monthly_usage). How many pages you generated each month, to apply the monthly limit.
• Inspiration images (inspirations). Images you upload or capture from a web address, stored in the database with the address they came from and the colours read from them.
• Skills and workflows (skills, workflows). Ones you save. If you mark one public, other users can see it.
• Billing (customers, subscriptions). Your Stripe customer number, and your subscription as Stripe reports it: its status, plan, current billing period, and any cancellation dates. We never see or store your card.
• Your own Anthropic API key (user_api_keys). Only if you choose to add one in Settings. It is stored encrypted, with the encryption key held outside the database, and used only to run your generations on your own Anthropic account. It is never shown to you again after you save it, only its last four characters. Remove it in Settings and it is deleted.
• Your own OpenAI API key (user_openai_keys). Only if you choose to add one in Settings, for voice input in the editor. It is stored the same way as your Anthropic key, encrypted and never shown to you again after you save it (only its last four characters), and used only to send your recordings to Whisper on your own OpenAI account. Remove it in Settings and it is deleted. We do not keep the recordings.
• Your Vercel connection (user_vercel_tokens, project_vercel_deploys). Only if you choose to deploy an app to your own Vercel account. Vercel gives us an access token for your account when you connect it; it is stored the same way as your AI keys, encrypted and never shown to you again after you save it (only its last four characters), and used only to create the project, set its settings and upload the app in your Vercel account. We also keep the name of the Vercel project and the address and state of the last deployment. Press Disconnect in Settings and the token is deleted. Any API key you type into the deploy dialog goes straight to Vercel as an encrypted setting and is not stored by us.
• Your app (project_apps). When you save screens made from your data as a project, we keep the app with the project: its structure and mapping, the design system it follows, the sample rows from your file and the address of your own API (never a key or a password). Delete the project and it is deleted.
• Large pages and apps on their way (project_upload_parts). A page or app too large to send in one go is sent in pieces. We hold the pieces only until the last one arrives, then join them, store the page or app as above and delete the pieces; pieces of a save that never finished are deleted when your next save starts (after a day at the latest) or when you delete the project.
• Connected AI tools (mcp_oauth_clients, mcp_oauth_codes, mcp_oauth_tokens). If you connect Claude, Claude Code, Cursor or Windsurf to your account, we keep the connection: the app's registered name and return address, and one-time codes and access tokens for your account, stored only as one-way hashes so a token cannot be read back. A connection stops working when its token expires or is revoked.
• What you open through a connected tool (mcp_pulls). Each time code, a DESIGN.md or a generation prompt is handed to a connected tool for your account, we record which item, what kind of thing it was and when. We use it to count the free items and the daily limit, to spot an account copying the library, and nothing else.

The operator of CreativePower can read all of this through the database's administrative access; other users cannot, except for skills and workflows you make public.

These services receive data from CreativePower when you use it:

• Supabase — our database and sign-in provider. Everything listed above is stored there.
• Stripe — payments. When you subscribe we send Stripe your email address and your CreativePower user number. You enter your card on Stripe's own page; it never reaches us.
• Anthropic — the AI model behind every AI feature. Generating a page sends Anthropic your brief, your DESIGN.md (unless you generate without one) and the motion pattern code offered (on your own Anthropic account, if you added your own key); remixing a page sends the page and your instructions; asking the editor's assistant to change a page sends the page's sections and what you asked (always on your own Anthropic account, with your own key); creating a DESIGN.md sends your description, or your inspiration images. [Unverified: how long Anthropic keeps what it is sent, under its commercial terms]
• OpenAI — only if you add your own OpenAI key and use Whisper for voice input: the recording of what you said is sent to OpenAI to be turned into text, on your own OpenAI account.
• Google — only if you choose to sign in with Google.
• microlink.io — when you add an inspiration by web address, that address is sent to microlink to take a screenshot of the page.

Sign-up and password emails are sent by [Decision 23: the email provider]. The site is hosted by [Decision 22: the hosting provider and the region your data is stored in].

CreativePower sets the cookies Supabase needs to keep you signed in. There is no analytics, advertising or tracking code in the product. The home page loads its animation scripts from cdnjs.cloudflare.com and unpkg.com, so your browser contacts those servers when you open it.

You can delete saved pages, inspiration images, skills and workflows yourself. There is not yet a way in the app to delete a project, the record of your generations, or your account. [Decision 11: how to ask for deletion, and how quickly it is done]

Nothing is deleted automatically: records are kept until they are deleted. [Decision 10: how long records are kept, including after an account is closed]