Effective: September 16, 2026 · Last updated: October 9, 2026
Fabricate ("we," "us," or "our") provides AI-assisted software generation tooling. This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and what rights you have. It applies to our website at fabricate.build and all related services (the "Service").
If you are located in the European Economic Area, United Kingdom, or Switzerland, the GDPR-specific section below applies to you. If you are a California resident, the CCPA section applies.
When you sign in via a third-party provider (e.g., Google, GitHub via Clerk), we receive basic profile information such as your name and email. We do not receive your passwords.
If you connect an AI assistant such as ChatGPT, Fabricate asks you to approve the requested permissions before sharing data with that assistant's provider. The app-only permission shares your owned app titles, recorded generation status, public or private visibility, last update and workspace links. It does not share prompts, source code, credentials or billing information. Other account-read connections may also read your subscription tier, as shown on the consent screen.
App-building connections are separate and require fresh consent. Depending on the permissions you choose, an assistant can read build progress, the builder's questions and replies (which may repeat details from your requests), previews, earlier versions and your credit balance; create or change apps; and read or edit eligible app source files. Building uses your existing credits within a limit stated before each request. Publishing, taking an app offline, making it public, making a published app private and restoring an earlier version each require your approval of the exact action on a signed-in Fabricate page. These connections do not buy credits, change subscriptions, take payments or read account credentials.
We store the connection's permissions and authorization records, and record operational events such as tool name, completion status and duration to run and secure the integration. These events do not include tool inputs or app titles. The retention periods in Section 6 apply. You can remove a connection at Connected agents; it then loses access to further requests, and its requests still waiting for approval are withdrawn. Work already admitted may finish. Data already sent to the assistant remains subject to its provider's privacy and retention policies. Existing metadata-only connections retain their original read-only permissions.
Fabricate asks Google for the permissions below and for no others, each only when you use the feature that needs it:
openid, userinfo.email, userinfo.profile): your name, email address and profile photo, used to create your Fabricate account, sign you in and run your account, as "How we use it" below describes (Section 1.3).drive.file): Fabricate creates one spreadsheet in your Google Drive, named after your app, and adds a row to it for each new form response. This permission reaches only files Fabricate creates; Fabricate cannot see, change or delete any other file in your Drive.calendar.events): Fabricate adds an event to the calendar you choose for each new form response, and reads that calendar's time zone when you connect it or choose another calendar. It does not read, change or delete your other events, and cannot change your calendar settings or sharing.Google's names for these permissions are openid, https://www.googleapis.com/auth/userinfo.email, https://www.googleapis.com/auth/userinfo.profile, https://www.googleapis.com/auth/drive.file and https://www.googleapis.com/auth/calendar.events.
Google Sheets and Google Calendar are connectors: an app owner connects a Google account to one of their apps from the app's Connectors page, so that each new form response the published app collects is added as a row or an event. Connecting one also asks for openid and userinfo.email, so Fabricate can show which Google account the connection uses.
What we store: from Sign in with Google, the name, email address and profile photo on your Fabricate account (account data, Section 6). From Google Sheets and Google Calendar: the access Google grants (an OAuth refresh token, encrypted with AES-GCM before it is stored), the connected account's email address, and the connection's settings: the spreadsheet's ID, link and column names, or the calendar's ID, its time zone, which form fields hold the date and time, and how long each event lasts. Short-lived access tokens are kept only in memory while in use and never stored. For each response sent, we keep a delivery record with the response's content and Google's reply, so the owner can see what was sent and failed sends can be retried; these records are deleted after 30 days.
How we use it: we do not use Google user data for advertising, we do not sell it, and we do not use it to train AI models.
Sign-in data (the name, email address and profile photo on your Fabricate account) is used to run your account and the Service, and to understand and improve the Service. It goes to these providers and people, for these purposes:
Sheets and Calendar data is used only to add the rows and events you set up, to show the connection and its recent deliveries to you, and to keep the connection working and secure. It is stored with our hosting provider, Cloudflare. People at Fabricate do not read it unless you ask us to (for example in a support request), or as needed for security or to comply with the law. What Fabricate writes to your spreadsheet or calendar is then held by Google under your Google account.
We do not transfer Google user data to anyone else except as described above, as needed for security or to comply with the law, or, with your prior consent, as part of a merger or acquisition.
How to revoke access and delete the data:
Limited Use: Fabricate's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
An app owner can let their app take card payments through Stripe, from the app's Payments page. Real payments go to the owner's own Stripe account, under the owner's own agreement with Stripe; Fabricate's own Stripe account (Section 4) does not handle them. We handle the information below on the owner's behalf, to run their app. There are two ways to connect, and both end with a Stripe key saved for the app.
Pasting a key: the owner pastes a Stripe secret or restricted key, for test mode, live mode or both. Before saving it, Fabricate sends Stripe one request with the key to check that it is valid and can create Checkout Sessions. That request creates nothing and charges nothing.
One-click setup, where offered: the owner can instead have Fabricate set up a Stripe test account (a Stripe sandbox) for the app. Fabricate asks Stripe to create it, sending the email address of the owner's Fabricate account, the app's name, and the country the owner appears to be connecting from (or the United States, where Stripe cannot create one in that country). Stripe returns the test account's keys once, and Fabricate saves its secret test key for the app just as it saves a pasted one. Stripe uses the email address to fill in its claim page, and to remind the owner seven days before it deletes a test account nobody has claimed. From the Payments page, the owner can claim the test account into a new or existing Stripe account; Fabricate asks Stripe for that claim link each time and does not store it. Once claimed, the account is the owner's; to take real payments, the owner adds a live key from their Stripe account as above. Stripe deletes a test account that is not claimed within 60 days; Fabricate then removes its key from the app.
What we store: each key, encrypted with AES-GCM, as one of the app's secrets; the Payments page shows only its last four characters. For a one-click test account we also keep a record of it: its Stripe IDs and status, when it expires or was claimed, which Fabricate user set it up, a one-way fingerprint of its key (so we can tell when the owner replaces the key) and, once the owner installs Fabricate's Stripe app in their live Stripe account, that account's ID. The record holds no keys and no claim link. Stripe tells Fabricate when the test account is claimed, changes or expires, and Fabricate asks Stripe for its status then and when the owner opens the Payments page.
What is read from the owner's Stripe account: Fabricate gives the keys to the app's own server: a test key to the app's preview, so test payments work there, and the saved keys to the published app when it is next published. The payment code Fabricate builds into apps uses the key to create a Stripe Checkout Session when a customer pays (with what is being bought, its price, the app's order number and, if the customer gave one, their email address), and then to ask Stripe whether it was paid: the payment status, amount and currency, the email address the customer entered and, for a subscription, its ID and status. Each order is recorded in the app's own database, which Fabricate hosts for the owner, so the owner can see who paid; an owner can change what their app records. Fabricate's own servers do not read the owner's customers, payments or subscriptions. In the payments Fabricate builds, customers enter their card on Stripe Checkout, Stripe's own payment page, so card numbers never reach Fabricate or the app.
Fabricate's Stripe app: one-click setup works through Fabricate's app for Stripe. Stripe installs it in each test account it creates for Fabricate, and asks the owner to install it in their own Stripe account when they take a claimed test account live. Wherever it is installed, it has one permission, event_read, which lets Fabricate read the account's Stripe events. Fabricate would use it only to follow the test account it created for the app: whether it has been claimed, whether the account application has been sent, and when it will expire. Today Fabricate's servers do not use it at all: Stripe sends those updates to Fabricate's own Stripe account, and the app's server uses the account's key, as described above. Fabricate does not read the owner's customers, payments or subscriptions through the app. Uninstalling Fabricate's app in the Stripe Dashboard removes this permission. It does not remove the key saved in the app.
How to disconnect and delete the data:
We use the information we collect to:
We do not use your prompts or generated content to train AI models or sell your data to third parties for advertising.
If you are in the EEA or UK, we process your personal data under the following legal bases:
We share personal data only with vendors and partners necessary to operate the Service ("sub-processors") and as required by law. We do not sell your personal data.
| Vendor | Purpose | Location |
|---|---|---|
| Stripe | Payment processing and subscription management for Fabricate plans, and creating the Stripe test accounts of one-click payments setup. Real payments inside an app go to the app owner's own Stripe account instead (Section 1.6). | USA |
| Clerk | Authentication and user identity management | USA |
| Cloudflare | Infrastructure, CDN, serverless compute, database, and storage | Global |
| Anthropic | AI model inference for code generation, and the AI assistant our team uses to run the Service (Section 1.5) | USA |
| Resend | Transactional and lifecycle email delivery | USA |
| PostHog | Product analytics and feature flags (consent-gated), the server page counts and sign-up source described in Section 5, and a copy of our Stripe billing records used to measure revenue (Section 1.5) | USA / EU |
| Sentry | Error monitoring and performance tracking | USA |
| OpenAI Ads | Consent-gated purchase measurement: payment amount, currency, opaque event ID and advertising click reference. Automatic advanced matching is not loaded. | USA |
| Meta (Facebook) | Conversion tracking via Meta Pixel (consent-gated) | USA |
| TikTok | Conversion tracking via TikTok Pixel (consent-gated) | Global |
| Crisp | Customer support chat widget (consent-gated) | EU |
| Google Analytics (consent-gated) and Google Tag Manager | USA | |
| Advertising conversion pixel, delivered via Google Tag Manager | USA | |
| Tolt | Affiliate referral attribution: its script loads only with your consent, and it has access to our Stripe records to pay referral commissions (Section 1.5) | USA |
| GitHub (optional) | Source control sync when you enable GitHub integration | USA |
| Google Sheets and Calendar (optional) | Receive the form responses an app owner chooses to add to their own spreadsheet or calendar (Section 1.5) | USA |
We may also disclose data: (a) to comply with legal obligations or respond to lawful requests from public authorities; (b) to protect our rights, property, or safety or that of our users; or (c) in connection with a merger, acquisition, or sale of all or a portion of our assets, in which case we will notify you before your data is transferred to a new entity.
We use the following categories of cookies and similar technologies:
Separately from these categories, our servers count page visits. Each count uses an identifier derived from your IP address that changes daily and is never linked to your account. On the page you land on, it also records campaign tags from the link (source, medium, campaign and ad content) and whether an ad click identifier was present, but never the identifier itself or any other part of the address. We use this only to measure, in aggregate, which campaigns bring visitors.
When you first arrive from another website or through a tagged link, we keep the same campaign tags, the referral code of the link if it has one (which names the partner, site or Fabricate member that sent you, not you), which advertising platform's click identifier was present (never the identifier), the name of the referring website (never the page) and the page you landed on in one first-party cookie, fab_src, for up to 90 days. It contains no identifier, it is not readable by scripts or by other websites, and it is never sent to an advertising platform. If you create an account, we copy it to your account so we know which channel brought you, and attach it to your subscription record at our payment processor. If the code is a Fabricate member's invite code, we also record that member as having referred you, so we can give you your sign-up bonus and credit them when you pay; they see how many friends joined and paid, never who. After you sign up we may also ask, optionally, where you heard about us; your answer is stored with your account.
You can manage cookie preferences through our cookie banner or your browser settings. Withdrawing consent for non-essential cookies does not affect the lawfulness of prior processing. For more details, see our Cookie Policy.
We retain personal data for as long as necessary to provide the Service and comply with legal obligations:
After account deletion, we will delete or anonymize your personal data within 30 days except where longer retention is required by law.
We are based in the United States. If you access the Service from the EEA, UK, or Switzerland, your personal data will be transferred to and processed in the USA and other countries that may not have equivalent data protection laws.
We rely on the following transfer mechanisms to ensure adequate protection:
You may request a copy of the applicable transfer safeguards by contacting us at support@fabricate.build.
We implement administrative, technical, and organizational safeguards appropriate to the risk, including encryption in transit (TLS), access controls, and security monitoring. No security system is perfect; we cannot guarantee absolute security. If we become aware of a security breach affecting your personal data, we will notify you and relevant authorities as required by applicable law.
The Service is not directed to children under 13 years of age, and we do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us with personal data, please contact us at support@fabricate.build and we will promptly delete it. Users between 13 and 17 years old may use the Service with parental or legal guardian consent, as described in our Terms of Service.
Regardless of your location, you may:
If you are located in the EEA, UK, or Switzerland, you have additional rights under the GDPR and equivalent laws:
To exercise these rights, contact us at support@fabricate.build. We will respond within 30 days (extendable by an additional 60 days for complex requests). We may ask you to verify your identity before fulfilling certain requests.
If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) gives you additional rights:
To submit a CCPA request, contact us at support@fabricate.build or use the unsubscribe link in any email we send. We will respond within 45 days (extendable to 90 days with notice).
Categories of personal information collected in the past 12 months: Identifiers (name, email, IP address); commercial information (subscription and billing history); internet activity (usage logs, session data); professional information (generated applications and prompts); and inferences drawn from the above. We collected this information for the business purposes described in Section 2.
We currently do not respond to "Do Not Track" browser signals because no industry standard for such signals has been established. You can control analytics tracking via our cookie banner.
We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice on the Service at least 30 days before the changes take effect. We encourage you to review this policy periodically. Continued use of the Service after the effective date of the updated policy constitutes acceptance.
For privacy questions, requests, or complaints, contact us at support@fabricate.build.
EEA/UK residents may also contact our representative or lodge a complaint with your local data protection authority.