Privacy

CreativePower is operated by Greg White, an individual — there is no company. Postal address: [To fill in before launch: postal address]. Support email: [To fill in before launch: support email]. Write to the support email about anything on this page.

Your account and everything you make are stored in a Supabase database. Specifically:

• Your sign-in (auth.users). Your email address, and either a password or your Google identity if you sign in with Google. Your password goes from your browser straight to Supabase; CreativePower's own server never receives it. If Google provides your name and picture, those are kept too. [Unverified: what Supabase Auth itself records about each sign-in, such as IP addresses]
• Your profile (profiles). A display name and a picture link. The display name is your name from Google, or — if there is none — your email address.
• Your projects (projects, design_md_files). Each project's name and description, and every version of its DESIGN.md.
• Every page you generate (generation_manifests). A record of every generation is kept, whether or not you save the page: your brief, the settings you chose, the model used, the exact DESIGN.md that was sent, which motion patterns were offered, the complete generated page, whether it finished or failed, when, and how many tokens it used.
• Pages you arrange from sections (remix_pages). The sections you put on a remix page: their order, the words you write into them, and which library items you placed as whole pages. You can remove sections in the editor; the page itself is kept with the project.
• Library items you favourite (library_favourites). Which library items you marked as a favourite, and when. Only you can see your own list; the count shown on a card is a total across everyone and never says who. Remove a favourite and the row is deleted.
• Library items you vote for (library_votes). Which library items you gave a thumbs up, and when. Only you can see your own votes; the count shown on a card is a total across everyone and never says who. Take a vote back and the row is deleted.
• Items you submit (library_submissions). If submissions are ever opened to subscribers, what you submit: its title, the licence you declare for it, the licence notice and credit you give, and the review status. Only you and the owner can see your submissions. Submissions are switched off at present, so this table is empty.
• Skills you apply (library_skill_uses). Which library skill you applied, and when, so the Skills page can show how many times each has been used. Only you can see your own rows; the count on the page is a total across everyone and never says who.Patterns made from your references (remix_candidates). The recordings and screenshots you give Remix from reference are read once and are not stored. When what they showed matches nothing in the library, the page built from it is queued for review by the owner of CreativePower, together with what was read from the reference (a description of its technique, not the file) and your edits to it. It is not published.
• Your own media (my_media). The images and videos you upload to My media, and the frames made from them: each file's name, type, size and place in private storage. Only you can open them, through short-lived links. Delete a file and its row and its stored copy are removed.
• Extra storage you buy (media_topups). Which storage top-ups you have bought and whether each is still active. Card details stay with our payment provider.
• Media published with your pages (published_media). When you export a page as a link or a ZIP, a copy of each of your files it uses is published at a permanent public address so the page keeps working; this records which file was published where. Anyone with the page's address can see those copies.
• Pages you save (generations). The prompt and the page, when you choose to keep one in your history.
• Your usage (generation_daily_usage). How many pages you generated each day, to apply the limit.
• Your usage (generation_monthly_usage). How many pages you generated each month, to apply the monthly limit.
• Inspiration images (inspirations). Images you upload or capture from a web address, stored in the database with the address they came from and the colours read from them.
• Skills and workflows (skills, workflows). Ones you save. If you mark one public, other users can see it.
• The waitlist (waitlist). Only if you join the waitlist before CreativePower opens: the email address you give, when you joined, the page you joined from, and your browser's user-agent string. We use it only to email you when CreativePower opens. You do not need an account to join, and you can ask us to remove your address at any time.
• Refused publishes (clean_language_attempts). Only if something you try to publish, share, export or print is refused because of its words: when, your account and email, what you were doing, and the words that were not allowed, with all but their first letter hidden. Only the site's owner can see it; it is kept to look after the rule that vile language is never shown on CreativePower.
• Support requests (support_tickets, support_messages, support_attachments, support_notes, support_events). Only if you write to us through the contact form: your name, email address, topic, subject and messages, any screenshots or PDFs you attach (kept in private storage), your browser's user-agent string, and, if you were signed in, your account and plan. We also keep our replies, our own internal notes about the request, and a log of its status changes. We use it only to answer you. Replies are sent by email through Resend.
• Merch orders (merch_designs, merch_orders, merch_order_events). Only if you buy something with “Make it merch”: the design you made (your words, how they were styled, and the print file), and for the order your email address, phone number and shipping address as you gave them to Stripe, what you paid, and the order's progress at the printer (Printful or Printify) with its tracking number. You do not need an account to buy, and we never see or store your card.
• Billing (customers, subscriptions). Your Stripe customer number, and your subscription as Stripe reports it: its status, plan, current billing period, and any cancellation dates. We never see or store your card.
• Your own Anthropic API key (user_api_keys). Only if you choose to add one in Settings. It is stored encrypted, with the encryption key held outside the database, and used only to run your generations on your own Anthropic account. It is never shown to you again after you save it, only its last four characters. Remove it in Settings and it is deleted.
• Your own OpenAI API key (user_openai_keys). Only if you choose to add one in Settings, for voice input in the editor. It is stored the same way as your Anthropic key, encrypted and never shown to you again after you save it (only its last four characters), and used only to send your recordings to Whisper on your own OpenAI account. Remove it in Settings and it is deleted. We do not keep the recordings.
• Your Vercel connection (user_vercel_tokens, project_vercel_deploys). Only if you choose to deploy an app to your own Vercel account. Vercel gives us an access token for your account when you connect it; it is stored the same way as your AI keys, encrypted and never shown to you again after you save it (only its last four characters), and used only to create the project, set its settings and upload the app in your Vercel account. We also keep the name of the Vercel project and the address and state of the last deployment. Press Disconnect in Settings and the token is deleted. An API key you type into the deploy dialog goes to Vercel as an encrypted setting; whether we also keep it is described next.
• The API key of your own data (project_live_keys). Only if you connect live data, save the screens as a project and leave the box ticked (or tick it when you deploy). The key for your own API is stored with that project the same way as your AI keys: encrypted, never shown to you again after you save it (only its last four characters), and used only to pass it to your Vercel project when you deploy, so you do not have to enter it twice. Replace or Remove it in the Deploy dialog and it is deleted, as it is when you delete the project.
• Your app (project_apps). When you save screens made from your data as a project, we keep the app with the project: its structure and mapping, the design system it follows, the sample rows from your file and the address of your own API (never a key or a password). Delete the project and it is deleted.
• Large pages and apps on their way (project_upload_parts). A page or app too large to send in one go is sent in pieces. We hold the pieces only until the last one arrives, then join them, store the page or app as above and delete the pieces; pieces of a save that never finished are deleted when your next save starts (after a day at the latest) or when you delete the project.
• Connected AI tools (mcp_oauth_clients, mcp_oauth_codes, mcp_oauth_tokens). If you connect Claude, Claude Code, Cursor or Windsurf to your account, we keep the connection: the app's registered name and return address, and one-time codes and access tokens for your account, stored only as one-way hashes so a token cannot be read back. A connection stops working when its token expires or is revoked.
• What you open through a connected tool (mcp_pulls). Each time code, a DESIGN.md or a generation prompt is handed to a connected tool for your account, we record which item, what kind of thing it was and when. We use it to count the free items and the daily limit, to spot an account copying the library, and nothing else.

The operator of CreativePower can read all of this through the database's administrative access; other users cannot, except for skills and workflows you make public.

These services receive data from CreativePower when you use it:

• Supabase — our database and sign-in provider. Everything listed above is stored there.
• Stripe — payments. When you subscribe we send Stripe your email address and your CreativePower user number. You enter your card on Stripe's own page; it never reaches us.
• Printful and Printify — only when you buy something with “Make it merch”: the printer that makes your order receives your print file, your name, shipping address, email address and phone number, so it can make, ship and track it.
• Anthropic — the AI model behind every AI feature. Generating a page sends Anthropic your brief, your DESIGN.md (unless you generate without one) and the motion pattern code offered (on your own Anthropic account, if you added your own key); remixing a page sends the page and your instructions; asking the editor's assistant to change a page sends the page's sections and what you asked (always on your own Anthropic account, with your own key); creating a DESIGN.md sends your description, or your inspiration images. [Unverified: how long Anthropic keeps what it is sent, under its commercial terms]
• OpenAI — only if you add your own OpenAI key and use Whisper for voice input: the recording of what you said is sent to OpenAI to be turned into text, on your own OpenAI account.
• Google — only if you choose to sign in with Google.
• microlink.io — when you add an inspiration by web address, that address is sent to microlink to take a screenshot of the page.

Sign-up and password emails are sent by [Decision 23: the email provider]. The site is hosted by [Decision 22: the hosting provider and the region your data is stored in].

CreativePower sets the cookies Supabase needs to keep you signed in. There is no analytics, advertising or tracking code in the product. The home page loads its animation scripts from cdnjs.cloudflare.com and unpkg.com, so your browser contacts those servers when you open it.

You can delete saved pages, inspiration images, skills and workflows yourself. There is not yet a way in the app to delete a project, the record of your generations, or your account. [Decision 11: how to ask for deletion, and how quickly it is done]

Nothing is deleted automatically: records are kept until they are deleted. [Decision 10: how long records are kept, including after an account is closed]