Privacy Policy

This Privacy Policy describes how Woobox LLC ("Hatchable", "we", "us", "our") collects, uses, and protects your information when you use the Hatchable platform ("Service"). Woobox LLC is the data controller for personal information you provide directly to us in connection with your Hatchable account.

1. Information We Collect

Account Information

When you create an account, we collect:

• Email address — required for claimed accounts; not collected for anonymous auto-signup accounts until you claim them
• Handle (username) — a unique identifier for your account, auto-generated or chosen by you
• Display name — optional

Anonymous Accounts

When you copy a setup command from the homepage or an AI agent first connects via MCP, an anonymous account is created automatically. At this stage we collect only:

• A generated handle and API key
• Your IP address (for rate limiting and abuse prevention)

No email or personal information is required. When you later claim the account by verifying an email address, the anonymous account is converted into a full account.

Passkey (WebAuthn) Data

If you register a passkey for authentication, we store:

• Credential ID (a unique identifier for the passkey)
• Public key (used to verify your identity — your private key never leaves your device)
• Credential metadata (sign count, attestation type, creation date)

We do not have access to your biometric data. Biometric verification happens entirely on your device.

Project Data

When you use Hatchable to build applications, we store:

• Project files (code, HTML, CSS, JavaScript) deployed via MCP tools or the console
• Database contents created by your applications
• Environment variables and configuration
• Function execution logs (request method, path, status code, duration, errors)
• Deployment history

Usage Data

We automatically collect:

• API request metadata (timestamps, endpoints called, response codes)
• Resource usage (function calls, database size, storage usage)
• IP addresses of API requests

End User Data

Applications you build on Hatchable may collect data from their own end users. You are the data controller for any end user data stored in your project databases. We act as a data processor for this information.

2. How We Use Your Information

Purpose	Data Used
Provide the Service	Account info, project data, environment variables
Authentication	Email address, passkey credentials, API key hashes, session tokens
Billing and plan enforcement	Account info, resource usage
Debugging and support	Function logs, error data
Service improvement	Aggregated usage data (anonymized)
Security and abuse prevention	IP addresses, request patterns
Account claim and merge	Email address, API keys (to transfer ownership when an anonymous account is claimed by an existing user)

3. Cookies and Session Tokens

On hatchable.com

The Hatchable website and console use the following cookies:

Cookie	Purpose	Duration
hatchable-session	Server session, set for every visitor. Strictly necessary.	2 hours
XSRF-TOKEN	Protection against cross-site request forgery, set for every visitor. Strictly necessary.	2 hours
hatchable_session	Keeps you signed in to your Hatchable account. Set only when you sign in.	7 days
AWSALBTG, AWSALBTGCORS	Keep your requests on the same server. Strictly necessary.	7 days
hb_consent	Remembers whether you accepted or rejected the cookies below. Strictly necessary.	6 months
hb_vid	A random visitor ID we use to count visits and understand which pages lead to sign-ups. Not shared with third parties.	2 years
hb_visitor	Remembers which version of a page you were shown when we test changes to the website.	1 year
_gcl_*	Google Ads conversion measurement (set when you arrive via a Google ad)	Up to 90 days
_fbp	Meta ad measurement and audience building	90 days

hb_vid, hb_visitor, _gcl_* and _fbp are not strictly necessary. Where we ask for consent, they are set only after you accept.

Your cookie choice

If you visit from the EU, the EEA, the UK or Switzerland, or we cannot tell where you are visiting from, we ask before using any cookie that is not strictly necessary. A banner offers Accept and Reject. Until you press Accept:

• the Google Ads tag and the Meta Pixel do not load, and Google's consent mode is set to denied;
• hb_vid and hb_visitor are not set, and we do not record your page views against a visitor ID;
• the campaign details from the link you arrived on are kept only for the page you are on, not saved in your browser;
• if you sign up, we do not send that signup to Meta from our servers.

If you press Reject, all of this stays off, and the advertising cookies already on hatchable.com are removed. Your choice is saved in the hb_consent cookie for 6 months, after which we ask again. You can change it at any time with the Cookie settings link at the bottom of every page. Visitors from other countries do not see the banner, but can use the same link to turn these cookies off.

On sites published with Hatchable

Sites that customers publish on Hatchable, on *.hatchable.site and on custom domains, use only these cookies:

Cookie	Purpose	Duration
hatchable-session	Server session, set for every visitor, including visitors who never sign in. Strictly necessary.	2 hours
XSRF-TOKEN	Protection against cross-site request forgery, set for every visitor. Strictly necessary.	2 hours
hatchable_session	Keeps a visitor signed in to that site. Set only when the visitor signs in.	Up to 7 days

All three are first-party, Secure, and sent only to the site that set them. They are never used for analytics, advertising or tracking across sites. When you are signed in on hatchable.com and open a private project, a one-time sign-in link sets hatchable_session on that project's own address so you can use the app without signing in again. Sites may also set their own cookies. Those are chosen by the site's owner, not by Hatchable, and the site's own privacy notice covers them.

Advertising measurement

We advertise Hatchable on Google, on Meta platforms (Instagram and Facebook), and in ChatGPT, and use each provider's measurement tag or reporting API to understand whether those ads work:

• Google Ads tag (gtag): loaded on our marketing pages. It reports page views and conversion events (such as signing up) to Google so we can measure ad performance, and reads the gclid click identifier when you arrive from a Google ad. See Google's advertising policy; opt out at adssettings.google.com.
• Meta Pixel: loaded on our marketing pages. It reports page views and conversion events (such as requesting a link by email, or signing up) to Meta so we can measure ad performance, and to build audiences of site visitors that we may show ads to on Meta platforms (Instagram and Facebook), including when you arrive via the fbclid click identifier from one of our ads. If you create an account, we may also include a hashed (irreversibly obscured) version of your account email address in customer-list audiences so we can show you relevant Hatchable ads on Meta platforms, for example a reminder to finish setting up; you can opt out of this at any time by contacting us or via Meta's ad preferences. To measure conversions more reliably, we also send some of these events (such as a signup) to Meta directly from our servers using Meta's Conversions API, matched with identifiers that are hashed (irreversibly obscured) before transmission — such as a hashed version of your email address and account identifier — together with your IP address and browser user-agent. See Meta's privacy policy; manage ad preferences at facebook.com/adpreferences or opt out of interest-based ads at aboutads.info.
• OpenAI Ads (ChatGPT): we advertise Hatchable inside ChatGPT, and those ads send people to our listing in ChatGPT's app directory rather than to our website. Because that click never reaches our site, no measurement tag loads in your browser and there is no click identifier for us to read. Instead, if you create an account by connecting Hatchable from within ChatGPT, we send OpenAI a small number of conversion events (that a signup happened, and that the account went on to use Hatchable) directly from our servers using OpenAI's Conversions API, so that OpenAI can report whether our ads produced it. These events are matched using identifiers that are hashed (irreversibly obscured) before transmission, specifically a hashed version of your email address and of your account identifier, together with your IP address and browser user-agent. We send these events only for accounts that reached us through ChatGPT's app directory, and we do not send your project code, project data, or the contents of anything you build. See OpenAI's privacy policy.
• First-touch attribution: subject to your cookie choice above, we store the campaign parameters from the link you arrived on (and, for Meta-ad visitors, a flag that you arrived via a Meta ad) in your browser's localStorage, and associate them with your account if you sign up, so we know which ad brought you.
• "Email me the link": if you use the email-handoff form on our mobile landing page, we store the email address you provide, the ad-campaign tags from your visit, and a hashed IP address, and send you a single email containing the link. We do not add you to any marketing list.

4. Data Isolation and Security

• Database isolation: Every project gets its own dedicated, isolated database. There is no shared access between projects or accounts.
• Encryption at rest: Environment variables marked as secrets are encrypted using AES-256 before storage.
• No credentials in subprocess: Function execution environments do not have direct database or storage credentials. All data access routes through our authenticated gateway.
• API key security: API keys are stored as SHA-256 hashes. We cannot retrieve your original key after creation.
• Passkey security: Only your public key is stored on our servers. Private keys and biometric data remain on your device.
• Session tokens: Signed with HMAC-SHA256 and include an expiration timestamp. Tokens cannot be forged or extended.

5. Data Retention

• Active accounts: Data is retained as long as your account is active.
• Anonymous accounts: Unclaimed anonymous accounts and their data may be deleted after 90 days of inactivity.
• Function logs: Retained for 90 days, then automatically deleted.
• Agent-submitted SQL and code: Excerpts of the SQL and code that AI agents run against your projects are kept for 90 days for security review, then automatically deleted.
• Backups: Automated database backups are kept for 7 days, then automatically deleted. Data you delete leaves our backups within that window.
• Deleted projects: Project data (database, files, logs) is permanently deleted within 30 days of project deletion.
• Closed accounts: All data is permanently deleted within 30 days of account closure.

6. Data Sharing

We do not sell your personal information. We may share data with:

• Infrastructure providers: AWS (hosting, database, storage) — as necessary to operate the Service
• Advertising measurement providers: Google, Meta and OpenAI, as described in "Advertising measurement" above. These providers receive page-view and conversion-event data — from your browser and, for Meta and OpenAI, also directly from our servers with hashed identifiers as described above — for the purpose of measuring our ad campaigns and, for Google and Meta, building advertising audiences of our site visitors and, as hashed customer-list audiences, of our account holders. OpenAI receives conversion events only for accounts that reached us through ChatGPT's app directory, and only to measure those campaigns.
• AI model providers: Anthropic, OpenAI and Google, when an app uses AI through Hatchable's built-in AI. The request content is sent to the provider to generate the response. We keep usage records (model, token counts and cost), not the prompt or response text.
• Legal requirements: When required by law, subpoena, or court order
• Business transfers: In connection with a merger, acquisition, or sale of assets, with notice to affected users

We do not use your project code or data to train AI models.

7. Collaborators and Shared Projects

When you are invited as a collaborator on a project, the project owner can see your handle and email address. Your role (viewer, user, editor, admin) determines what project data you can access. Project owners can remove collaborators at any time.

When you request access to a private project, the project owner can see your handle and any message you include with the request.

8. Your Rights

• Access: View all data associated with your account via the console or API
• Export: Download your project files and database contents at any time
• Delete: Delete individual projects or your entire account
• Correct: Update your account information at any time
• Revoke passkeys: Remove any registered passkeys through the console

If you are in the EU/EEA, you also have rights under the GDPR including the right to data portability and the right to lodge a complaint with a supervisory authority.

9. International Data Transfers

Our infrastructure is hosted primarily in the United States, and we may process data in any other country where we or our providers operate. If you access the Service from outside the US, your data will be transferred to and processed in the US. We rely on standard contractual clauses for EU data transfers where applicable.

10. Children's Privacy

Hatchable is not intended for use by anyone under 18 years of age. We do not knowingly collect personal information from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through the Service. The "last updated" date at the top reflects the most recent revision.

12. Contact

For privacy-related questions or requests, contact Woobox LLC at privacy@hatchable.com.