Who this covers
This policy applies to the gobananas.dev website and to the hosted community edition, which Go Bananas AI operates. For account data on the hosted edition, we are the data controller.
Private deployments are different. When an organization runs the platform inside its own cloud, that organization is the data controller, the data stays in its environment, and it never reaches us. Their own privacy notice governs that data. See Security & trust for how a private deployment works.
What we collect
Account details — your name, email address, organization and role, and how you sign in (a password hash, or a link to a Google, GitHub, Microsoft, Facebook or Apple account).
Project content — the prompts you write, files you upload, chat history, and the code, apps and documents the platform generates for you.
Payment details — when you buy credits or a domain, payment is processed by Stripe. Domain registration also requires the contact details that domain registries require.
Usage and device data — pages visited, clicks and session recordings on our website, device and browser information, IP address, and error reports.
How we use it
- To run the service: sign you in, build and host what you ask for, and bill you.
- To generate results: your prompts and files are sent to the AI providers listed below, under their commercial terms.
- To keep the service secure and prevent abuse.
- To answer support requests and send service emails.
- To understand how the website is used and improve it.
We do not sell personal data, and we do not train AI models on your content.
Who else handles it
The hosted edition relies on these service providers, who process data on our behalf. Most are based in, or process data in, the United States. A private deployment uses none of them.
| Provider | Purpose |
|---|---|
| Anthropic | AI models that generate code and answers from your prompts and files |
| Google (Gemini) | Image generation from text prompts |
| OpenAI | Occasional helper calls and text embeddings |
| Railway | Application hosting and databases |
| Cloudflare | Content delivery, file storage (R2) and sign-up abuse checks (Turnstile) |
| E2B | Isolated sandboxes that run generated code |
| Expo and Appetize | Building and previewing mobile apps, when you use that feature |
| GitHub | Repository import and export, and sign-in, when you connect it |
| Stripe | Payments for credits and domains |
| Porkbun | Domain registration, when you buy a domain |
| Resend | Transactional email such as invitations and notifications |
| Sentry | Error reports, which can include request details |
| Google Analytics | Website usage statistics |
| Microsoft Clarity | Session recordings and heatmaps of how the site is used |
We also share data when the law requires it, or with a successor if the business is sold — in which case this policy continues to apply.
Retention
We keep your account and project data until you delete it or close your account. Security and audit records are kept for a fixed period; when you ask us to erase your data, your identity in those records is replaced with an irreversible pseudonym.
Your rights
Depending on where you live, you can ask to see, correct, export or delete your personal data, and object to or restrict how we use it. Email [email protected] from the address on your account and we will respond within one month. You also have the right to complain to your local data protection authority.
The service is not directed at children under 16, and we do not knowingly collect their data.
Contact and changes
Questions about this policy: [email protected]. Security issues: [email protected].
If we change this policy materially, we will update the date above and notify account holders by email before the change takes effect.