Privacy

Short version: we store your account, the extensions you build and the conversations that produced them. We send your prompts to a model provider so it can write code. Your extensions run entirely in your own browser and report nothing back to us.

What we store

• Your account — the email, name and avatar Google gives us when you sign in. No password: we never see one.
• Your extensions — the name, description, files and every saved version, so you can go back to the build that worked.
• Your builder conversations — what you asked for and what came back, so a thread still makes sense tomorrow.
• Publishing attempts — including failed ones, because the rejection reason is the useful part.

It lives in a Postgres database with row-level security, so a query for someone else’s rows returns nothing rather than relying on our code to remember to filter.

What we send elsewhere

Building an extension means sending your prompt, and the current files, to a language model through OpenRouter. That is the one place your content leaves our systems, and it is unavoidable — it is how the code gets written.

We do not send your prompts anywhere else. There is no analytics vendor reading your extensions, and we do not sell anything to anyone.

What your extensions do

This is the part worth being precise about, because an extension is powerful and people are right to be suspicious.

An extension built here runs entirely in your browser. It does not phone home. We add no tracking, no telemetry and no “built with” beacon to generated code. If an extension makes a network request, it is because you asked for one, and we say so on the permissions panel before you install it.

Once you install an extension, it is no longer connected to us at all. It keeps working if we disappear.

The preview

Previews run in a sandboxed frame in your own browser with Chrome’s APIs stubbed. Nothing about a preview is sent to us, and any settings a preview stores exist only until you reload the page.

Cookies

One session cookie, so you stay signed in. No advertising cookies and no third-party trackers.

Deleting things

Delete an extension and its files, versions and conversation go with it. Delete your account from settings and everything above is removed — properly, not flagged as hidden. Backups age out within thirty days.

Children

Despicable is not intended for anyone under 13, and we do not knowingly keep data belonging to them.

Getting in touch

Ask us anything, including for a copy of what we hold about you, at hello@fulmina.re.