Privacy Policy

This Privacy Policy applies to WHAT IF and related websites, previews, and services operated by Juno Design, Inc. ("Juno Design", "we", "us", or "our").

We may collect the following categories of information:

• account and identity information, such as your email address, profile name, avatar, auth provider, and account identifiers;
• content you submit, store, or generate in the Service, including prompts, notes, images, files, sites, version history, URLs, canvas data, and generated outputs;
• payment and transaction information, such as purchased credit packs, transaction identifiers, billing metadata, and usage ledger entries;
• device, browser, and usage information, including local storage state, feature interactions, and analytics events;
• information from connected third-party services, such as GitHub account connections and repository synchronization metadata;
• email sent to the inbound address we assign to your account, if you enable that feature, including the message body, subject, attachments, sender address, and mail headers such as the message identifiers we use to thread our replies.
• your mobile phone number, if you link a phone so you can text the Service, and the text messages you exchange with the WhatIF number, including their words, the photos and files you attach, and the message identifiers we use to avoid answering the same text twice.
• feedback you send us from within the Service, including your message and any images you attach, together with diagnostic information sent with it: your account email and identifier, the space and page you were on, the app version, your browser, screen size, and connection status, and recent error messages from your session.

Your inbound address can receive mail from anyone. We process only mail sent from your own account email address; other mail is discarded without reaching your canvas, and we retain from it only a delivery identifier used to avoid processing the same message twice.

To link a phone, you enter its number in the Service and then text the WhatIF number from that phone, which shows the phone is yours. We answer only texts from a phone linked to an account. A text from a number that is not linked is not processed or stored; we may send that number one short reply explaining how to link.

If you text us a voice message, we send its audio to a third-party speech-to-text provider to turn it into words, and your agents answer those words as if you had typed them. We keep the words with your texts; we do not keep the recording.

We collect information when you:

• create an account or sign in using Supabase-supported auth;
• enter prompts, upload or paste files or images, or save notes;
• create or edit sites, previews, and deployments;
• connect GitHub or other third-party services;
• purchase credits or otherwise use paid features;
• send email to the inbound address we assign to your account, if you enable that feature;
• link a phone and send text messages to the WhatIF number;
• send us feedback from within the app;
• use the app, previews, and related pages in your browser.

We use information to:

• provide, maintain, secure, and improve the Service;
• authenticate users and manage accounts;
• store, sync, preview, publish, and otherwise process your content;
• run AI features, including sending prompts, files, images, and related context to third-party model providers;
• process payments, credits, refunds, disputes, and usage records;
• monitor usage, troubleshoot errors, and prevent abuse;
• read, investigate, and respond to feedback you send us;
• reply to the text messages you send us, and send you the text messages you ask for, such as a message when work you started by text is finished, or a message an agent sends at your request;
• communicate with you about the Service.

When you use AI features, we may send prompts, files, images, URLs, and other relevant context to one or more third-party AI providers in order to generate responses or provide related features. The specific providers we use may change over time as we add, remove, or substitute vendors. If you ask the Service to observe or inspect a URL, we may also fetch that URL and capture screenshots or related context for model processing.

When an agent looks for pictures for your work, it sends the words of its search to image sources: Unsplash for photographs, and the public collections of The Metropolitan Museum of Art, the Smithsonian Institution, the Art Institute of Chicago, the Cleveland Museum of Art and the Rijksmuseum for public-domain art. Only the search words are sent, not your account details. Unsplash photographs are shown from Unsplash's own servers, so your browser loads them from Unsplash when you view them, and we tell Unsplash when one of its photographs is used in your work, as its terms require.

Some video features animate or change people, for example making a person in a picture speak or matching their lips to new words. When you use them, we send the images, video, and audio you choose, which may show a person's face or contain their voice, to third-party AI providers to make the new video.

Some WHAT IF features create public URLs, including preview URLs and named deployment URLs. Content published to those URLs may be accessible to anyone who has the URL. SHA-based commit content may also be retrievable through public endpoints if the SHA is known.

You can also make your canvas (your "space") available as a public, read-only view through a share link. If you enable sharing, the content in that space — such as notes, images, links, and other items — may be viewed by anyone who has the link, without signing in. Sharing is off by default and applies only to a space you choose to share.

You should not publish or share secrets, credentials, personal information, or other confidential information through these public features.

We use browser storage and similar local technologies to support app functionality, including session-related state, GitHub connection state, canvas preferences, and other product behavior.

We also use privacy-focused analytics tools to understand usage of the Service and improve the product.

We may share information with:

• service providers that help us operate the Service, such as Supabase, Stripe, analytics providers, hosting providers, email delivery and receiving providers, and AI model providers;
• image sources our agents search on your behalf, currently Unsplash and the public museum collections named in section 5, which receive the search words; Unsplash also receives a request from your browser when one of its photographs is shown;
• messaging providers we use for internal notifications, such as Telegram: feedback you send us, including attached images and the diagnostic information described above, is delivered to our team through Telegram;
• the messaging provider that carries text messages between your phone and the Service, currently Linq: if you link a phone, your phone number and the texts you exchange with us, including their photos and files, pass through and may be stored by that provider, and are delivered over Apple's iMessage service;
• third-party services you choose to connect, such as GitHub;
• law enforcement, regulators, or other parties when required by law or necessary to protect rights, safety, and the Service;
• a buyer, investor, successor, or affiliate in connection with a corporate transaction or reorganization.

We store information using a combination of service providers, hosted infrastructure, and local or cloud-backed systems used to operate WHAT IF. This may include authentication and database providers, payment processors, hosting providers, and local repository storage used for app functionality. Where you use email features, this also includes email providers that send our messages and receive mail addressed to you, and that hold those messages and their attachments on our behalf. Feedback you send us is stored in our database, its images in private cloud storage, and a copy is delivered to our team through Telegram. If you link a phone, we store its number and the texts you exchange with us in our database, and the photos and files you text us in your library, alongside the rest of your content; a voice message you text us is kept only as its words, not its audio. The messaging provider that carries those texts also holds them on our behalf.

We keep information for as long as reasonably necessary to provide the Service, comply with law, resolve disputes, enforce our agreements, and protect the Service. Retention periods may vary depending on the type of information and how it is used.

We use reasonable administrative, technical, and organizational measures designed to protect information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

WHAT IF is not intended for children under 13, and we do not knowingly collect personal information from children under 13.

Depending on where you live, you may have rights to request access to, correction of, deletion of, or a copy of certain personal information, or to object to or limit certain processing. To make a request, contact us at [email protected] .

If you link a phone, you can unlink it at any time in the Service's settings, or by texting STOP to the WhatIF number; after that we stop answering and sending texts to it. You can also turn off, in settings, the texts we send when work you started by text is finished and the texts agents send at your request. Texting HELP to the WhatIF number returns a short explanation and how to reach us.

The Service may rely on providers and infrastructure that process information in the United States and other countries. By using the Service, you understand that your information may be transferred to and processed in jurisdictions that may have different data protection laws than your own.

We may update this Privacy Policy from time to time. If we make material changes, we may provide notice by updating the effective date, posting the revised policy in the Service, or using another reasonable method.

If you have questions about this Privacy Policy or our privacy practices, contact us at [email protected] .