What Mekkapp keeps, and how to leave.

What to expect from an alpha

Things will break, and we will change them without notice. Your projects are kept in our database, but we cannot promise that nothing is ever lost. Keep a copy of anything you would miss: “Download the code”, on each app's page, gives you its source at any time.

Some buttons in Mekkapp send what you write about your app to an AI model run by another company. Who handles it lists each one and says what it sends. Everything else is done by our own code and sends nothing anywhere.

What we store

Your account: first name, last name, email address, a hash of your password (never the password), whether your address is confirmed, the language you use Mekkapp in, your plan and the AI it gives you each month, and the times you registered and last logged in.

If you answer the questions after you sign up: what you want to make first, and whether you have written code before. You can skip them.

Your projects: what you wrote about each app, and everything Mekkapp made from it: what it keeps, its screens, the code the AI wrote, its look and its icon. With them, the app as it was after each of your last 30 changes, so you can go back, and every change of its data, so its database can follow. When you last tried it in the phone and last downloaded its code. Plus any picture you upload for it, such as its icon, and nothing else.

Your chat with the AI about each app: your messages and its answers, the last 200, kept with the app and deleted with it.

If you fill in your app's privacy policy: who publishes the app, an email for questions about its data, and the country. If you make that policy public, anyone with its address can read it, those details included.

If you connect an Expo account to a project, its access token, stored encrypted and used only to send that project's builds to Expo. You can disconnect it at any time, which deletes it.

If you connect a project with Supabase, the access Supabase grants Mekkapp to your Supabase account, stored encrypted. Mekkapp uses it only to list your Supabase projects, read the publishable key of the one you choose, set that project's tables up from your Data area, and count the rows a change of your data would touch, before you save it. It reads only how many rows there are, never what they hold, and never a secret key. You can disconnect at any time, which revokes it at Supabase and deletes it here.

Short-lived tokens for confirming your address and resetting your password, stored as hashes and deleted once used or expired.

If you change your email address: the new address, and a short-lived token for the link we send to it, stored as a hash.

The invite that let you in: your address, the code, and who accepted it.

If we send you an invite, its email carries a link to unsubscribe. Press it, and we keep your address and when you left, so that we never send you an invite or news again.

What we record when you use it

A log line per request to our server: the method, the path, the outcome, how long it took, your account id, your network address (which we need to limit abuse), and a request id. Request bodies are never logged, and email addresses and tokens are removed from log messages by the code that writes them. Our hosting provider keeps these logs for a short time.

If the app fails in your browser, it sends the error message, the code location, and the page path to our own server, which passes them on to Sentry (below) so we can fix it. There is no advertising, and no tracker that follows you from site to site.

For each call to the AI model, its numbers: which step and which app it was for, how long it took, how many tokens it used, and what it cost us. We keep them to make Mekkapp faster and to know what the AI costs; when your account is deleted they stay without your name or account. Never the words sent or answered.

If you send us feedback: your message, its kind, the page you were on, and its language.

If you press “I need this” beside something not possible yet: that line, the app it was for and its kind, and the language; under an answer of the AI, the question you asked too.

The invite request on the public landing page is separate and asks for its own consent.

Cloudflare, which already serves this site, counts visits to the public pages for us with Cloudflare Web Analytics: the home page, Help and this page. It uses no cookies and makes no profile of you. The pages of your account, your projects and your apps are never counted.

Who handles it

Cloudflare serves the web app from its network and, if you upload a picture such as an app icon, stores the file in its R2 storage. Render, in Oregon, USA, runs our server and holds the database. Resend delivers account email, which is the only email we send you: an address confirmation, and a password-reset link when you ask for one.

Sentry tells us when something breaks. When our server or the web app hits an error, we send Sentry the error, where it happened in our code, the page path, and at most an id for your account or project. Never your name, your email address, your password, your network address, what you wrote, or your app's code. Sentry keeps it for 30 days, in the European Union (Germany).

DeepSeek runs that model. We send it something only in these places. On the creation page: “Read my words”, “Change it” and “Create the app”. While you read what the AI understood, it already starts on the app's data and screens, so the app is ready sooner. After “Create the app”, our server goes on by itself: the data, the screens, the code and the icon, and a second try at any code that fails our checks. On the app's page: “Send”, for a question about the app or a change to one screen or to the whole app, with the last messages of your chat with the AI; “Point at a part” adds the part you chose to it. In Design: “Draw the icon”. In Settings, under Languages: “Add”, which has the AI write the app's words in another language.

We send what you typed, and what your app is made of: its name and description, the kinds of people who use it, what it keeps, its look, its screens with their code and their words, and its notebook of the changes you asked for. We never send your name, your email address, or anything else about your account. DeepSeek may keep what we send and use it to improve their own models; we have no model of our own, so we cannot prevent that. If you would rather an idea never left our server, do not use those places: nothing else in Mekkapp uses a model.

If you connect a project with Supabase, Mekkapp sends Supabase the SQL it writes from your Data area, to set up the tables in your own Supabase project. Before a change of your data is saved, it also sends a question that counts the rows the change would touch. It sends none of your account details.

Apart from those, nobody else receives your data. We never sell it, and we train nothing on it ourselves.

What is yours

What you build is yours. Mekkapp claims no rights over your projects or the source generated from them. Formal terms will be written before any paid plan exists; until then, this sentence is the promise.

Who it is for

Mekkapp is not for children under 13, or under 16 where the law of your country says so. If you think a child has given us their details, write to us and we will delete them. Each app made with Mekkapp says the same in its own privacy policy.

How to leave

Delete your account from your account settings at any time. It asks for your password and signs you out everywhere. Fourteen days later the account and every project in it are deleted for good, along with the invite you joined with; logging in before then keeps it all. If you connected Supabase, Mekkapp's access to it is revoked first. Download each app's code first if you want to keep it.

At the end of the alpha we may close tester accounts. We will tell you first, and delete your data on request.

If you cannot log in, write to us and we will delete the account for you after confirming it is yours.