Privacy policy

What we collect

Your account: your name, your email address, and your password, which we store only as a salted one-way hash. A profile photo and avatar colour if you choose them.

If you sign in with Google: your Google account’s ID, its email address (only if Google has verified it), your name and your profile photo. We ask Google only for these (the openid, email and profile scopes). We don’t get your Google password or access to Gmail, Drive, contacts or anything else.

Your work: the designs, comments, images, fonts, versions and history you and your team create, and what connected agents (such as Claude Code or Codex) do in them on your behalf.

Running the service: the network address of each request, used for rate limits against abuse and kept in short-lived logs; error reports from the app (the message and the page, without design content); and which emails we sent, recorded without their content.

How we use it

To run Repen: sign you in, keep your designs, show them to the people and agents you share them with, and send account emails (confirmation codes, password reset links, invitations someone sends you, and notifications you turn on).

We don’t sell your data, show ads, or use third-party analytics or tracking cookies. We don’t use your designs to train AI models.

Information from Google

We use the Google information above only to sign you in, to link Google to your Repen account, and to fill in your name and photo when you create an account with Google. You can remove Google from your account in Settings · Password at any time.

Repen’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Who else handles it

Cloudflare hosts Repen (its servers, database, file storage and email sending) and so processes everything above for us.

When you or an agent ask for stock photos or generated images, the search words or prompt go to the provider that answers them (such as Unsplash, Pexels, Pixabay, Openverse, or Google’s image model through Cloudflare). Unsplash photos are shown straight from Unsplash, so your browser contacts it to display them.

Google, when you choose to sign in with Google.

Cookies and your browser

We use only the cookies Repen needs: your sign-in session, a guest session on public design links, and short-lived cookies that keep a Google sign-in safe. The app also keeps copies of unsaved edits in your browser so they aren’t lost, and clears them when you sign out.

Keeping and deleting

We keep your account and work while you use Repen. You can delete your account in Settings · Profile: that removes your name, email, photo and sign-in methods, signs you out everywhere and deletes the workspaces only you were in from the app. Their stored content is not erased at once; write to us and we’ll erase it completely.

Database backups are kept for up to 30 days.

Your choices

You can see and change your details in Settings, and turn email notifications off there or with the link in each one. To get a copy of your data, correct it or have it erased, write to hello@repen.app from your account’s address.

Repen isn’t meant for children under 16.

Changes

If we change this policy in a way that matters, we’ll say so in the app or by email before it applies.