Privacy policy

What we collect

• Account details — your name and email address when you sign up. Passwords are stored only as one-way bcrypt hashes; we never see or store plain-text passwords.
• Your websites — the pages, sections, content and settings you create, so we can save, render and publish them for you.
• Session cookie — one strictly-necessary cookie (create_io_session) that keeps you logged in for up to 30 days. See our cookie policy.
• Guest drafts — if you try the builder without an account, your edits stay in your own browser (local storage) and are never sent to our servers.

How we use it

Your data runs the service: authentication, saving your work, publishing your sites, and keeping everything secure. We do not sell your personal data, we run no third-party advertising trackers, and we do not use your site content to train models.

Where it lives

Account and website data is stored in a managed PostgreSQL database (Neon) in production. Passwords are hashed with bcrypt before storage.

Your choices

• View and edit your profile any time from account settings.
• Delete a website from your dashboard — published pages for that site stop being served.
• Log out from any device to invalidate the session cookie immediately.
• To request a copy of your data or deletion of your account, contact us through the site and we will action verified requests within 30 days.

Changes

If this policy changes materially, we will update the date above and, for significant changes, note it in the product. Continued use of PANA after a change means you accept the updated policy.