Privacy Policy
Last updated September 3, 2026
This page explains what PWAfy collects, why, and who it's shared with. The short version: the actual PWA generation (manifest, icons, splash screens, service worker) happens entirely in your browser and is never uploaded anywhere. The only data we handle is what's needed to run optional accounts and payments.
1. Data that never leaves your browser
The icon you upload, the generated manifest, service worker, splash screens, and ZIP file are produced on-device using the Canvas API and never transmitted to our server or any third party. If you never create an account or pay for a plan, PWAfy collects nothing about you at all.
2. Data we collect and why
| Data | When | Why |
|---|---|---|
| Email address | You sign in | Passwordless (magic-link) authentication, via Supabase Auth |
| Saved preset config (app name, colors, description, etc.) | You save a preset | So you can reuse a brand across builds |
| Plan status & build count | You use a paid plan / generate a build | Enforcing plan limits and entitlements |
| IP address | Every request to our Worker | Rate limiting and abuse prevention only; not linked to your account and not stored beyond the short windows below |
| The URL you scan (if you use "Scan a URL") | You use the scan feature | Fetched server-side to read its title/description/theme-color/icon; cached briefly to avoid re-fetching the same URL repeatedly |
3. Payments
Card and bank-transfer payments are handled entirely by Paystack. We never receive, see, or store your card number, expiry, or CVV. Paystack's inline checkout runs in its own secured frame. We only receive a payment confirmation (plan, amount, success/failure) via a signed server-to-server webhook, which we verify before activating anything.
4. Third parties we use
- Supabase: authentication and database hosting for accounts, presets, and plan status.
- Paystack: payment processing (cards and Nigerian bank transfer).
- Cloudflare: hosts the site and our API Worker, and provides Turnstile bot-protection on the URL-scan endpoint.
- open.er-api.com: a keyless, free exchange-rate API used only to display approximate prices in other currencies. No personal data is sent to it, only currency codes.
We do not use advertising trackers, ad networks, or third-party analytics/marketing pixels. We don't sell or rent your data to anyone.
5. Cookies & local storage
PWAfy uses your browser's local storage, not tracking cookies, for: your dark/light theme choice, your signed-in session token (managed by Supabase's client library), and a cached exchange-rate lookup for the current tab session. None of this is used to track you across other sites.
6. How long we keep things
- Rate-limit counters: auto-expire within roughly a minute to an hour.
- URL-scan cache: auto-expires after 6 hours.
- Account data (email, presets, plan status): kept until you delete your account or request deletion.
7. Your choices
You can sign out at any time, cancel a paid plan yourself from the account menu (drops you back to Free immediately), and delete individual presets. To request full account deletion, contact us with the email address associated with your account.
8. Data location & security
Data is stored with our infrastructure providers (Supabase, Cloudflare), which encrypt data at rest and in transit. Access to your account data is protected by row-level security policies so that, by default, only your own signed-in session can read or write your own rows.
9. Children's privacy
PWAfy isn't directed at children and we don't knowingly collect data from anyone under the age required by applicable law to consent to data processing in their jurisdiction.
10. Changes to this policy
If this policy changes materially, we'll update the date at the top of this page. Continued use after an update means you accept the revised policy.
11. Contact
Questions about this policy, or a data-deletion request, can be sent via the contact details on ayocodes' portfolio site.