← Back to F18

Privacy policy

Draft for review — not a final policy. Details marked [TO COMPLETE] must be filled in and the text reviewed by a qualified professional before publication.

Draft date: October 2026

1. Who is responsible

Controller: [TO COMPLETE: operator legal name and address]. Contact for privacy requests: [TO COMPLETE].

2. What we store on our servers

Guest identity: a random identifier and its sign-in records (creation and last sign-in times). We do not ask for your name, email address or phone number.

Your history: the field and category, your answers and free-text details, the current question and screen, interface language, chosen target system and usage mode, agent names, statuses and dates, and each saved prompt exactly as shown, with its answers, questionnaire version and date.

Security data: if you set a lock code or create a recovery key, only salted or one-way hashes of them are stored, together with counters of failed attempts and lock-out times. The code and the key themselves are not stored.

Deletion markers: when you delete an agent, its identifier (without content) is kept so that a late synchronisation from another device cannot recreate it.

Protection counters: to refuse unusual volumes, we keep short-term counters keyed by a one-way hash of your network (IP) address or of your guest identifier. The address itself is not stored by F18 in readable form; each counter is overwritten in the next time window.

Anything you type in free-text fields is stored as you wrote it. Please do not enter sensitive personal data, passwords or secrets.

3. What is stored on your browser

See the Cookies & browser storage policy: the guest sign-in session, your interface language, a working copy of drafts and changes waiting to synchronise.

4. Why we use it

To save your progress, show your history back to you on this browser or on a device you restored with your key, keep your prompts and versions, protect access with the lock code and recovery key, and keep the service secure and available. We do not use your data for advertising or profiling, we do not sell it, and F18 uses no analytics or tracking tools.

5. Legal basis

[TO COMPLETE: legal basis under the applicable law, for example providing the service you request and a legitimate interest in security.]

6. Service providers and storage location

Database and guest identities: Lovable Cloud, provided by Lovable, which relies on its own infrastructure sub-processors. According to the project's technical configuration, the database is hosted in the London, United Kingdom region (eu-west-2). [TO COMPLETE: confirm the list of sub-processors and transfer safeguards with Lovable.]

Website delivery: the site is served by Lovable's hosting [TO COMPLETE: confirm the hosting/edge provider and its locations]. To deliver pages and requests, these providers process technical data such as IP address, browser type and request time.

F18 does not send your answers or prompts to any AI provider. You decide where to paste your prompt.

7. Security

The server allows each guest identity to reach only its own history. When a lock code is enabled, the database refuses to return or save the history until the code has been verified on the server, and repeated wrong codes or recovery keys are temporarily blocked. Communication is encrypted in transit (HTTPS). No system is completely secure.

8. Retention and deletion

Your history is kept until you delete it. You can delete a single agent (with all its versions) or your entire history from My agents. Deleting the entire history immediately removes from the database all agents, versions, the lock code, the recovery key and your guest identity, and clears the drafts kept on this browser.

Retention of inactive histories: [TO COMPLETE]. Server and access logs kept by the service providers (which may include IP addresses): [TO COMPLETE: retention period]. Backups: [TO COMPLETE: frequency and retention]; deleted data may remain in backups until they expire.

9. Your rights

Depending on the applicable law you may request access to, correction, deletion or a copy of your data. Most of these actions are available directly in My agents (open, download, rename, delete). Because we do not know who you are, we may ask you to show control of the history, for example from your browser or with your recovery key. Contact: [TO COMPLETE]. You may also complain to a data protection authority.

10. Changes

We may update this policy; the draft date above will change.

Details to complete

  • • Operator legal name, registration number and postal address
  • • Contact address for privacy, accessibility and general requests
  • • Accessibility coordinator name and contact details
  • • Rights holder of the software and design
  • • Governing law and jurisdiction
  • • Legal basis for processing under the applicable law
  • • Confirmation from Lovable of sub-processors and transfer safeguards
  • • Website hosting/edge provider, its locations and any technical cookies it sets
  • • Retention of inactive histories, provider logs and backups
  • • Result of a formal accessibility audit, if performed