LAST UPDATED · OCTOBER 26, 2026
This policy explains how CodeVF LLC, doing business as KickStartMVP ("KickStartMVP," "we") handles personal information when you use kickstartmvp.com, the dashboard, our CLI and API, and the hosting service (the "Service").
It doesn't cover the apps our customers build and host with us. If you use an app hosted on KickStartMVP, the business or person who runs it decides what it collects, and their privacy notice applies. We process that data only on their behalf, to run their app.
Two things we do for every hosted app, on its owner's behalf: we count its visitors so the owner can see them, from our own server logs (no cookies or tracking script), keeping a one-way hash of each visitor's IP address, the day, their country (looked up from the IP address before it is hashed), how many pages they loaded and which page paths they visited (with IDs and tokens in paths replaced by a placeholder), the site that sent them, and the ?ref= tag of the link they used, if it had one. And if the owner turns on the app's Feedback button, what a visitor types into it, plus an email address if they give one, is stored and shown to that owner.
Account details: your name, email address, username, and password (stored only as a hash). If you sign in with Google, we receive your name, email, and profile picture from Google. If you connect GitHub, we receive your GitHub username and access to the repositories you choose.
Billing details: Stripe handles payments. We never see or store your full card number. We keep your plan, billing status and interval, and Stripe customer and subscription IDs.
Your content: the code, files, and uploads you deploy; your apps' databases and their backups; environment variables and secrets you set; your prompts to the AI editor and its responses; if you sign in to a third-party tool such as Claude Code or Codex inside the Terminal, that tool's login tokens, which stay with the app's sandbox until you sign out or delete the app and which we don't read or use; build and runtime logs; deploy history; domain settings; and the email addresses of people you invite to an app.
Usage and device data: IP address, browser and device type, pages visited, actions in the dashboard, and timestamps. For our own visit counts, and to ask accounts on networks we've seen abuse from to confirm their email before publishing, we store a one-way hash of your IP address rather than the address itself.
Messages: what you send us by email or through support, and a record of each email we send you (address, subject, time and whether our email provider accepted it or sending failed, not its contents).
To run the Service: building, hosting, and restoring your apps; running AI edits you ask for; registering and connecting domains; showing logs and history; and processing subscriptions.
To keep it safe: preventing fraud, spam, and abuse; enforcing plan limits and our Terms; and investigating security issues.
To talk to you: account, billing, and deploy emails (you'll get these while you have an account), a one-time tip on getting started if you haven't built an app; if you have, a note the next day with your app's next step, one a few days later if you haven't been back, and a one-time note about your app and what's new if you've been away a while; a weekly summary of your apps' visitors (only on weeks they had any); and occasional product announcements. We never send two of those getting-started and come-back notes within 48 hours. You can unsubscribe from all of these with the link in the emails.
To improve the site, using aggregated analytics, and to comply with the law.
We don't sell your personal information, we don't use it for targeted advertising, and we don't use your code or content to train AI models.
Service providers that process data for us under contract: Amazon Web Services (hosting, storage, backups, email delivery, and domain registration), our other hosting providers, Stripe (payments), Anthropic and OpenRouter (the AI model providers that power the editor and receive your prompts and the relevant code; OpenRouter routes some requests to third-party providers such as DeepSeek, and ByteDance for image generation), Google (sign-in, Analytics, and reCAPTCHA; and OSV, its public vulnerability database, which receives the names and versions of your app's packages, never your code, when you open an app's Security tab), and GitHub (if you connect it).
People you choose: collaborators you invite to an app can see that app and its content.
Public image collections: when you choose a best-looking first build, the AI may search Openverse, Wikimedia Commons, the Art Institute of Chicago and the Metropolitan Museum of Art for pictures, using words drawn from your app's description. They receive those search words, not your account details.
Legal and safety: when required by law or valid legal process, or when needed to protect the rights, property, or safety of our users, the public, or KickStartMVP.
Business transfers: if KickStartMVP is involved in a merger, acquisition, or sale of assets, your information may transfer as part of it, and this policy will continue to apply to it.
We use a session cookie to keep you signed in. Google Analytics sets cookies (_ga and related) that help us understand how the site is used. You can block them in your browser or with Google's opt-out add-on. Google reCAPTCHA runs on sign-up and sign-in to stop bots and collects device and interaction data under Google's Privacy Policy and Terms of Service. We don't use advertising cookies. We don't currently respond to browser "Do Not Track" signals, because there's no common standard for them.
We keep account information while your account is open. Deleting an app removes its container and stored source right away. Database backups expire on a rolling 30-day schedule. Hosted-app visitor counts are deleted after 90 days. When you ask us to delete your account, we delete your apps and personal information within 30 days, except records we must keep for legal, tax, or accounting reasons (such as invoices) and backup copies that expire on their normal schedule.
From the dashboard you can download your source code, download or restore database backups (as your plan allows), update your account details, and delete apps. To delete your account, or to get a copy or correction of other personal information we hold, email hi@kickstartmvp.com from the address on your account. We may need to verify your identity first.
Depending on where you live, you may have more rights under state privacy laws, such as rights to know, correct, delete, or port your data, and to appeal a decision we make about your request. We honor these requests for every user, wherever you live, and we won't treat you differently for making one. If we deny a request, reply to our email to appeal.
We use reasonable safeguards, including HTTPS encryption in transit, encrypted storage for backups, hashed passwords, and a separate isolated container for each app. No system is perfectly secure, so we can't guarantee absolute security. If a breach affects your personal information, we'll notify you as the law requires.
The Service is for adults and isn't directed to children under 13. We don't knowingly collect personal information from children under 13. If you think a child has given us information, email us and we'll delete it.
We're based in the United States, and we store and process data in the United States. If you use the Service from outside the US, your information will be transferred to the US.
We'll post any changes here and update the date above. If a change is material, we'll email you or notify you in the dashboard before it takes effect.
Privacy questions and requests: CodeVF LLC d/b/a KickStartMVP · hi@kickstartmvp.com