Privacy Policy

Last updated 5 October 2026

Wapper.ai turns a sentence into a working app. This page says what we collect while doing that, who else sees it, and how long we keep it. It is written to be read, not to be impressive.

Who is answerable for it

Wapper.ai is run by Mohit, a sole proprietor in India trading as GlobeStack. Under India's data protection law that makes him the data fiduciary for everything described here — the person accountable for it, rather than a company name with nobody behind it. Wherever this page says "we", that is who it means.

support@wapper.ai is the address for anything on this page, including a complaint you want treated as one. It reaches a person, not a ticket queue.

What we collect

Your account

Your email address, and either a password or a Google account identifier, depending on how you log in. Passwords are never stored — we keep only a one-way hash (argon2id), which cannot be turned back into your password.

Your sessions

When you log in we record the time, and may record your IP address and browser identification string, so you can see where your account has been used and so we can tell a normal login from an attack. Login tokens are stored only as a one-way hash, which means a copy of our database would not let anyone log in as you.

Your country

When you register we note which country you are in, from your IP address, because prices and tax depend on it. We keep the country, not the address it came from.

What you type

The descriptions you write to build an app, and the app that comes back. We also keep a record of what was sent to the AI model and what it returned, so that when a build goes wrong we can see why. These records are tied to your account.

Error reports

When something breaks in Wapper.ai — on the website or in the app — it sends us a report: the error, the page it happened on, your browser or device's identification string, and which account was logged in. We use these only to find and fix problems.

What we do not collect

No analytics, no advertising identifiers, no tracking pixels, and no cookies for tracking. We do not buy or sell data about you. We do not build a profile of you across other websites.

Data inside the apps you build

Where an app keeps what people type into it depends on whether it is shared.

• An app only you use keeps its data — a counter's count, a list you type in — in the browser or device of the person using it. That data is not sent to us.
• An app shared with members keeps its data on our servers, so every member sees the same thing. It is stored in a database of its own for that app, on Neon's servers in Singapore, and changes are passed between members through Cloudflare as they happen. We also keep the email address of each member the owner invites. The owner decides who is a member, and can remove anyone.

We do not look at the data inside your apps, except to keep the service running or when the law requires it.

Who can open your apps

Every app gets its own web address, like your-app-name.wapper.app.

• A public app can be opened by anyone who has the link, or guesses it, and is not hidden from search engines by default.
• A private app opens only for the people its owner has invited, after they log in.

Anyone who can open an app can also read its code, with their browser's view-source. Do not put anything secret in an app's description or design — passwords, keys, private notes.

The Android app

The Wapper.ai app for Android does what the website does, and a few things only a phone can:

• Continue with Google uses your phone's Google account. Google tells us your email address and your Google account identifier, as on the website.
• Background sync. For shared apps you are a member of, the app fetches their latest data about every 15 minutes, so they open up to date. That data is kept on your phone. You can turn this off in Settings.
• Nothing is backed up. The app keeps your login sessions on your phone and leaves them out of Android's backups, so a new phone logs in again.

The app does not read your contacts, photos, location or anything else on your phone, and it has no advertising or analytics code in it.

Who else sees your data

We use a small number of companies to run the service. Each sees only what it needs to.

• Google — the descriptions you write are sent to Google's Gemini model to build your app. Google processes them under its own terms.
• Cloudflare — serves this website and your apps, stores the app files, and runs the process that builds them. Sees the network traffic that reaches us.
• Fly.io — runs our server, in Singapore.
• Neon — stores your account, the list of apps you have made, and the data of shared apps, in Postgres databases on servers in Singapore.
• Paddle — takes payments for credit and plans, as the seller of record. Sees your email address, your country and your payment details; we never see your card number.
• Resend — sends account emails, such as verifying your address or resetting your password. Sees your email address.
• Google Fonts — this website loads its typefaces from Google, which means Google sees the IP address of anyone visiting this page.
• esm.sh — apps you build load part of their machinery from this public service, so it sees the IP address of anyone opening one of your apps.

We do not give your data to anyone else. If we are ever legally required to, and are permitted to tell you, we will.

Where your data is

Mainly India and Singapore, with some traffic passing through Cloudflare's network worldwide. The AI model runs on Google's infrastructure.

How long we keep it

• Your account — until you ask us to delete it.
• Your apps, and the data of shared apps — until you delete them, or ask us to delete your account. A deleted app is purged 7 days later; until then it can be restored if you ask.
• Build records — the AI request and response logs, kept while they are useful for fixing problems, and intended to be deleted automatically after 30 days.
• Error reports — 90 days, then deleted automatically.
• Login sessions — 30 days from last use, or immediately when you log out.
• Email verification and password reset links — a short time, and single-use.

What you can ask for

Email support@wapper.ai and you can ask us to show you what we hold about you, correct it, delete it, or delete your account entirely. We will do it, and we will not make it difficult. Deleting your account says exactly how, and what is deleted and kept. Under India's Digital Personal Data Protection Act, 2023, you may also withdraw consent and raise a grievance; the same address reaches us for both.

Security, honestly stated

Passwords and login tokens are stored as one-way hashes. Traffic is encrypted in transit. Only our own server can reach the database.

We are a very small operation in early testing. We do not have a security team, and we would rather tell you that than imply otherwise. Treat Wapper.ai as somewhere to build things, not as somewhere to keep anything sensitive.

Children

Wapper.ai is not intended for children under 18, and we do not knowingly create accounts for them.

Getting in touch

support@wapper.ai — for anything on this page, including a complaint.