Privacy Policy

Depending on how you use BuildLoop, we may process: account identity and profile information (such as display name, email, and sign-in provider metadata from Supabase Auth); workspace/project metadata (such as project name and connected public GitHub repository URL, owner, branch, and commit references); task goals, acceptance criteria, clarification answers, and generated task contracts; uploaded workspace specifications (PRD, FRD, BRD, Architecture, API Spec, ADR, Spec Kit bundles, and other supported technical documents); orchestration run and evidence metadata (status, checks, changed files, checker results, approval records); and limited operational/security logs needed to operate and protect the service.

If you join the public pilot waitlist on the landing page, we store the email address you submit, selected role, optional pain-point note (up to 500 characters), consent marker, and submission timestamp in Supabase. The waitlist is not readable through the public site.

BuildLoop does not intentionally collect passwords for third-party services, private repository credentials, or payment card data in the current release. Do not submit secrets through tasks or specification uploads.

We use the above information to authenticate users; provide workspace and project functionality; generate and execute bounded task contracts; analyze repository and specification context for planning; generate or refine acceptance criteria where implemented; run governed orchestration; produce checker/evidence results; maintain audit trails; prevent abuse and security incidents; and operate and improve service reliability.

BuildLoop does not use your data for advertising profiles, sell personal data, or operate an ad network in the current release.

Certain BuildLoop features may send task-relevant context to Google Gemini when required for functionality — for example bounded coding worker execution, task interpretation, or semantic planning where implemented. This may include portions of a task goal, contract fields, repository paths, and relevant specification excerpts — not your entire repository by default.

BuildLoop is designed to use minimum necessary context for the active task. API keys, internal prompts, and provider-side retention are not exposed in the UI. Google Gemini is a service provider used to operate AI-assisted features; Google ADK is a runtime framework used by BuildLoop and is not itself a separate data store.

Service providers and infrastructure used to operate BuildLoop may include: Supabase (authentication and Postgres application data); Google Cloud Run (application hosting); Google Firestore (orchestrator runtime/evidence persistence in production); Google Secret Manager (server-side secrets such as service role keys and Gemini API keys); Google Gemini API (AI-assisted worker/planning features); and GitHub (public repository source access).

Exact legal processor classifications may vary by deployment. This page describes operational roles rather than claiming formal certification under any privacy regime.

BuildLoop currently supports public GitHub repository connection for hackathon/demo scope. When you connect a repository, BuildLoop may inspect repository metadata, clone content into a controlled execution workspace, analyze files for task planning, and use repository state during validation and orchestration.

Private repository OAuth is not supported in the current release. BuildLoop does not claim ownership of your repository content. You are responsible for connecting repositories you are authorized to use.

Workspace specifications — including single documents and Spec Kit bundles — are stored as workspace context. Relevant files or sections may influence task planning and appear in Sources Used. They may be processed by AI when necessary for planning or execution assistance.

Specifications should not intentionally contain credentials, API keys, passwords, private keys, or production secrets. BuildLoop does not execute uploaded files as code.

You are responsible for having authority to upload specification material and for excluding sensitive content from uploads.

Do not enter or upload passwords, API keys, service-account credentials, access tokens, private keys, or production secrets into tasks, clarifications, or specification uploads. BuildLoop includes guardrails for sensitive goals, but you remain responsible for avoiding secret disclosure.

The landing-page waitlist stores contact and interest information in Supabase for pilot outreach. It is separate from authenticated workspace data.

Waitlist submissions do not automatically create an application account.

BuildLoop may retain account, project, task, contract, approval, specification, and operational records while your account/workspace remains active and as reasonably necessary for security, audit, and service operation.

Automatic deletion schedules are not fully self-service in the current release. Retention automation and export tooling may be expanded in future versions.

Depending on the feature set available to you, you may disconnect a repository, remove uploaded specifications, delete individual specifications or specification sets where supported, switch workspaces, and update profile information in Settings.

For access, correction, or deletion requests beyond self-service controls, contact the operator through the public GitHub repository issue tracker listed below. BuildLoop does not promise instant automated deletion of all backend records where retention is required for security or audit.

BuildLoop is designed with human approval for sensitive actions, protected-path enforcement, bounded contracts, workspace isolation (including Supabase row-level security where enabled), server-side secret storage, and evidence/audit records. See the Security Overview for more detail.

Privacy rights vary by jurisdiction. BuildLoop aims to follow practical principles of transparency, purpose limitation, data minimization, security, and user control. This page does not claim GDPR, UU PDP, CCPA, or other formal compliance certification.

If you believe you have privacy rights under applicable law, you may contact the operator using the channel below.

Privacy and security inquiries for this hackathon/demo release can be submitted through the public GitHub repository issue tracker: https://github.com/akbartantu/buildloop-hackathon-2026. A dedicated security contact address may be published before wider production use.