Privacy Policy

This policy explains what information First.new collects, why, and the choices you have. First.new is operated by Autorender Inc., a corporation incorporated in Delaware, United States (“we”, “us”). It works alongside our Terms of Service.

• Account details. Your name, email address, and profile picture when you sign up or sign in with Google, GitHub, or email. If you link Discord, we receive your Discord username and ID.
• What you build. Your prompts, chat messages, uploaded files, and the code and apps generated for you.
• Billing details. If you subscribe, Stripe handles your payment. We receive your plan and payment status, never your full card number.
• Integrations. If you connect a service like Supabase, we store the access it grants and use it only to do what you ask.
• Usage and device data. Pages you visit, features you use, and basic technical details like browser, device, and IP address. When session replay is on, this can include clicks and scrolling so we can find bugs.

Data in your apps. An app you build may collect information about your own customers or other users. Connected services may also supply records that you ask First to work with. This can be different from the information used to manage your First account. You are responsible for having permission to provide that information, explaining your app’s data practices to its users, and configuring appropriate access controls.

• To run the Service: build, preview, and publish your apps.
• To manage your account, credits, and subscription.
• To fix bugs, prevent abuse, and keep the Service secure.
• To understand what’s working and improve First.new.
• To contact you about your account, important changes, and — if you haven’t opted out — product updates.

To generate your app, we send your prompts, messages, files, and project code to the AI providers used for your request. When OpenRouter is enabled, requests pass through OpenRouter to the selected model provider. We don’t use your content to train AI models. Providers may also retain or review information for service operation, safety, abuse prevention, or legal requirements under their applicable terms and our agreements. This is not a promise of zero retention or immediate deletion by every provider.

When you publish an app, its public pages and assets become accessible through its published address. Showcase listings and shared templates are also public. Review the material you expose before sharing it. Publishing an interface does not by itself make every database record public: access to records depends on the app’s authentication and access rules. Keep secrets out of public code and assets, and check that private pages, files, and customer records have appropriate access controls.

When LangSmith tracing is enabled, traces can include prompts, model responses, tool inputs and results, and execution details used to investigate how a build behaved. Connected records included in a build can therefore appear in those traces. Tracing is separate from optional website analytics and is not controlled by the website’s cookie choices.

We don’t sell your personal information. We share it only with providers that help us run First.new, and only what each one needs:

We may also share information if the law requires it, to protect people or the Service from harm, or as part of a merger or sale of our business — in which case this policy continues to apply.

We use essential storage to keep you signed in, protect your account, remember privacy choices, and provide core features. These are not controlled by the optional tracking switches. Blocking them through your browser may prevent sign-in or other core features from working.

If you allow Analytics, PostHog and Google Analytics help us understand visits, traffic sources, feature usage, product performance, and where people encounter problems. Browser analytics can include account and project identifiers and feature events. When session replay is enabled, it starts only after analytics consent. We configure it to mask input values, prompts, and text in project details, menus, dialogs and errors, block the build conversation, app preview, images and code areas, and exclude network payloads and console recording. Replay helps us understand navigation and usability problems. Automatic page-content event capture remains disabled. We remove query strings and URL fragments from PostHog page URLs, mask invitation codes in tracked page paths, and avoid sending project-derived page titles to Google Analytics. You can turn Usage off in Cookie settings at any time to stop future analytics and recordings.

If you allow Marketing, Meta Pixel and HubSpot help us understand which campaigns lead to visits and registrations, measure ad performance, improve audience targeting, and connect a visit with a customer relationship record. They may receive page and campaign information, browser or device details, IP-derived location, cookie identifiers, and conversion events such as completing registration. We do not intentionally send them your prompts, project code, uploaded files, or payment-card details.

Optional analytics and marketing scripts do not load until you enable their category. Your choices are saved in local browser storage and apply to that browser. We also store limited campaign attribution information locally so it can survive sign-in redirects.

We may separately create service-side operational events when you use account features so we can provide the service, prevent abuse, and understand whether core product flows succeed; these do not read or write cookies on your device. Operational events can include account and project identifiers, feature actions, and success or failure information. Browser cookie choices do not switch off these server-side events or AI processing and tracing described elsewhere in this policy.

You can accept, reject, or change optional storage at any time using “Cookie settings” in the site footer. If you withdraw consent, we stop future optional browser tracking and ask the relevant tools to disable or remove their tracking storage. Withdrawing consent does not automatically delete information already received by a provider. Rejecting optional storage does not affect sign-in or core product functionality.

We keep information needed to provide your account and the service. To request account closure or deletion of your information, email care@first.new. We review requests and explain the action we can take, any information we need to retain for legal, tax, or security reasons, and the expected timing. Deleting a project does not immediately erase every stored file, backup, or record held by an external provider.

Information already sent to a connected service or AI provider is subject to that provider’s retention rules and applicable agreements. Disconnecting a service stops future access through that connection; it does not undo earlier actions or automatically erase records in that service. Removing a shared template does not recall independent copies that other users have already made.

You can ask us to access, correct, export, or delete your information, or to stop using it for a particular purpose. Email care@first.new and we’ll respond within 30 days. Depending on where you live — for example the EU, UK, or California — you may have additional rights, including the right to complain to your local data protection authority.

We use encryption in transit, access controls, and isolated build sandboxes to protect your data. No system is perfectly secure, so if you notice something wrong, please tell us right away.

Our providers may process data in the United States and other countries. When data moves across borders, we rely on appropriate safeguards such as standard contractual clauses.

First.new isn’t for children under 13, and we don’t knowingly collect their information. If you think a child has signed up, let us know and we’ll delete the account.

If we make significant changes to this policy, we’ll let you know by email or in the app before they take effect.

Questions or requests about your privacy? Email care@first.new.