Privacy Policy
Last updated 3 November 2026. Questions: hello@farbaek.com.
The short version
We collect what Farbaek needs to work: your email, your work, and usage. We use it to run Farbaek and keep it safe, never to sell or advertise. AI providers receive only what each request needs, and their terms don't let them train on it. You can export your projects, turn off emails and delete your account yourself.
On this page
Who we are
Farbaek is based in Sri Lanka. We decide how your personal data is used, which makes us its controller. Write to hello@farbaek.com about anything in this policy.
This policy covers www.farbaek.com, the Farbaek app, sites people publish on farbaek.si, and the Farbaek desktop app.
What we collect
- Your account: your email address, when you signed in, and the workspaces you belong to with your role in each. If you use Sign in with Apple, Apple gives us an ID for you and your email address, or a relay address if you choose to hide yours. On the website, Apple also offers your name, and you choose whether to share it; the iPhone app doesn't ask for it. We keep Apple's sign-in token so that deleting your account also ends your Apple sign-in with Farbaek, and if you stop using Sign in with Apple with Farbaek, Apple tells us and we sign you out. If you sign in with Google, Google gives us your email address, your name and the address of your profile picture.
- Your work: what you write to plan software, the files in your projects and their history, AI drafts and changes, approvals, check results, ProofPacks, and sites you publish.
- Usage: how much AI and sandbox time each workspace uses, so plans and limits work.
- Visits to our public pages, only if you allow it: through Google Analytics, which pages you view, how you got there, and your browser, device and rough location. Signed-in pages and the Android app never collect this.
- Messages: support requests you send us and our replies, and the emails we send you.
- Security records: our sign-in service logs sign-in attempts with the email address and the IP address they came from. We keep a one-way fingerprint (a SHA-256 hash) of each address that has had a free trial, so the same address can't start another. To limit how many sign-in emails can be requested, we count requests by fingerprints of the email address and the network address.
Why we use it
Under the GDPR and similar laws, each use needs a lawful basis:
- To provide Farbaek: your account, your workspaces, the AI work you ask for, checks, publishing and support. That's needed for our agreement with you.
- To keep Farbaek safe and fair: security logs, rate limits, one trial per address. That's our legitimate interest, and yours.
- To send emails about your own work and your trial. You can turn both off in Settings, under Email.
- To see which public pages help people, through Google Analytics, only if you allow it. That's your consent, and you can withdraw it any time under Cookie choices.
- To keep tax and payment records for paid plans, because the law requires it. Dodo Payments keeps your payment details; Farbaek never sees your card.
- When you subscribe in Farbaek for iPhone, Apple handles the payment. Apple sends us the purchase's product, dates and the workspace it's for, signed by Apple, never your payment details.
- When you subscribe in Farbaek for Android, Google Play handles the payment. We keep the purchase's token to ask Google about it, and Google tells us its product, dates, state and order number, never your payment details.
We don't sell your personal data, share it for advertising, or use it to train AI models. We don't make decisions about you that are based only on automated processing and have legal or similarly significant effects.
AI and your work
When you ask Farbaek to draft a plan or a change, what you wrote and the files you chose go to one AI provider: Anthropic (Claude) or Google (Gemini). Only what that request needs is sent.
Anthropic's commercial terms don't let it train its models on what we send. It deletes API inputs and outputs within 30 days, except content its safety systems flag, which it can keep for up to two years. We use Gemini only on a paid account, whose terms don't let Google use the content to improve its products.
When someone in your workspace asks for a second check on a change, its contract, plan and file diffs go to a second AI model, from OpenAI or Anthropic. OpenAI's API terms don't let it train its models on what we send. It keeps API inputs and outputs for up to 30 days to check for abuse, longer only when the law requires it or to protect people from harm, and we ask it not to store the answers.
If an owner or admin gives your workspace its own Anthropic key, those requests go to Anthropic, or through their company's own server, under that account's own terms. Farbaek keeps the key encrypted and never shows it again.
Farbaek labels AI-drafted work, records which model drafted each change, and asks you to review it before it's applied. AI output can be wrong; see our Terms.
Who processes it for us
These services handle personal data on our behalf, under their data processing terms:
Anthropic
- What for
- AI models (Claude) that draft plans and code changes from what you write and the files you choose
- Data
- Prompts, chosen file contents, AI output
- Where
- United States
Google
- What for
- AI models (Gemini): image generation, and drafting when the server uses them instead of Claude, on a paid account only
- Data
- Prompts, chosen file contents, image descriptions, AI output and generated images
- Where
- United States
OpenAI
- What for
- A second AI model that checks a proposed change against its contract, when someone in your workspace asks for a second check
- Data
- The change's contract, plan, policy decision and file diffs, and the model's answer
- Where
- United States
Google Analytics
- What for
- Counting visits to our public pages, only if you allow it there
- Data
- Pages viewed, how you arrived, your browser and device, a rough location from your IP address, which Google doesn't keep, and a random ID in a cookie
- Where
- United States
Hosting provider
- What for
- The servers that run Farbaek: the app, its database, sign-in and nightly backups
- Data
- Everything Farbaek stores
- Where
- United States
Off-site backup storage
- What for
- A second copy of each nightly backup, kept apart from our servers and deleted after the same 14 days
- Data
- Everything Farbaek stores
- Where
- United States
Test space provider
- What for
- Isolated, temporary computers that run your project's checks, builds and previews
- Data
- Project files, commands and their output
- Where
- United States
Email delivery provider
- What for
- Sending sign-in links and the emails you choose to get
- Data
- Your email address and the email's content
- Where
- A United States company
Bot check at sign-in
- What for
- Telling people from automated sign-ins
- Data
- Your IP address and signals from your browser
- Where
- A United States company's worldwide network
Service What for Data Where Anthropic AI models (Claude) that draft plans and code changes from what you write and the files you choose Prompts, chosen file contents, AI output United States Google AI models (Gemini): image generation, and drafting when the server uses them instead of Claude, on a paid account only Prompts, chosen file contents, image descriptions, AI output and generated images United States OpenAI A second AI model that checks a proposed change against its contract, when someone in your workspace asks for a second check The change's contract, plan, policy decision and file diffs, and the model's answer United States Google Analytics Counting visits to our public pages, only if you allow it there Pages viewed, how you arrived, your browser and device, a rough location from your IP address, which Google doesn't keep, and a random ID in a cookie United States Hosting provider The servers that run Farbaek: the app, its database, sign-in and nightly backups Everything Farbaek stores United States Off-site backup storage A second copy of each nightly backup, kept apart from our servers and deleted after the same 14 days Everything Farbaek stores United States Test space provider Isolated, temporary computers that run your project's checks, builds and previews Project files, commands and their output United States Email delivery provider Sending sign-in links and the emails you choose to get Your email address and the email's content A United States company Bot check at sign-in Telling people from automated sign-ins Your IP address and signals from your browser A United States company's worldwide network We'll update this policy before we use a new kind of service that handles personal data. To know which company provides each service above, write to support@farbaek.com.
Paid plans on the web are sold by Dodo Payments, our merchant of record. It runs checkout, works out tax, keeps your payment details and issues receipts, as its own controller under its own privacy policy, which its checkout page links to. Farbaek never sees your card.
If you connect your own hosting account, such as Vercel or Netlify, we send your project's files to that account only when you launch, and the provider handles them under your own agreement with it, not ours. We keep the token you gave us encrypted, never show it again, and delete it when you disconnect.
When someone runs a security check on a project, we look up the names and versions of the packages its lockfiles list in a public vulnerability database. No code, file contents or account details go there. The rest of the check runs inside the disposable test space and sends nothing about your project anywhere. Only the rule, file and line of each finding come back.
If an owner or admin connects GitHub with a token, we send the files of a change to the linked repository only when someone opens a pull request for it, with the change's summary and its ProofPack result. GitHub handles them under your own agreement with it. We keep the token encrypted, never show it again, and delete it when you disconnect.
If you send a folder between your computers over the internet, the Farbaek Agent encrypts it end to end before it leaves. Our server passes the two computers the details they need to connect directly, including each one's network address, and the files then go between them without touching our server; each computer learns the other's public address. If you choose Farbaek's relay instead, our server passes the encrypted bytes along without being able to read them. They're held in memory only while both computers are connected, and never written to disk. We record which two agents took part, how many bytes passed through the relay, and each workspace's daily total, for its allowance.
If you use Mesh on a phone or in a browser, that browser keeps its own device key and the computers you paired it with in its storage on that device; the key's private half can't be read out of the browser. Clearing the site's data there forgets them. While you make that browser reachable, our server remembers it in memory only, and forgets it once the page closes. Files you receive there are kept in that browser's own storage on the device, or in the page's memory, until you clear them; we don't keep a copy.
If you turn on notifications on a device, we send them through that browser's push service: Google, Apple, Mozilla or Microsoft. Each message is encrypted for your device, so the service sees only that one was sent. Turn them off in Settings, under This device.
Where it's stored
Farbaek runs on servers in the United States, and is operated from Sri Lanka. So your data is processed in the United States and can be reached from Sri Lanka, which may not have the same data protection laws as where you live. Where the law requires it, transfers to our processors rely on safeguards such as the European Commission's standard contractual clauses in their data processing terms.
How long we keep it
- Your account and your work: until you delete them, or your account. Deleting is immediate in Farbaek itself.
- Nightly backups: each is overwritten after 14 days, so deleted data is gone from them within 14 days. Until then it's kept out of use.
- Server and sign-in logs: kept until newer lines overwrite them, oldest first, which can take several months.
- Trial fingerprints: kept, because they only exist to stop repeat trials and can't be turned back into an address.
- Sign-in request counts: deleted within 24 hours.
- Analytics, if you allowed it: Google Analytics keeps visit data for 14 months.
- In workspaces you leave or that others own, what you did there stays, such as tasks, approvals and history, but tied to an ID that no longer points to you.
Your rights
You can ask to see, correct, export or delete your personal data, or to restrict or object to how we use it. Most of it you can do yourself:
- Download what we hold about you in Settings, under Your data: one JSON file.
- Delete your account in Settings, under Delete your account. You'll see what happens to each workspace first.
- Export a project with its files, tasks, ProofPacks and history: Export everything, on the project's page.
- Turn off emails in Settings, under Email.
For anything else, write to support@farbaek.com. We answer within one month. If you're in the EU or UK, you can also complain to your data protection authority.
Security
Your workspace's data is separated from others' in the database, every change goes through the server, and Farbaek never runs your project's code on its own servers: checks run in isolated sandboxes. No system is perfectly secure. If a breach puts your data at risk, we'll tell you and the authorities as the law requires. You can see how we test our own boundaries on the security tests page.
Age
Farbaek is for people aged 13 and over; under 18, with a parent's or guardian's agreement. We don't knowingly collect data from anyone younger than 13. If you think a child has signed up, tell us and we'll delete the account.
Changes to this policy
We'll post any change here with a new date. If a change matters to how we use your data, we'll email you before it applies.