Privacy policy

Iconic is made by The San Francisco Design Company. This page explains what information we handle when you use Iconic: the website at withiconic.ai, the Iconic connector inside ChatGPT or Claude, and the sites you build and publish with it. It's in plain language, because that's how we'd want it explained to us.

The short version

• We collect what we need to run your account and host your sites, and nothing more.
• We don't sell your data, show ads, or track you across the web.
• Visitor analytics on published sites are daily totals only: no cookies, no profiles, and nothing that can follow a visitor from one day to the next.
• You can ask us for a copy of your data, or ask us to delete it, by email.

What we collect, and why

Your account

You sign in with Google. From that we receive your name, email address, and a Google account identifier, and nothing else from your Google account. We use these to sign you in, tie your projects to you, and send you transactional email about your account (never marketing you didn't ask for).

Your projects and sites

When you build with Iconic we store the things that make up your project: the instructions your AI assistant sends on your behalf, your site's content, code, and settings, saved checkpoints of your project's history, and any secrets (like API keys) you add. Secrets are encrypted at rest and never shown back, not even to your chat.

Form submissions on your site

If your published site has a form (a contact form, a waitlist), we store what visitors submit so you, the site owner, can read it. Visitors submit anonymously; we don't require or create accounts for them.

Visitor analytics on published sites

Published sites get simple, privacy-preserving visit counts. Here's exactly how they work:

• We store daily totals per site only, never individual visit events.
• We never store raw IP addresses, browser fingerprints, cookies, or full referrer URLs (only the referring domain, like "google.com").
• Distinct visitors are estimated from a hash that is salted with the calendar day and a server-held secret, so it cannot be reversed to an IP and cannot link the same visitor across days. There is no cross-day tracking.

Payments

Paid plans are handled by Stripe. Your card details go directly to Stripe. We never see or store full card numbers. Stripe shares with us what we need to run your plan: the plan you chose and its payment status.

What we deliberately don't do

• No selling or renting your data. Ever.
• No advertising, ad networks, or third-party ad trackers.
• No tracking you across other websites.
• No training AI models on your projects or your visitors' data.

Where AI fits in

Iconic runs inside the AI chat you already use. Your prompts are processed by that chat product, ChatGPT (OpenAI) or Claude (Anthropic), under their terms and privacy policies, through your own account with them. Iconic receives the instructions your assistant sends to build your site, and stores the resulting project content as described above.

Who processes data for us

We run on a small set of infrastructure providers, each doing one job:

• Instant (InstantDB): our database and sign-in provider; stores account and project data.
• Vercel: hosts published sites and runs the isolated build environments your projects are built in.
• Stripe: payment processing for paid plans.
• Postmark / Resend: deliver transactional email, like form-submission notifications.
• GitHub: stores checkpoint backups of your project's code history.
• Pexels: powers stock-photo search; receives your search terms only.
• OpenAI or Anthropic: the AI chat you choose to build through, under your own account and their own policies.

How long we keep things

We keep your account and project data for as long as your account is active. If you ask us to delete your account, we delete the personal data we hold about you and take your sites offline. Analytics rollups contain no personal data to begin with. Form submissions live until the site owner deletes them, the form, or the account.

Your rights

Email us and we'll act on it. You can ask what we hold about you, ask for a copy, ask us to correct it, or ask us to delete it. Depending on where you live these may be legal rights (GDPR, CCPA, and similar); we honor the requests either way.

If you visited a site built with Iconic

Site owners are responsible for their own sites and for the data those sites collect (like form submissions). We process that data on the owner's behalf. If you want something you submitted corrected or deleted, contact the site owner first, and if you can't reach them, email us and we'll help.

Security

Everything travels over HTTPS. Secrets you store are encrypted at rest. Payment details never touch our servers. No system is perfectly secure, but we build so that the sensitive things are the hardest to reach.

Children

Iconic isn't directed at children under 13, and we don't knowingly collect their data.

Changes to this policy

If we change how we handle your data, we'll update this page and its effective date. For meaningful changes we'll tell you by email or in the product before they take effect.

Contact

The San Francisco Design Company
izu@joincharm.com

Questions about anything on this page? Email us. A human reads it.