Privacy policy

Account information. When you sign in we receive your email address and, from Google or Apple, your display name (via Firebase Authentication). If you sign up with an email and password, Firebase Authentication holds the password; we never see or store it.

Content you create.Briefs, prompts, uploaded reference images, moodboards, generated images and videos, prototypes, brand assets, and the edits you make to them. This content is the product — it's stored so you can come back to it.

Usage and billing records. Which generations you run and their approximate compute cost (model, token and image counts), plan and credit state, and payment status. We use these to meter plans, show you your own usage, and operate the service. Card details go directly to Stripe — we never see or store card numbers.

Request metadata and logs. Like any web service, our servers record technical details of each request: IP address, timestamp, browser or client type, the page or API endpoint called, and error details. We use these only to keep the service running, debug problems, and prevent abuse. We do not build behavioral profiles from them and we do not use them for advertising.

Product analytics. Basic interaction events (pages viewed, features used, generations started) tied to your account identifier, so we can understand what to improve. We do not run third-party advertising trackers.

Cookies and local storage. We use strictly necessary cookies and browser storage to keep you signed in, remember your preferences (for example, theme and selected project), and protect forms. We do not use advertising or cross-site tracking cookies.

We do not knowingly collect sensitive categories of personal data (such as health, financial account, biometric, or government identifiers), and Northlit is not intended for use by anyone under 18. If you believe a minor has created an account, contact us and we will delete it.

To provide the service: generating designs from your prompts, storing your work, enforcing plan limits, and billing. To operate and improve Northlit: debugging, security and abuse prevention, and understanding which features matter. To communicate with you: transactional email about your account, billing, and the work you asked for. We don't sell your data, we don't share it for advertising, and we don't use your designs or prompts to train our own models.

We share personal data only with service providers that process it on our behalf to run the product, under contracts that limit their use to providing the service: Google Firebase (sign-in), Vercel (hosting, serverless compute, and file storage), Neon (database), Stripe (payments), Resend (transactional email), and Mixpanel (product analytics).

When you generate, your prompts and reference images are sent to the AI model provider that serves the request — such as Anthropic, OpenAI, Google, or fal.ai — to produce the output, under our agreements with them. If you configure your own provider keys (BYOK), those requests run against your account with that provider instead, under your agreement with them.

We may also disclose data when required by law, to protect the rights and safety of our users or the public, or as part of a merger or acquisition, in which case this policy continues to apply to the data transferred. These providers may be located in the United States or other countries; where data leaves the region it was collected in, we rely on the providers' standard contractual safeguards.

Northlit can be used from AI assistants — ChatGPT and Codex through the Northlit plugin, Claude and other agents through the Northlit MCP connector. When you connect one, you sign in to Northlit with OAuth and the assistant receives a token for your account. The assistant then sends us the requests it makes on your behalf (for example, a brief to explore or an image to edit), and we return the results, which the assistant displays. We receive only what the assistant sends to our tools; we do not receive your other conversations with that assistant. What the assistant's provider does with your conversation is governed by that provider's own privacy policy. You can disconnect an assistant at any time in Settings → API, which revokes its token immediately.

Your work is private to you (and to project collaborators you invite) by default. Some actions publish deliberately: deploying a prototype creates a public URL, minting a build handoff link creates a tokenized document readable by anyone holding the link, and sharing a board or brand book grants access to the people you share it with. You decide when that happens and can unpublish or stop sharing at any time.

API keys and OAuth connections act as your account: anything an agent creates, reads, or spends happens under your identity and billing. You can see and revoke every key and connection in Settings → API, which cuts off that access immediately.

Your content stays until you delete it. Deleting a canvas card, run, or asset removes the stored content and its files within 30 days.

Account information is kept for as long as your account exists and is deleted within 30 days of an account deletion request.

Usage and billing ledgers are retained for up to 7 years after the transaction, as required for accounting, tax, and plan-enforcement purposes.

Request logs are kept for up to 90 days, then deleted or aggregated so they no longer identify you.

Product analytics events are retained for up to 24 months.

You can view and edit your account details, see and delete your content, and manage API keys and connected assistants from within the app. You can cancel a paid plan at any time in Settings → Billing. You can ask us to access, correct, export, or delete the personal data we hold about you, or object to or restrict how we process it, by emailing northlit_support@hangarx.ai. We respond within 30 days and do not discriminate against you for exercising these rights. If you are in the EEA, UK, or another region with a data protection authority, you also have the right to lodge a complaint with it.

Traffic is encrypted in transit (TLS) and data is encrypted at rest by our storage providers. API keys are stored only as hashes — the plaintext is shown once at creation and is unrecoverable by us. Access to production data is limited to the people who operate the service.

We'll update this page when our practices change and revise the effective date above; for material changes we will also notify you by email or in the app. Questions, privacy requests, support, or account deletion: northlit_support@hangarx.ai. Northlit is operated by HangarX Labs LLC, the controller of the personal data described here.