Who this is about
Tiles holds data about two different kinds of people, and the difference matters.
- Tiles’ own customers — the people who sign in to the console and build things. This policy is about them. The controller of their data is Lucas Arano, who operates Tiles from Atlanta, Georgia, USA.
- The people who use a customer’s app. Tiles knows almost nothing about them and is a processor, not a controller: whatever a customer’s app collects is the customer’s, under the customer’s own privacy notice. A visitor to an app opened to anyone with the link is not identified to the customer’s app at all — Tiles does not know who they are either.
What Tiles stores about a customer
- Identity. Your email address and display name. If you sign in with Google: your Google account identifier and whether Google asserts the email as verified. If you sign in by email: the address the message was sent to, a hash of its one-time link and a keyed hash of its six-digit code, cleared after they expire. Tiles has no password of its own and stores none.
- Directory rows. The people in an organization, their email addresses and names, whether each is a guest, and who shared what with whom.
- Source code. What you connect or upload, packed into an artifact kept in Google Cloud Storage, plus the repository binding that says where it came from.
- Keys and secrets you give Tiles, encrypted at rest, revealed only to the connection’s owner and only when the connection was created as recoverable.
- Operational records. Deployments and their versions, build logs, a record of outbound calls Tiles brokered (the path, the time, and whether it was allowed — not the body), instance time and cost records, and liveness probes.
- A hash-chained audit log. Who did what, when, from what kind of credential. Invites appear here as the invited address and whether the message went — never its text.
- Abuse limits. Sign-in and signup are rate-limited by network address. Tiles stores a keyed hash of the address for the length of the limit’s window, never the address itself.
- Your conversations with Kyle, Tiles’ builder: what you write to Kyle, what Kyle answers, and its working record of each request — the app’s files it wrote and what it read while building. Kept with your account; “Start over” begins a new conversation, and deleting your account deletes them all. Keys you add go straight to Tiles and are never part of a conversation.
- What you do in the console: each page you open, each thing you click or send (by the words on it), when the console is opened, left and closed, and a small picture of the screen at each click. Tiles’ own staff read these to see where people get stuck; they stay in Tiles’ own database and go to nobody else. A picture shows the screen as it was, so it can show ordinary words you typed into a field, such as an app’s name; password fields and anything shaped like a key are blanked before it is taken. Pictures are kept 30 days and the steps with your account; deleting your account deletes both.
- Your app’s own data, in a database Tiles provisioned for it. Tiles operates that database; what is in it is yours, and the operator does not read it except where you ask for help and say so.
What Tiles never stores: a card number, its last four digits, its brand or its expiry. Cards are entered on Stripe’s own pages.
This website
ai-tiles.com has one form. What you type into it — your name, email, company and message — is stored and emailed to the operator, so that somebody can write back. The site sets no cookies and loads no analytics.
Cookies
Session cookies, and nothing else: one for the console, one for a site a person was let into, and short-lived ones for a sign-in in flight. All are HttpOnly and SameSite=Lax, and Secure on https. There is no advertising cookie, no analytics cookie, and no third-party script on the console or on the pages Tiles itself serves.
Sub-processors
Only these, and only for what is named:
| Who | For what |
|---|---|
| Google Cloud (us-central1) | Everything Tiles runs on: compute, databases, storage, builds, logs and secret storage. |
| Google (sign-in) | The sign-in itself, when you choose Continue with Google. |
| Stripe | Subscriptions, Checkout, tax calculation and the billing portal. Receives the organization’s name, the billing email, the billing address and any tax ID you enter at checkout — and nothing about your apps. |
| Resend | Delivering a sign-in code and link you asked for, or an invite somebody sent: the recipient’s address, the subject and the text. |
| OpenAI | Writing a Dockerfile when a person asks, and “Help me find it” on the connection form. Receives the manifests of the component being described, or the name of an API. Only on those explicit asks; a build never calls a model. Also speaking to Kyle: when you press the microphone, your recording goes to OpenAI, which turns it into text. Receives the recording and nothing else. Tiles keeps neither the recording nor the words; the words appear in your message box, and go to Kyle only if you send them. Only when you press the microphone, after you have said OK to the note that says so. |
| Anthropic | Kyle, when you ask it to make or change an app: what you write to Kyle, and what Kyle reads while it builds — your app’s code, the build’s output, and what your app answers when Kyle checks it, which can include the app’s own data. Never a key you add. Only when you write to Kyle, after you have said OK to the note that says so. |
| E2B | Kyle’s try-out space: while Kyle builds, a copy of your app’s code runs on E2B’s machines so Kyle can try it before putting it online, with the test data Kyle enters while trying it. Never a key. A space is deleted once Kyle has not used it for 15 minutes, and when you delete the app. |
| TypeSafe | Watching coding agents for loops and workarounds: when an agent’s calls keep failing or hit a refusal, a summary of its recent calls and the platform’s answers to them. Never what the iPhone app does, and never your apps’ data. |
No analytics provider, no advertising network, no error-reporting service, and no outside session-recording tool: what you do in the console is recorded by Tiles itself, as described above.
Where it is
Google Cloud, region us-central1 (Iowa, United States). Stripe, Resend, OpenAI, Anthropic, E2B and TypeSafe process where they process. If you are outside the United States, read that as: your data is in the US.
How long
- Audit records, source artifacts, build logs and cost records are kept indefinitely, including after an organization is deleted. The audit log is a hash-chained record of what happened, and a chain its subject can erase is not evidence of anything. Deleting an organization ends every session, revokes every token, deactivates every person in it, marks the organization deleted and frees its name; the rows stay.
- Databases Tiles provisioned are destroyed when the space holding them is deleted with the explicit confirmation that says so.
- Sign-in link and code records are cleared after they expire.
- Deleting your account — from Settings in the Tiles iPhone app, or the Plan page in the console — happens at once. Every sign-in and token you had ends; your email address, name and Google identifier are erased from every record that held them; your conversations with Kyle are deleted; the organizations only you used are deleted with their apps, databases, source and notes; and you leave every other organization. Notes you wrote on other people’s apps stay with those apps, under “Deleted account”. The audit trail is kept, as above, so entries written before the deletion can still name you; the record of the deletion does not.
What you can ask for
You can read your own directory entry, your organization’s audit trail and every record page in the console, and you can delete your organization there, or your whole account there or in the iPhone app. There is no self-serve export of everything Tiles holds about you in one file. To ask for access, correction, deletion or a copy of your personal data — under GDPR, UK GDPR, the CCPA or otherwise — write to support@ai-tiles.com. Requests are answered by a person, within 30 days. Where a record has to be kept — the audit trail — you will be told which and why.
Abuse reports
Anybody — including somebody who is not a customer and has never heard of Tiles — can report an app at abuse@ai-tiles.com. That address is on every refusal page Tiles serves. A report is handled by the operator, may result in a suspension, and is not passed to the customer as a matter of course.
Children
The Service is not for children. Nobody under 16 should have an account.
Changes
Material changes will be said before they take effect.