1. What this policy covers
This Privacy Policy applies to the Artifact Studio website, published artifact pages, REST API, and Model Context Protocol (MCP) endpoints operated as part of Artifact Studio. It does not replace the privacy policies of third-party AI clients, identity providers, hosting providers, or websites you choose to connect.
2. Information we process
Depending on how you use the service, we may process:
- Account information, such as your name, email address, profile identifier, and the identity provider you use to sign in.
- Artifact content and metadata, including Markdown, titles, slugs, visibility settings, style presets, version history, timestamps, and generated public URLs.
- Authentication data, including session identifiers, OAuth grants and tokens needed to keep MCP connections working, and hashed API keys. Artifact Studio stores API-key hashes rather than the full secret after it is created.
- Technical and security information, such as request metadata, timestamps, IP-derived security signals, error logs, and records needed to prevent abuse and diagnose failures.
3. How we use information
We use information to authenticate you, store and render your artifacts, maintain version history, let authorized agents act on your behalf, secure the service, investigate errors, prevent misuse, and improve reliability and usability.
Artifact Studio does not need to send the contents of your artifacts to an AI model merely to publish them. When you connect ChatGPT, Claude, or another AI client through MCP, that client can receive tool results and take actions you authorize; its handling of conversation data is governed by that provider’s own terms and privacy policy.
4. Public, unlisted, and private artifacts
Public artifacts are intended to be discoverable and may appear in search engines, previews, caches, and third-party links. Unlisted artifacts are excluded from Artifact Studio’s sitemap and marked not to be indexed, but anyone who has the URL may still be able to view and share them. Private artifacts are intended to require authorization.
Do not use an unlisted link as a substitute for access control when the content is confidential.
5. Service providers and integrations
Artifact Studio relies on infrastructure and integrations needed to operate the service, such as hosting, edge networking, databases, authentication providers, and observability services. These providers may process limited information on our behalf according to their own contractual and security obligations.
If you choose Google, GitHub, ChatGPT, Claude, or another third-party service, information also flows directly between you and that provider as necessary to complete authentication or the action you requested.
6. Cookies and local storage
We may use cookies or equivalent browser storage that are necessary to keep you signed in, remember your language preference, preserve security state, complete OAuth flows, and operate core product features. Artifact Studio does not currently depend on advertising cookies for the service described by this policy.
7. Retention
We keep account, artifact, and authorization data for as long as needed to provide the service or until it is deleted, revoked, or no longer reasonably required. Security and operational logs may be kept for a limited period for fraud prevention, troubleshooting, legal obligations, and service integrity. Backups can persist for an additional limited period before being overwritten.
8. Security
We use reasonable technical and organizational safeguards, including hashed API keys, scoped OAuth authorization, encrypted HTTPS transport, and access controls. No internet service can guarantee absolute security. Keep API keys private, use a separate key for each agent or machine, and remove credentials you no longer trust.
9. Your choices and rights
You can choose artifact visibility, disconnect OAuth clients, manage API keys, change your language preference, and stop using the service. Depending on where you live, applicable privacy law may also give you rights to access, correct, delete, port, or object to certain processing of your personal data.
For users protected by Brazil’s LGPD, these rights may include confirmation of processing, access, correction, portability where applicable, deletion or anonymization in certain circumstances, information about sharing, and revocation of consent when consent is the legal basis.
10. Children
Artifact Studio is not intentionally designed for children to create accounts independently. If you believe a child has provided personal data in circumstances that require parental or guardian authorization, contact the service operator so the situation can be reviewed.
11. Changes to this policy
We may update this policy as the product, infrastructure, or legal requirements change. The date at the top of the page shows the latest revision. Material changes may also be communicated through the service when appropriate.
12. Contact
For privacy questions or requests, use the contact channel made available by Artifact Studio. A dedicated privacy email may also be published in the product or account settings as the service evolves.