Privacy Policy
PadCode: No-Code App Builder
Effective November 5, 2026.
This policy covers PadCode, the app for building apps on iPad, and the services that come with it (together, "PadCode"). PadCode is made by Junaid Tariq ("we", "us"). It says what we collect, why, who else handles it, and what you can do about it.
In short: we collect what we need to give you an account, run the AI Agent and the Marketplace, answer your feedback, and see how PadCode is used and where it crashes. We don't show ads, we don't track you across apps or websites, and we don't sell your data.
What we collect
- Your account: your name, your email address, how you sign in (Apple, Google, or email and password) and, if you add one, your photo. With Sign in with Apple you can hide your email; we then get an address Apple forwards.
- When you last opened PadCode, so we know your account is in use.
- The AI Agent: when you ask it for something, your message, the chat so far and the app you're building are sent to our server and on to the AI model that answers; the same goes for Formula from words, with what you describe and your app's value names. PadCode asks your permission before it sends the first one. We count how much each request uses, to keep within your plan's limits.
- The Marketplace: what you publish (the item itself, its name, words and screenshots, and your name and photo as its creator), the stars and reviews you give, what you get, and what you report or block.
- Feedback: what you send from Send Feedback, the screenshot or recording you attach and, if you leave Attach Diagnostics on, your iPad's model, iPadOS and PadCode versions, language and theme, and PadCode's recent app log: the last 100 things it did, like opening a project, running Preview or a sync that failed. The log holds no project names or content, nothing you wrote, no passwords or keys, and only the first letter and domain of an email address.
- How you use PadCode (Google Analytics for Firebase): which screens you open, and events like making a project, running the AI Agent (which model, and whether it finished), publishing, getting something from the Marketplace, sending feedback or changing the theme, with your device's model, iPadOS and PadCode versions, language, and a rough location Google works out from your IP address (like your city or country, never your precise location). They're linked to an ID for this copy of PadCode and to your account's ID, never your email or name. We don't collect your iPad's advertising identifier or its vendor identifier, and nothing is used for ads.
- Crash reports (Firebase Crashlytics): when PadCode crashes, what it was doing (the code where it stopped and the recent app log above), your device's model and iPadOS and PadCode versions, and your account's ID, so we can find and fix the cause.
- Notifications: if you turn on Tips and what's new, PadCode registers this iPad with Firebase Cloud Messaging and subscribes it to a topic named for its time zone (like tips_p0500), so tips arrive at the same local hours wherever you are. To deliver them, Firebase uses an ID for this copy of PadCode; we don't link it to your account, and we don't keep it. The AI Agent's notifications are made on your iPad and don't go through us.
- Purchases: Apple handles payment. We get the App Store's signed record of each purchase (the product, its dates and IDs) to keep your plan and credits. We never see your payment details.
- AI credits: how many credits the AI Agent used each day, and with which of PadCode's models, for your plan's allowance and the Usage you see in Plan & Billing.
What stays with you
- Your projects are kept on your iPad. With iCloud Sync on, they're also in your own iCloud Drive, which Apple runs and we can't see.
- Your own AI models: the API keys you add are kept in your iPad's Keychain, and those requests go straight from your iPad to that model's provider, not through us.
- The apps you build keep their data on the device they run on, unless you make them send it somewhere, for example with Call API.
How we use it
- To give you your account and sign you in.
- To run the AI Agent, the Marketplace and your plan.
- To review what's published in the Marketplace, act on reports and keep the community safe, as the Community Guidelines and our Terms of Service say.
- To answer your feedback and support requests, and to fix and improve PadCode: usage and crash reports show us what people use, what goes wrong and what to fix first.
- To send you messages about your account. We don't send marketing email.
- If you turn on Tips and what's new, to send you a few tips a day by notification. Turn them off any time in Settings › Notifications.
Who else handles it
We use these services to run PadCode. Each handles your data only for us:
- Google Firebase (Authentication, Cloud Firestore, Cloud Storage, Cloud Functions and Cloud Messaging): your account, your profile and photo, the Marketplace and feedback, and tips by notification if you turn them on. Our Firebase project is hosted in the United States.
- Google Analytics for Firebase and Firebase Crashlytics: how PadCode is used, and crash reports. Google handles this data to provide these services to us. PadCode turns Analytics' advertising features off.
- OpenRouter and the AI model providers it reaches: what the AI Agent is asked, to answer it.
- Resend: sends PadCode's emails: the code that confirms your email address, password reset links, and your feedback to us.
- Apple: Sign in with Apple, iCloud Drive and App Store purchases. Google: Sign in with Google.
What you publish in the Marketplace is shown to everyone who uses PadCode, with your name and photo. We may share information when the law requires it, or to protect people's safety or our rights.
How long we keep it
We keep your account, profile and photo while you have the account. When you delete it (Settings › Profile › Delete Account), they're deleted, along with everything you published in the Marketplace and your ratings, gets and reports. Feedback you sent is kept to help us improve PadCode; ask us and we'll delete it. Crash reports are kept for 90 days, and usage events no longer than Google Analytics' retention setting, at most 14 months. Copies in backups go when those backups expire.
Your choices and rights
- Change your name or photo in Settings › Profile, and turn iCloud Sync on or off there.
- Turn the AI Agent's notifications and tips on or off in Settings › Notifications.
- Delete your account at any time in Settings › Profile.
- Ask us for a copy of your data, to correct it, or to delete it: write toinfo@flutterninja.com. Depending on where you live (for example, the EU, the UK or California), the law gives you these rights and others; we'll honor them, and we don't treat you differently for using them.
Children
PadCode isn't meant for children under 13, and we don't knowingly collect their data. If you think a child has given us data, write to us and we'll delete it.
Security and transfers
Data travels to and from PadCode encrypted, and our services keep it behind access controls. No system is perfectly safe, so we can't promise that nothing will ever go wrong. Your data may be handled in countries other than yours, including the United States; where the law asks for safeguards for that, we use them.
Changes
If we change this policy, we'll update the date at the top, and tell you in PadCode if the change is important.
Contact
Junaid Tariq,info@flutterninja.com.
