Privacy policy

The data controller for Unwrite Make is [OWNER DECISION: the registered legal name, trading address and company number of the entity that operates Unwrite Make]. That is the organisation you can hold to everything on this page.

This policy covers Unwrite Make at make.unwrite.co. Signing in is handled by the one Unwrite account, which has its own policy at voice.unwrite.co/voice/privacy, and the free tools on unwrite.co have a separate policy again.

Under your account and your projects we hold:

• Your account details, held by the one Unwrite account: your name and email address, whether it is verified, how you signed in, your sign-in sessions with the IP address and browser each was created from, and any linked sign-in accounts. Make verifies your shared account session; it never keeps a copy of your account record.
• Your projects: the name, who owns it, who its members are, and the briefs, requirements and conversation threads you write in it.
• Everything you upload: photographs, drawings, scans and CAD files, with the evidence and measurements taken from them.
• What Make generates: feature graphs, revisions and their parameters, validation runs, the built models and drawings, and the export files, plus review comments and the project activity trail.
• Plan and metering: which plan the owner is on, completed designs used, builds and machine time used, and a record of what each generation spent, so we can bill and meter correctly.
• A short-lived record of a payment you started, so a second attempt cannot charge you twice.
• A copy of the subscriptions Stripe has for you, so we can notice if two are running at once.
• A note of when we last checked your billing with Stripe, so a missed update can be caught up.
• Organisations, keys and integrations, if you use them: members and their roles, governance settings, the audit trail, API keys, and webhook endpoints. Webhook signing secrets and any model provider key you supply are encrypted before they are stored.

One item is easy to overlook, so we spell it out. Each project records a one-way hash of the network address it was created from, mixed with a secret only the server holds. It exists so the build machine limits count a person once instead of once per project. It is not readable, and it is deliberately held back from your export because handing back a hash nobody can read tells you nothing and would publish how the hash is made.

We also count requests per address and per credential to stop one machine flooding the service. Those counters hold no name and no email. We store no password: Make has none. Card details never reach us.

Everything runs on Cloudflare. The site is served by Pages, the API by Workers, the database is D1, your files and generated artefacts are in R2, and the CAD builds run in containers pinned to Oceania and Asia Pacific regions. D1 and R2 are encrypted at rest with keys Cloudflare manages.

Cloudflare keeps its own request logs in front of us, as any host does: the connection details, the URL and your browser string. We cannot switch that off and still serve the site.

To answer a design request we send the model what it needs: your brief and requirements, the relevant part of the feature graph, and the photographs or drawings a step is reading. Requests are routed through OpenRouter to the provider serving the model.

Two rules are attached to every one of those requests by the server, not by preference:

• providers may not collect the content of the request, and
• it must be served on an endpoint that keeps nothing, which the industry calls zero data retention.

There is one exception, and it is real rather than a form of words: OpenAI, Google and Anthropicmay serve a request on their own endpoints under their own API terms without the retention flag. The no-collection rule still applies. Nobody else gets that exception, including other companies hosting those three companies’ open models.

If you supply your own provider key, your runs go to that provider on your key and your agreement with them applies to them. Our own provider keys never leave our servers.

Our own logs hold codes, identifiers and counters. They do not contain your briefs, your images or the model’s output. We sell your data to nobody, and there is no advertising on Make.

Project history records what happened in a project. It is needed to run the product: restore, revision provenance, support, export and deletion all read it.

Using a filtered copy of it to improve Make is a separate choice, and it is off unless you turn it on in the project tools, where you can change it at any time. Secrets and credentials are removed before anything is stored, by pattern matching on both the field name and the value, and over-removal is preferred to a credential slipping through.

Unwrite uses one shared account cookie to keep you signed in across Make and Voice. It is Secure and HttpOnly, so scripts cannot read it. Make keeps one non-sensitive preference in browser storage:

• whether you want the interface sounds on, in localStorage.

You only need to sign in to generate: viewing, sharing and downloads stay open, and none of them stores an account credential in browser storage.

Signing in happens against the one Unwrite account, which sends a code to your email address to prove you hold it. The browser receives the shared account cookie after a successful sign-in. Creating a project can be protected by Cloudflare Turnstile, a bot check that sees your IP address and a short-lived response from your browser. Cloudflare’s own protections in front of the site may set a cookie of their own.

Projects are deleted 30 days after they are created while Make is in private alpha, whether or not you asked. Export anything you want to keep. An organisation can set its own retention period for the projects it governs, and a legal hold stops any deletion until it is lifted.

Spend counters are pruned once the window they measure has passed, and the audit entries behind them outlive the counters because a billing question is asked later than the month it is about. Completed-design counters are kept the same way, so the allowance you were sold can be enforced, and they are pruned once their window has passed. An upload that is started and never finished is cleared within an hour.

Export gives you a JSON file holding every row Make stores for that project, table by table, together with a list of the files kept for it. Where a column is deliberately held back, the file names it and says why, so it tells you what it lacks rather than quietly omitting it. The project history panel downloads its filtered history. A complete project export is available through the API while signed in, and we will send it to you if you would rather ask.

Deleting a project removes its stored files first, then its rows. Ask us or call the API while signed in, and the retention sweep does it in any case. The intent is written down before either happens, so a deletion interrupted halfway is finished by the next scheduled run rather than left half done. API keys are scoped to a project, so they go when their project goes. Once you hold no projects at all, the records that hang off you rather than off a project go too: usage, billing customer reference and organisations you own.

Your Unwrite account has its own export and deletion. The export gives you your account record, your sessions, your linked sign-in accounts and your Voice data, with sign-in credentials held back because a file carrying them could be used to sign in as you. Deleting your Unwrite account also deletes your Make projects and their stored files, cancels active Unwrite subscriptions, deletes your Voice data and closes the account. The operation stops if Make cannot confirm its part, so it does not leave project files without an owner.

Two things outlive it, and it would be dishonest to imply otherwise.

• Database backups. The platform keeps point in time backups so we can recover from a mistake. Rows sit in those until the backup window rolls past them: 30 days on Workers Paid, which this service requires, or 7 days on Workers Free.
• Stripe. We cancel a subscription, but Stripe keeps its own billing records for as long as its tax and anti-fraud duties require.

We use a small number of suppliers. They process your data on our instructions and for no purpose of their own.

• Cloudflare hosts everything: the site, the API, the database, your files and the build machines.
• OpenRouter routes model requests, and the model provider it selects serves them, under the two rules above.
• Stripe takes and stores card details and processes payments. We receive the plan and a customer reference.
• Resend delivers the sign-in code email, so it receives your email address when you ask for a code.

Some of them run outside Australia, typically in the United States. Unwrite is based in Australia, so overseas disclosure is handled under Australian Privacy Principle 8: we take reasonable steps so those recipients handle the information in line with the Australian Privacy Principles.

You can ask us for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict what we do with it, or object to it. Export and deletion in the product cover most of that immediately; for anything else, email us and we will act within one month.

If you think we have handled your data badly you can complain to us, and you can complain to a data protection regulator whatever we say. Because Unwrite is based in Australia, that regulator is the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

Questions about this policy or your Make data: privacy@unwrite.co.