Privacy policy

Who this covers

This policy is from [Your full legal name, or your LLC's name], which runs Opal at opalcreate.dev. It covers people who use Opal ("you"), visitors to Opal's pages, and people who buy from or contact a business through a website or store made with Opal ("buyers").

What we collect from you

Account: your name, email, a password (stored only as a secure hash, never readable), your language, and the date you agreed to our terms. If you sign in with Google, we get your name and email from Google.

What you make: your websites, their words, photos and settings, products, store settings, orders, Books entries, invoices, social posts, team tasks, and who you share a project with. Photos you upload have hidden location data removed.

Ask King Opal and other AI features: what you type, and pictures and files you add, are sent to the AI company that answers (see AI companies below). Your conversations with King Opal are saved in your own browser on your device, not on Opal's servers.

Payments: Stripe handles all card and bank details. We never see or store full card or bank numbers. We keep your plan, its status and renewal date, credit packs, and the Stripe IDs that link them. If you sell, Stripe collects your identity and bank details on its own pages, and we keep your Stripe account ID and whether it's ready to take payments and receive payouts.

Accounts you connect: if you connect Gmail to your Inbox, Opal reads your newest inbox messages (sender, subject, date and a short preview) to show them to you, and never sends, deletes or changes anything. If you connect a social network, we keep the access needed to post what you ask. Sign-in keys for these accounts are encrypted before they're stored.

Messages: what you send us for support, and emails we send you (such as password resets and order emails).

Technical information: your IP address and browser details, used to keep Opal secure, stop abuse and set rate limits; error logs; and records of AI use (when, which feature, how many credits) so we can bill fairly and give credits back.

Cookies and browser storage

Opal uses a few cookies that it needs to work: one that keeps you signed in, and short-lived ones used while you accept an invite or connect another account. Opal also saves some things in your browser, such as drafts, your King Opal chats and your display settings. Opal doesn't use advertising cookies or outside analytics or tracking tools. Published websites made with Opal don't add trackers unless their owner adds them.

How we use it

To run Opal for you: your account, your websites and stores, AI features you start, payments and payouts, and emails about your orders and account. To keep Opal and its users safe: preventing fraud, abuse and spam, and proving who owns a store. To support you and fix problems. To improve Opal, using information about how features are used. To follow the law, such as tax and accounting rules.

Where the law asks for a legal reason (for example in the EU and UK), we rely on: performing our contract with you; our legitimate interests in keeping Opal secure and improving it; your consent, where we ask for it (such as connecting Gmail); and our legal duties.

AI companies

When you use an AI feature, what you send for that request goes to the company running the AI: OpenAI, Anthropic (Claude), Google (Gemini) or xAI (Grok) for text and looking at pictures, and OpenAI for making pictures and checking uploaded photos for content that isn't allowed. We use their paid business services. We have not allowed any of them to train their AI on your information. Each keeps request data only as its own business terms say, usually for a short time to prevent abuse.

Who we share it with

Companies that run parts of Opal for us, under contract, and only for that: Railway (hosting and storage, in the United States), Stripe (payments and payouts), Resend (email), the AI companies above, and Google (Google sign-in and Gmail, only if you use them).

Stripe: when you pay or set up payouts, Stripe receives your information and processes it under the Stripe Privacy Policy (stripe.com/privacy).

Other people, because you asked: buyers see your public website and store; people you invite see the projects you share; a social network gets the posts you publish there.

Sellers: when a buyer orders from a store, the seller gets the order details (see below).

When the law requires it, to protect someone's safety, or to stop fraud or abuse. And if Opal is sold or reorganized, to the new owner, who must keep this policy's promises.

We don't sell your personal information, and we don't share it for advertising.

Google user data

Opal's use and transfer of information received from Google APIs follows the Google API Services User Data Policy (developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. Gmail information is used only to show your messages to you in Opal, is never used for advertising, is never sold, and is never used to train AI. People at Opal don't read it unless you ask us to for support, it's needed for security, or the law requires it. You can disconnect Gmail in Opal, or at myaccount.google.com/permissions, at any time.

If you buy from an Opal store

When you order from a website or store made with Opal, the business you buy from decides how your information is used, and Opal handles it for that business. We collect what you enter at checkout (such as your name, email, phone, delivery address and notes), what you order, and the order's status, and we send you order emails on the business's behalf. Your card is handled by Stripe; neither Opal nor the business sees your full card number.

For questions about your order, or to ask about your information, contact the business you bought from. If you can't reach them, email OPALCREATE.DEV@gmail.com and we'll help.

How long we keep it

While your account is open, we keep your information so Opal works. If you ask us to delete your account, we delete your information within 30 days, except: daily backups, which are replaced and gone within 14 days after that; records we must keep by law, such as payment, tax and order records, kept for up to 7 years; and information we need to resolve a dispute or stop abuse. Security logs are kept for a short time. Orders in a seller's store are kept for that seller as part of their records.

Keeping it safe

We use encrypted connections (HTTPS), store passwords only as secure hashes, encrypt the keys for accounts you connect, limit who at Opal can see data, and back up every day. No system is perfectly secure, so use a strong password that you don't use anywhere else. If a breach affects your information, we'll tell you as the law requires.

Your choices and rights

You can see and change your account details in Settings, download your websites, and download a copy of your workspace. To get a copy of all your information, correct it, delete your account and information, or object to how we use it, email OPALCREATE.DEV@gmail.com. We'll confirm it's really you before we act, and answer within 30 days (or sooner if the law requires).

Depending on where you live, you may have extra rights. In California and other US states with privacy laws, you have the right to know what we collect, to get a copy, to correct and delete it, and to not be treated differently for using these rights; we don't sell or share personal information for advertising, so there's nothing to opt out of. In the EU, UK and similar places, you also have rights to restrict or object to processing, to data portability, to withdraw consent, and to complain to your data protection authority. If we turn down a request, you can appeal by replying to our answer.

Where your information is kept

Opal is run from the United States and stores information there. If you use Opal from another country, your information is sent to and kept in the United States, where privacy laws may differ from yours. Where the law requires, we use legal safeguards for these transfers.

Children

Opal is for people 18 and older and isn't meant for children. We don't knowingly collect information from anyone under 18. If we learn an account belongs to someone under 18, we close it and delete its information. If you think a child gave us information, email OPALCREATE.DEV@gmail.com.

Changes and contact

If we change this policy in a way that matters, we'll tell you in Opal or by email before the change applies, and update the date at the top.

Questions or requests: [Your full legal name, or your LLC's name], OPALCREATE.DEV@gmail.com.