Privacy Policy

The short version

This site uses Vercel Web Analytics and Speed Insights to understand visits and page performance. It also remembers your theme and language preferences. It also uses pixels to measure Rogue's ads on X and, on the landing page and /build, Facebook and Instagram. You can decline at any time. Google Analytics and Google Ads also measure visits and ad clicks by default, so we know which campaigns bring people to Rogue. One "Decline" turns all of this off, and declining does not stop you from using Rogue. The details are in Measurement by default and how to decline.

The app is different because it has accounts. It keeps your name and email, what you ask Rogue to build, and a record of how much your account uses. We do not sell personal data or show advertising. Service providers process data to run these features. Disclosures may also be required by law or necessary to address abuse and security incidents.

Connecting Gmail is optional. If you connect it, Rogue sends an email only when you click Send. The gmail.send permission does not provide access to read your mailbox.

Why we process data

We process account details and the content you submit to provide the service you request, including sign-in, AI responses, project hosting and connected features. We also process usage and technical records to manage capacity, investigate errors and prevent abuse. Measurement and optional account communications are described separately below.

Accepting the Terms does not give blanket consent to every use of personal data. Connecting an external account authorizes the features and permissions shown in that connection flow.

What stays in your browser

Your light or dark theme choice is saved under the key rogue-theme in your browser's local storage. It exists so the page does not flash the wrong colours when you come back. Clearing your browser data removes it.

A cookie named locale remembers your language preference for up to one year and is sent to this site with requests. Clearing this site's cookies removes that preference.

When you follow a build link or submit the home-page prompt, campaign parameters already present in the address, such as UTM tags and Google and X click identifiers, may accompany the request to app.rogueon.ai. On this site they are kept only in the current tab, so they also apply to an app link opened after browsing the pages. This transfer does not create a new identifier. What the app does with campaign parameters is described in Ads on X and Meta.

What you type in the prompt box

The box on the home page runs nothing here. This site has no server-side API of its own. Your text stays in your browser until you submit it, and submitting sends it to the Rogue app at app.rogueon.ai as part of the request. Until you press send, nobody receives it.

Submission sends your text in an HTTPS POST body, rather than in the page address. A temporary encrypted copy in the app tab and an HttpOnly cookie preserve the request while you sign in. This handoff is accepted for up to 20 minutes; the cookie expires then. Once the request opens, its copy moves into the app's account-scoped storage described below. Do not submit passwords or secret keys. This transport change does not remove information already retained in old URLs or third-party logs.

What our host sees

The site is served by Vercel. Like any web host, Vercel processes the technical data your browser sends with each request, such as your IP address, the page you asked for, and your user agent. That processing is what makes serving a page possible, and it is governed by Vercel's own privacy terms.

Fonts and images

Typefaces are served from this domain, not fetched from a font network while you browse. Every image and video on the page is served from this domain too. Measurement scripts are supplied by Vercel and, unless you decline, by Google, Meta and X; serving an asset from this domain does not mean that no service provider processes the associated requests.

Your Rogue account

When you sign in to the app we store your name, your email address and when your account was created. If you sign in with Google we also store the address of your Google profile picture and whether Google confirmed your email. If you use a password, we store only a one-way hash of it. Sign-in codes we send by email are stored hashed and expire after five minutes. Account records also include language preferences and, when available, the time zone supplied with your request. GitHub sign-in, when available, supplies profile and email details for your account. If you reached the app through an ad or link with campaign parameters, those are stored with the account too, as explained in Ads on X and Meta.

Emails from Rogue

AgentMail sends sign-in codes. Resend sends account and security notices, project notifications, summaries, reminders and product updates. These providers receive the recipient address and the message needed for delivery. We record delivery attempts, status and notification preferences; bounced addresses and complaints are kept on a suppression list to prevent further unwanted delivery.

Summary, reminder and update emails are currently enabled by default. You can turn them off in notification preferences or use their unsubscribe link. Sign-in and essential account or security messages are handled separately. If email open or click tracking is enabled with the delivery provider, those events and their times may also be recorded; disabling optional emails stops future messages in those categories.

Signing in with Google

To sign you in, we ask Google for your basic profile and your email address (the openid, email and profile permissions). We use them to create your account and to recognise you when you come back, and for account-related features described in this policy. Gmail is an optional permission: it may be offered during Google sign-in or when you connect it later. We do not request Drive, contacts or calendar access in this sign-in flow. The app is configured to encrypt the tokens Google returns in storage.

Gmail, if you connect it

Connecting Gmail is optional. You can do it in Preferences, Connections, or the first time you send an email Rogue wrote for you. Rogue asks for a single permission, Send (gmail.send): it sends an email from your Gmail only when you click Send on a draft. It never sends on its own, and this permission does not let it read your mailbox. Sending passes the draft and recipients through Rogue to Google. The draft also remains in your conversation history in the browser, and Google handles the sent message under its own terms.

The tokens that give Rogue this access are stored encrypted. You can disconnect at any time in Preferences, Connections, which deletes the tokens and revokes them with Google, or remove Rogue's access in your Google Account at myaccount.google.com/permissions.

Rogue's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Gmail data only to do what you ask in the app. We do not use it for advertising, we do not sell it, we do not use it to train AI models, and no one at Rogue reads it unless you ask us to, it is needed for security, or the law requires it.

Staying signed in

A cookie named __Host-rogue.session_token keeps you signed in for up to 30 days. It can only be read by app.rogueon.ai and is never available to scripts on the page. For each session we record the IP address and the browser that started it, and we count sign-in attempts per IP address, so we can stop abuse. Signing out ends the session.

What you ask Rogue to build

Chat history, build conversations and the list of recent projects are saved in this browser when you are signed in. Without signing in, new content stays in page memory and is lost on reload. Requests and attachments are also sent to the services needed to answer or build. Project files, build metadata and hosted outputs can be stored on our infrastructure and by our providers. Clearing browser history does not delete those server records.

For signed-in accounts, Rogue encrypts saved history, memory, drafts and attachment context in browser storage with AES-256-GCM. The app obtains the account's key after checking an active session and keeps it in page memory. Signing out locks the app's access; it does not erase the encrypted copies. Older unencrypted records are automatically imported in the background and associated with the first signed-in account that starts the import. If the import fails, the original copies are kept for retry; another account cannot take over that import. Use separate browser profiles on shared devices. Ordinary interface preferences are stored separately.

This is not end-to-end encryption. Rogue and the providers used for your requests can process the content. An unlocked session, malicious code running in the app, or a compromised device can still access it. Browser downloads, URLs and other browser caches are outside this storage protection. On a shared device, sign out when you finish and clear the site's data if you want to remove its local copies.

A build can have a preview link before you click Publish. A link that is not listed publicly is not a confidentiality guarantee. Clicking Publish makes the chosen version available at its published address; later edits remain previews until republished. Do not include content that you are not authorized to share.

Memory

When you are signed in, memory and standing instructions are saved encrypted in this browser. When memory is enabled, relevant entries can accompany AI requests. Automatic saving can also send your message and existing entries to an AI model to suggest memory changes. You can review, edit, delete or disable memory in Settings, Memory. Clearing conversation history does not clear memory; delete it separately in those settings or clear this site's browser data.

AI processing

To answer you, Rogue sends your prompt and the context it needs to AI model providers through the Vercel AI Gateway, and image requests to fal. In Rogue Code, a photo you agree to turn into a 3D model also goes to fal, and the finished model is stored by fal. Each request carries an opaque identifier derived from your account rather than using your name or email as that identifier. This does not make the request anonymous: prompts, files and memory can contain personal data that you include. The providers process requests under their own terms. A provider's retention or model-training restrictions depend on the applicable service agreement and settings; this policy does not promise zero retention by every provider.

Usage records

For every request we record which model ran, which provider served it, how many tokens it used, what it cost us, when it happened and which project it belongs to, linked to your account. You can see your own usage in the app, under Preferences, Account. The Rogue team uses these records to understand costs, to set fair limits and to stop abuse.

Measurement by default and how to decline

To know which campaigns work, Rogue measures visits and ad clicks by default with Google Analytics 4, Google Ads, the X pixel and Meta Pixel. When you first arrive, a small notice says this, with a "Decline" button the same size as "Got it". Closing or ignoring the notice is not acceptance of anything new: measurement is already on, and "Decline" turns it off with one click.

If you arrive from a Google ad, the click identifier that Google adds to the address (gclid, gbraid or wbraid) is kept with the campaign labels and, if you create an account, stored with it so we can count which campaigns bring accounts. It is deleted with the account and is not stored if you declined.

With your account we also store where you came from: the site name (only the domain, such as google.com or chatgpt.com, and "other" for sites outside our list of public sites), the path of the first rogueon.ai page you opened and, if you came from a Meta or X ad, only that you came from an ad on that network, without the click identifier. This is also deleted with the account and is not stored if you declined. So the account knows this even if you come back another day, rogueon.ai keeps the same data for 30 days in a cookie that app.rogueon.ai reads when the account is created; declining deletes that cookie.

The legal basis is Rogue's legitimate interest in measuring its own site, app and ads, with your right to object at any time. Declining on the notice, or later with the buttons in the sections below, stops Google Analytics, Google Ads, X and Meta on that host and removes their cookies; it does not delete data the providers already received. Each host (rogueon.ai and app.rogueon.ai) keeps its own choice. If your browser is set to a European time zone, or reports none, nothing of this runs until you click "Allow".

Measurement on the site and in the app

The site and app include Vercel Web Analytics and Speed Insights for page-view statistics and performance measurements. Data can include the visited URL, referrer, browser, device information and timing metrics. Vercel describes these services in its Web Analytics privacy documentation and Speed Insights privacy documentation. The language-preference cookie described above is separate from these services. Our measurement filter removes fragments and query strings from event URLs, except campaign parameters (utm_*) that carry only a short label, such as an ad's name, and limits collection to selected page paths. This filter does not remove data from hosting logs or from requests needed to run the app.

Google Analytics

We use Google Analytics 4 to understand visits and selected actions on Rogue's own site and app. It runs by default and stops when you decline, as described in Measurement by default. The choice applies separately on rogueon.ai and app.rogueon.ai. It does not enable Analytics on sites that people build or publish with Rogue.

When enabled, Google receives selected page paths, short campaign labels, recognized referring sites without their page path or query, browser and device information, and browser identifiers stored in Analytics cookies. Requests also expose your IP address to Google. This is not anonymous measurement. We replace page titles with fixed labels and remove fragments and other query parameters before sending events. Referrers from private sites, published Rogue projects or sources outside our approved list are omitted. We do not send Google Analytics your account ID, name, email, prompts, attachments, conversations, project IDs or project content. Automatic form, search, scroll and download measurement is disabled, as is Google Signals. Advertising signals are allowed, so Google can link visits to Rogue's ads.

Selected actions include following a link to the app from this site, copying a website brief, activating a brief or public-research download, and a new project's first build being accepted, its result becoming available, completed signup, the account's first completed project, or a version being published after server confirmation. An available result does not certify its quality or publication. These events use fixed labels such as language, placement, file format or project type; they do not include the text you copy or what you ask Rogue to build. Visits to the site and app use separate browser identifiers rather than an account-based identifier shared between them.

A cookie named __Host-rogue_analytics remembers your choice for up to 180 days on each host. While measurement is on, Google Analytics cookies with names beginning with __Host-rogue_ga can also remain for up to 180 days without automatic renewal. These cookies are limited to the host that set them, rather than shared with published project subdomains. Your browser may expire them sooner. You can change your choice using the buttons below. Declining stops future collection on that host and removes its Analytics cookies; it does not delete data already received by Google. See how Google uses information from sites and apps that use its services and Google's Privacy Policy.

This Analytics property is configured to retain user-level and event-level data for 14 months, without resetting user retention on new activity. This setting does not apply to standard aggregated reports. It is separate from how long cookies remain in your browser.

Google Ads

In the app, Google Ads measures by default which ad led to a signup and to the account's first completed project, including when you come back within 7 days. This result is a technical milestone, not a quality assessment. Declining on the notice stops the Google Ads tag and the conversions. Advertising personalization signals are allowed, so Google may use the visit to show Rogue ads. We do not use enhanced conversions with form data.

Google may receive the ad click source, campaign labels, selected app paths, browser information, your IP and a random conversion identifier to prevent duplicates. We do not send names, email, account IDs, messages, project content or project IDs. Signup is not a purchase or revenue. The __Host-rogue_google_ads cookie remembers the choice for up to 180 days; attribution cookies are limited to the app host.

We store one milestone per purpose in the account database so the same signup or first project is not counted twice. It is removed with the account. Declining stops future sends and removes attribution cookies; it does not delete data already received by Google. Change my Google Ads choice in the app.

Ads on X and Meta

The landing page and app.rogueon.ai/build also use Meta Pixel for Facebook and Instagram ad measurement, under the same ad choice described below. Meta receives a page visit, the first submitted request and, in the app, a completed signup and the account's first successful project (site or slides). Each conversion is verified on our server and claimed once per account, independently from Google measurement. The deduplication record is deleted with the account. Meta's script runs in an isolated frame: it cannot read the editor, forms, Rogue cookies, prompts or project content. Automatic matching is disabled. We send a fixed page category, project type and random event ID; a Meta ad click ID may accompany the frame URL and links to the app. It is kept in this browser tab for up to 30 days and removed on refusal. When the Conversions API is enabled, our server also sends the visit and first accepted request, with the IP address, browser, public page address without query parameters, click ID and Meta browser ID, when available. The request text is not sent. Browser and server visits share the same event ID to avoid duplicates. The first request is counted once per browser session and, when signed in, per account. A random identifier stays in this tab; the session cookie __Host-rogue_meta_first_prompt prevents repetitions. The __Host-rogue_meta_fbc cookie keeps the click ID for up to 30 days. Both cookies are restricted to the host that set them and removed on refusal. Meta may receive browser/network information and use its own identifiers, subject to browser restrictions. We do not give it your account ID, email, private URLs or project IDs. Declining also stops future Meta events; it does not delete data already received by Meta. See the Meta privacy policy.

Rogue advertises on X. To learn which ads bring visits, new accounts and product use after clicking, the public pages of this site and the app's studio (app.rogueon.ai/build) load the X pixel. You can decline at any time with the buttons below; after that, nothing from X is downloaded on those pages.

With the pixel, X receives the page address reduced to its path and campaign parameters (the rest of the URL and the referrer are not sent), browser and device information and the identifiers X itself uses. The pixel's automatic features, which would read what you type into forms, the buttons you click and your time on the page, are turned off. The pixel does not set X cookies on Rogue's domains, and it removes any left over: the ID of a click on an X ad goes from this site to the app in the link's address and is kept only in your browser (in this tab, on the site; for up to 30 days, in the app). In the app, the pixel only works in the studio, never on invites, your account or the Rogue Code connection. A few events are sent too, each with at most one random number: when your account is created (a number drawn on the spot, not your account's), when you send the first message of a new chat conversation (the conversation's number), when you start a new project and when that project is ready (the project's number); and, when you click on this site to open the app, an event with no number. We do not send X your name, your email, what you ask Rogue to build or the content of your projects. X processes this data under the X privacy policy, including outside Brazil.

To count in our own database how many accounts each campaign brings, without relying on X, the app keeps the campaign parameters (utm_*) you arrived at the studio with in a cookie named __Host-rogue_origem, in the app only, for up to 30 days; arriving through another campaign replaces it. If you create an account within that time, those parameters and the arrival time are stored with the account, and the cookie is removed; if you are already signed in, it is not set at all. When an account is created, from a campaign or not, the app sets the __Host-rogue_conta_nova cookie for one hour, holding the random number of the new-account event, and removes it as soon as the pixel uses it. If you declined the pixel, neither happens (declining removes any that exist), and from a European country, only if you accepted. Deleting your account deletes the stored campaign too.

The legal basis is Rogue's legitimate interest in measuring its own ads and counting the accounts they bring, with your right to object: the buttons below open the notice, and declining takes one click. If your browser is set to a European time zone, or reports none, the pixel only loads after you accept. Your choice is kept in a cookie named __Host-rogue_consent, for 180 days, separately on this site and in the app. To remove what X has already stored, clear this site's and X's data in your browser.

Data in the apps you create

When a generated app uses a database, Neon can store its users' accounts and the records they submit, according to the app's features. These are separate from accounts used to sign in to Rogue. Rogue processes the data needed to provision and operate the integration, including authentication, database access, security and transfer to the app owner's Neon account.

Controller and processor roles depend on each party's actual decisions and activities, not just on who hosts the database. If you decide why and how your app uses personal data, you must provide a lawful basis, an appropriate privacy notice and a way to exercise data rights. Rogue remains responsible for its own processing and legal duties. This policy does not replace the privacy notice for your app.

Who processes data for the app

• Vercel: hosting, file storage, measurement and the AI Gateway.
• Neon: Rogue accounts and usage records, and databases for generated apps when used, including their authentication and user records. These databases can process data in the United States.
• AgentMail: sends sign-in codes by email.
• Resend: delivers Rogue account and product emails and reports delivery events.
• Google: if you choose Google sign-in, connect Gmail, and for Google Analytics and Google Ads measurement unless you decline.
• AI model providers reached through the Vercel AI Gateway, and fal for images and for 3D models made from your photos in Rogue Code.
• Boat: the isolated machines where Rogue builds your projects.
• Perplexity: web search, when you ask Rogue to research something.
• GitHub: sign-in when available, or repository access when you connect it to save code.
• Supabase: when you connect an organization or use it for a generated app's backend.
• X: measurement of Rogue's ads on X, and you can decline.
• Meta: Facebook and Instagram ad measurement on the landing page and /build, using the same ad choice.

Data can be processed outside Brazil, including in the United States. Locations and onward processing depend on the service and configuration. You can contact us about the recipients and safeguards applicable to your data.

How long we keep it

Databases temporarily hosted in Rogue's Neon account pause after 14 consecutive days from the trial start. After 21 days from that same start, an untransferred database and its user accounts and saved data are permanently deleted. Usage does not renew these deadlines; the dates appear in Database. Complete the transfer in Neon before deletion to keep the database. Then its management and retention follow the owner's account and Neon's terms. App files, Rogue usage records and provider logs have separate retention periods. See the database terms.

Retention depends on the data and where it is stored. Browser history and memory remain until removed or cleared by the browser. Account, usage, email and project records have separate lifetimes; closing an account does not by itself demonstrate deletion from every system. A session expires after 30 days without renewal, and a sign-in code becomes unusable after five minutes. Expiry is not the same as deletion of the associated database record.

Disconnecting Gmail removes its stored connection tokens and requests revocation with Google. Database backups follow the host's configured retention and are separate from project storage and provider logs. Contact us to request deletion or information about retention. Some records may need to be retained for legal obligations, security or the exercise of legal rights; any applicable exception must be assessed for the requested data.

Links that leave

Links to our X profile and to other sites take you to services with their own privacy practices. Once you follow one, this policy no longer applies.

Age requirements

The Terms require users to be at least 18 and able to enter a contract, including any higher age of majority where they live. If you believe a minor is using an account or their personal data has been submitted, contact us so we can investigate and address the request. This age requirement does not itself verify a user's age.

Your rights

Under Brazil's LGPD, you can request confirmation and access, correction, information about sharing, and anonymization, blocking or deletion of unnecessary, excessive or unlawfully processed data. You can also request portability subject to applicable regulation, deletion of consent-based data subject to legal exceptions, and information about refusing consent, and withdraw consent. Where the GDPR applies, its rights and conditions also apply.

These requests can concern the site as well as the app. Write to caio@rogueon.ai with the request and enough information to locate your records. Using your account email can help; you can also act through an authorized representative. We may need proportionate identity verification before disclosing or changing personal data. Do not send passwords or connection tokens. Requests are free of charge and subject to the applicable legal deadlines and exceptions, rather than a single deadline for every right.

You may also raise a complaint with the ANPD or another competent data protection authority. Review of automated decisions affecting your interests may be requested where applicable.

Changes

When what we collect changes, this page changes first and the date at the top moves with it.

Contact

Questions about this policy go to caio@rogueon.ai.