Privacy Policy
What MaximusDev collects, what it sends to third parties, and how to make us stop. Plain English first; the legal terms are in the same paragraphs.
Contents
1. Who we are
MaximusDev is the trading name for a vibe-coding tool operated by Tim Harfield, an individual based in Suffolk, United Kingdom. We are not a registered company. For the purposes of UK and EU data protection law, Tim Harfield (trading as MaximusDev) is the data controller for personal data processed through maximusdev.cloud and maximusdev.app.
The fastest way to reach us about anything in this policy is hello@maximusdev.cloud. We aim to respond within 5 working days.
2. What we collect
We collect three categories of data, and only those three.
Account data
When you sign up, our authentication provider (Clerk) receives and stores your email address, an encrypted password (or social-login identifier if you sign in with Google, GitHub, or similar), and a unique account ID. We never see your password. We see the email address and the account ID.
Service-use data
When you use the cloud product, we store: the prompts you send to AI models, the responses returned, file uploads you make to the build sandbox, the apps you build (their code, configuration, and any data they store on our infrastructure), credit usage counts, and Stripe customer IDs if you subscribe. We log basic technical metadata for debugging and abuse prevention: IP address (truncated after 30 days), user-agent string, request timestamps, and error traces.
Marketing-site analytics
The marketing pages at maximusdev.cloud (excluding the app at /app) are served via Cloudflare Pages. Cloudflare collects edge-network telemetry (request counts, response times, country-level geolocation) for performance and security. We do not run Google Analytics, Meta Pixel, or any other third-party advertising trackers on the marketing site.
3. Why we collect it (and our lawful basis)
Under UK GDPR, we have to tell you the lawful basis for each thing we do with your personal data.
| What we do | Lawful basis |
|---|---|
| Run your account | Performance of our contract with you (Article 6(1)(b)) |
| Take payment via Stripe | Performance of our contract with you (Article 6(1)(b)) |
| Send AI calls on your behalf | Performance of our contract with you (Article 6(1)(b)) |
| Detect abuse, fraud, and security incidents | Legitimate interests (Article 6(1)(f)) |
| Keep records for tax and accounting | Legal obligation (Article 6(1)(c)) |
| Send service emails (e.g. password reset, billing receipts) | Performance of our contract with you (Article 6(1)(b)) |
| Send product update emails | Consent at signup (Article 6(1)(a)) — opt out any time |
We do not sell your personal data. We do not share it with advertisers. We do not use it to train AI models, and the third-party providers we route to have specific contractual restrictions on the same — see below.
4. Third parties we share data with
MaximusDev is a small operation. Most of the heavy lifting happens at trusted infrastructure providers, listed here in full.
| Provider | What they do | What they see |
|---|---|---|
| Clerk | Authentication, account management | Email, password (hashed), social-login tokens, session metadata |
| Stripe | Payments, subscriptions | Card details (Stripe handles direct — we never see them), name, billing address, country, VAT number if supplied |
| OpenRouter | Routing AI calls to model providers | The prompt text, the response text, the model used, token counts |
| Anthropic, OpenAI, MiniMax (via OpenRouter) | The actual AI inference | The prompt text, conversation history, the response. See section 5 |
| Cloudflare R2 | File storage for app assets and uploads | The file content and the file path |
| Cloudflare Pages | Hosting the marketing site and your deployed apps | Edge-server logs (requests, IP, user-agent) |
| Neon | PostgreSQL database | All structured account data (encrypted at rest, multi-tenant row-level security) |
We do not run our own transactional-email pipeline. Authentication emails (signup verification, password reset, magic links) are sent by Clerk directly. Billing emails (payment receipts, invoice reminders) are sent by Stripe directly. Both are governed by their own privacy notices.
Each provider above is bound by a Data Processing Agreement (DPA) that we sign with them. They process your data only on our instructions, except where they themselves are independent controllers (Stripe is, for fraud-prevention purposes — see stripe.com/privacy).
5. What happens when you use AI features (read this)
This is the most important section of this policy and we want to be plain about it.
When you ask MaximusDev to build, edit, or talk through an app, your prompt — including any code, text, or instructions you send — is transmitted to a third-party AI model provider. By default we route through OpenRouter, which then forwards your prompt to the specific model you've selected (Anthropic Claude, OpenAI GPT, MiniMax, or another model from our curated allow-list).
Specifically:
- Your prompt text leaves our infrastructure and is processed by the model provider's servers. It is held in their systems for as long as their own retention policy specifies (typically 30 days for abuse monitoring; sometimes zero days under their enterprise data terms).
- Retention at the model provider depends on the provider. We use the standard OpenRouter API tier, which forwards prompts under each provider's normal API retention policy. Anthropic, OpenAI, and MiniMax all retain API traffic for short windows for abuse monitoring (typically up to 30 days), then delete it. We have not negotiated bespoke zero-retention terms — that's an enterprise-tier conversation and we're not there yet.
- Your prompts are not used to train models. OpenAI, Anthropic, and OpenRouter all contractually exclude API traffic from training data on the tiers we use. Provider terms are linked from the documentation; we'll send you copies on request.
- If your app calls the AI on behalf of your end-users (e.g. you've built a chatbot), every one of those end-user prompts is also transmitted to the model provider, with the same terms.
If you are processing personal data of EU or UK residents through MaximusDev — for example, you've built a customer-service tool — you are the controller of that data and we are your processor. We will sign a Data Processing Agreement with you on request. Email hello@maximusdev.cloud.
If your app is in the Compliance tier, every AI call generates a cryptographic receipt via TraceSeal showing exactly which model received the prompt, when, and what was returned. See compliance.
6. Bring-your-own-key (BYOK)
On the Pro tier and above you can plug in your own OpenRouter API key. When you do this, AI calls route through your key, billed by you to OpenRouter directly. We still see the prompt and response in transit (because the call originates from our server, not your browser), but we do not pay for the call and the billing relationship is with you, not us.
Direct keys for Anthropic and OpenAI are not supported in v1 — both providers are reachable via OpenRouter today, and we'll add direct keys when there's clear demand.
Your BYOK key is encrypted at rest in our database with a key we hold separately. We decrypt it only at request time, in memory, and never write it to logs. If you delete your account or rotate the key in OpenRouter, the key in our system becomes useless immediately.
7. International transfers
Most of our infrastructure is hosted in the EU and US:
- Clerk: US (Standard Contractual Clauses + UK IDTA in place)
- Stripe: US/EU (UK adequacy decision applies for EU data; SCCs for US transfers)
- OpenRouter, Anthropic, OpenAI: US (SCCs + UK IDTA)
- Cloudflare R2 + Pages: distributed; you can pin region — we use EU and US
- Neon: UK (region eu-west-2, London)
Where we transfer personal data outside the UK or EEA, we rely on the UK International Data Transfer Agreement (IDTA), the EU Standard Contractual Clauses, or an adequacy decision, whichever applies. Copies are available on request.
8. How long we keep things
| Type of data | Retention |
|---|---|
| Account data (email, password) | For as long as your account is active, plus 30 days after deletion |
| Apps you've built (code, config, files) | 30 days after subscription cancellation, then permanently deleted |
| Prompts and responses | Stored for the lifetime of the project they belong to; permanently deleted with the project |
| Compliance receipts (Compliance tier+) | Hot for 30 days, cold storage for 7 years (regulatory norm), then deleted |
| Stripe billing records | 7 years (UK tax law) |
| Server logs (truncated IPs, user-agent) | 30 days |
| Backups | Rolling 30 days |
9. Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you
- Correct data that is wrong
- Delete your data (the "right to be forgotten")
- Restrict our processing of your data
- Object to processing based on legitimate interests
- Port your data to another service in a structured, machine-readable format
- Withdraw consent for any processing based on consent (e.g. marketing emails)
- Not be subject to fully automated decisions with significant effects (we don't make any)
To exercise any of these rights, email hello@maximusdev.cloud. We'll respond within one calendar month. There's no charge unless requests are unusually repetitive or excessive, in which case we'll explain any fee before doing anything.
For account deletion specifically, you can also do it yourself in Account → Settings → Delete account — that triggers the same 30-day grace then permanent erasure described above.
10. Cookies and tracking
We keep this short.
- Marketing site (maximusdev.cloud): no cookies, no third-party trackers, no pixels. Cloudflare may set its own performance/security cookies at the edge — we don't read them.
- App (/app): a session cookie set by Clerk for authentication. That's the only cookie. It's strictly necessary for the service to function and so is exempt from the prior-consent requirement under PECR.
- No analytics, advertising, or behavioural tracking cookies anywhere on the site.
11. Security
We're realistic. We're a one-person operation. We get this right by leaning on infrastructure providers that have hardened security teams, and by keeping the surface area small.
- All traffic is TLS-encrypted end-to-end (Cloudflare-issued certificates).
- Passwords are hashed and salted by Clerk; we never see them.
- Database (Neon Postgres) is encrypted at rest, with row-level security isolating tenants.
- BYOK keys are encrypted at the application layer with a separate key.
- Server logs are written without secrets, with IPs truncated after 30 days.
- Backups are encrypted and stored on a separate cloud account.
If you discover a security issue, email hello@maximusdev.cloud with "SECURITY" in the subject. We'll respond within 24 hours. We don't currently run a paid bug bounty.
12. Children
MaximusDev is not directed at children under 16. We don't knowingly collect personal data from children. If you believe a child has signed up, please email us and we'll delete the account.
13. Changes to this policy
If we change this policy materially — meaning a change that affects your rights or how we use your data — we will email everyone with an active account at least 30 days before the change takes effect. Minor edits (typos, clarifying language) get a date update at the top of this page and nothing more.
We keep an archive of previous versions of this policy and will share the diff on request — email hello@maximusdev.cloud.
14. Complaints
If you think we've handled your data badly, please tell us first — hello@maximusdev.cloud. We'd much rather fix it directly.
If we don't fix it, you can complain to the UK regulator: the Information Commissioner's Office, at ico.org.uk/make-a-complaint. If you're in the EU, you can complain to your local supervisory authority — list at edpb.europa.eu.
15. Contact
For anything in this policy:
Email: hello@maximusdev.cloud
Subject line: "Privacy" gets you in front of the right inbox filter.
Operator: Tim Harfield, trading as MaximusDev. United Kingdom.