Privacy policy

What we collect

• Account details: your email address and display name when you sign up, including through Google sign-in.
• Learning activity: exercises you complete, lesson progress, XP, streaks, reflections, and founder-journey checklists, so your workshop and studio remember where you left off.
• Ask Messy conversations: the questions you ask and the answers, so mentors can follow up when you request a human.
• Billing: if you upgrade to Pro, payments are processed by Stripe. We see your plan status, never your full card number.
• Connected tools: if you link GitHub, Vercel, or similar accounts, we store encrypted access tokens so Messy can act only when you ask. Tokens are never shown back to you or to anyone else.
• Security records: sign-in events and rate-limit counters, stored with a hashed (not raw) IP address, to protect accounts from abuse.
• Privacy and contact requests: what you send us through the contact form or the Privacy Request Center.

What we don't do

• We don't sell your data.
• We don't run advertising or third-party trackers.
• We don't use your code or conversations to train models.
• We don't post to Product Hunt, social networks, or anywhere else on your behalf — Messy drafts, you ship.

How we use information

• To personalise your learning path, difficulty, and Messy's coaching.
• To show your own progress dashboard, lesson progress, and funnel numbers.
• To send account emails (welcome, receipts, important changes) — never marketing you didn't ask for.
• To keep the service secure and prevent abuse.

Why we process information

• We don't rely on consent for everything. Depending on where you live, the legal reasons that may apply are:
• Account and sign-in: to provide the service you asked for (performing our agreement with you), and to keep accounts secure (our legitimate interest in security).
• Learning progress and personalisation: to provide and personalise the service you signed up for.
• Billing: to perform your subscription, and to meet legal and accounting obligations for payment records.
• AI interactions: to provide the Ask Messy and explanation features you request.
• Connected tools: to carry out actions you trigger on accounts you connected.
• Security and abuse prevention: our legitimate interest in protecting MessyDev and its users, and legal obligations where they apply.
• Necessary service emails (account, security, receipts): to provide the service and, for receipts, legal obligations.
• Optional learning analytics: your consent, which you can withdraw at any time.
• Optional product emails (weekly digest, onboarding tips): you can turn these off in your account. We don't send promotional marketing from or for third parties.

Cookies and device storage

• Strictly necessary storage keeps you signed in and remembers device preferences like text size, motion, and language. These are always on — the site doesn't work without them.
• Optional learning analytics only run if you tap Accept on the consent banner. Decline and nothing optional is stored or sent.
• Your choice and the time you made it are remembered on your device. Change it any time with “Cookie preferences” in the footer, or the button below.

AI processing

• When you ask Messy a question or request an explanation, the text you send (and the lesson context around it) is passed to AI models — currently Google and OpenAI models, via Lovable's AI gateway — to produce a reply.
• It is not used by MessyDev to train models. AI answers can be wrong; check anything important.
• Messy's lesson suggestions are personalisation you can ignore. MessyDev makes no automated decisions with legal or similarly significant effects on you.

Connected services

• If you connect GitHub, Vercel or similar tools, we store an encrypted access token and use it only for actions you trigger.
• Disconnecting deletes the stored token. Tokens are never included in data exports or shown to anyone.

Service providers

We share personal data with service providers only as reasonably necessary to provide, secure, support, and improve MessyDev, subject to applicable contractual and legal safeguards. Last reviewed 2026-10-01.

International data transfers

• MessyDev is operated from the United States, and some service providers may process information in other countries, including outside the country where you live.
• Where the law requires it, we use the safeguards that applicable law calls for when personal data is transferred internationally.
• To ask about international transfers, use the Privacy Request Center and choose “Ask about international transfers”.

Data retention

• We keep your data while your account is active. If you ask us to delete your account, we remove your personal data within 30 days, except billing records we're legally required to keep.
• Security records with hashed IP addresses are kept only as long as needed to protect the service.

Your privacy rights

• Disconnect any tool from your account at any time; the stored token is deleted.
• Update your profile and display name in your account page.
• Ask to access, export, correct or delete your data, or withdraw consent, through the Privacy Request Center. We verify requests before releasing or changing account information.
• Rights depend on where you live and are subject to applicable law; if we can't fully meet a request we'll explain why.

Regional privacy rights

• EU, EEA and UK: you may have rights to access, rectification, erasure, restriction, portability and objection, and to complain to your local data protection authority.
• United States: depending on your state, you may have rights to know, access, correct and delete your personal information. We don't sell or share personal information for cross-context advertising.
• Brazil: see the LGPD section below.

Brazil — LGPD privacy rights

• If you are in Brazil, the Brazilian General Data Protection Law (LGPD) may give you rights over your personal data. Where they apply, you can ask us to:
• Confirm whether we process your personal data, and give you access to it.
• Correct data that is incomplete, inaccurate or out of date.
• Tell you which categories of third parties we share your data with.
• Provide your data in a portable format, where the law provides for it.
• Anonymise, block or delete data that is unnecessary, excessive or processed unlawfully, where applicable.
• Delete data we process based on your consent, where applicable.
• Explain what happens if you do not give consent, and let you withdraw consent where consent is the basis we rely on.
• Review, or give you information about, decisions made solely by automated processing that affect your interests, where applicable. MessyDev's lesson suggestions are personalisation you can ignore, not decisions with legal effect.
• These rights are subject to applicable law. Some requests may be limited — for example, where we must keep billing records for legal or accounting reasons, or to protect the security of the service. If we cannot fully meet a request, we will tell you why.
• To make a request, use the Privacy Request Center. You can also contact the ANPD (Brazil's data protection authority).

Children

• MessyDev is not designed for children under 13, and we don't knowingly collect their personal data. If you believe a child has given us data, contact us and we will delete it.

Changes

• If this policy changes materially we'll email you before it takes effect. The 'last updated' date above always shows the current version.
• Previous version: September 2026.