Last updated: 2026-07-14

Privacy Policy

This Privacy Policy describes how Brightwing Systems, LLC ("we", "us", or "our") collects, uses, and protects information when you use ProtoPeek ("the Service") available at protopeek.dev. By using the Service, you agree to the collection and use of information in accordance with this policy.

1. Information We Collect

Prototype content

When you upload a prototype, we collect the HTML file you submit and the display name you give it. There is no access list to collect: a prototype has no per-reviewer settings.

Data received via AI coding tools

ProtoPeek is designed to be driven by AI coding agents (such as Claude Code, Codex, or Gemini CLI). When you upload through an agent, the upload payload — the HTML file and its metadata — is sent from your machine to our API. We receive and store only that payload. We do not receive, access, or store your conversations with the agent.

Owner tokens and accounts

Owners are identified by an access token, which can be minted without providing any personal information. If you claim a token for recovery, we collect the email address you provide.

Reviewer identity

Reviewers type an email address once per browser. It is not a sign-in and it is never verified — any well-formed address is accepted, and it is not checked against anything. We use it solely to attribute feedback to a name, and we remember it in a signed cookie so it doesn't need to be re-entered.

Feedback data

When a reviewer leaves feedback, we collect the note, the on-page anchors that position the pin (CSS selectors, text snippets), an optional screenshot of the annotated region of the rendered prototype, and capture context (page URL, viewport size, browser user-agent).

Usage data

We collect standard server logs (IP addresses, browser type, pages visited, timestamps) to operate the Service and prevent abuse, including short-lived rate-limit counters keyed by IP address.

Cookies

We use only essential and functional cookies:

• protopeek_sessionid — session management (signed-in owners only)
• protopeek_csrftoken — CSRF protection
• protopeek_reviewer — the signed reviewer-identity cookie (14 days)

We do not use analytics, advertising, or third-party tracking cookies.

2. Legal Basis for Processing

We process your personal information on the following legal bases:

• Contract performance: to provide the Service you have requested, including hosting prototypes and delivering feedback
• Legitimate interest: to operate, maintain, and improve the Service, detect abuse, and ensure security
• Consent: where required by applicable law, such as for optional communications

3. How We Use Your Information

• To host prototypes and serve them to anyone who opens their link
• To attribute feedback to the email its author entered
• To return feedback to the prototype's owner, including through the API
• To communicate with you about the Service (e.g., security alerts, updates)
• To respond to support requests
• To detect and prevent fraud, abuse, or security incidents

4. Data Sharing

We do not sell your personal information.

ProtoPeek has no access control. A prototype is reachable by anyone who has its link, for as long as the link is live — there is no allowlist, no restricted mode, and no way to limit a prototype to particular people. The only protection is that the link contains an unguessable random identifier; the 14-day lifetime bounds how long a link can be used, but it is not a substitute for access control. Anyone with the link can also leave feedback, and can see the feedback others have left. Please do not upload anything confidential or personal to ProtoPeek.

Beyond that, we share information only in the following circumstances:

• Service providers: we use third-party providers to operate the Service, bound to access data only as necessary to perform their functions. These include our cloud hosting provider (Hetzner).
• Legal requirements: we may disclose information if required by law, subpoena, or other legal process.
• Business transfers: if Brightwing Systems, LLC is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

5. Data Retention

Every prototype is permanently deleted 14 days after its first upload. That single moment is both when the link stops resolving and when the data is destroyed — the prototype, every stored version, all feedback, and all screenshots. There is no grace period afterwards in which anything is retained.

Nothing extends that deadline. Publishing a new version does not extend it, and deactivating and re-opening a link does not extend it; a request to re-open a prototype after its deadline is refused rather than granted. The deadline is fixed when the prototype is created and cannot be changed by us or by the owner, and it is not configurable per customer or per prototype.

Before that deadline: only the three most recent versions of a prototype are retained, and older ones are removed automatically. Owners can permanently delete any prototype sooner, at any time, via the dashboard or API. Owners who want to keep reviewer feedback must retrieve it before the deadline, because it is not recoverable afterwards.

Deletion requests for other stored data are honored within 30 days, except where retention is required by law. The reviewer-identity cookie expires after 14 days. Server logs are kept for a limited period for security and operations.

6. International Data Transfers

Our servers are located in the United States. If you access the Service from outside the United States, your information may be transferred to, stored, and processed there. By using the Service, you consent to the transfer of your information as described in this policy. We take appropriate measures to ensure your data is treated securely regardless of where it is processed.

7. Data Security

We implement industry-standard security measures to protect your information, including encryption in transit (TLS), signed cookies, access controls, and regular backups. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Your Rights

Owners may:

• Deactivate a prototype or let its link expire at any time, via the dashboard or API
• Permanently delete a prototype — its content and all associated feedback — at any time, via the dashboard or API, effective immediately
• Revoke or rotate access tokens at any time
• Request a copy or deletion of stored data by contacting privacy@brightwingsystems.com

Reviewers may request access to or deletion of feedback attributed to their email address by contacting privacy@brightwingsystems.com.

California residents (CCPA)

If you are a California resident, you have the right to know what personal information we collect, use, and disclose; to request deletion of your personal information; and to opt out of the sale of your personal information. We do not sell your personal information. To exercise these rights, contact us at privacy@brightwingsystems.com. We will not discriminate against you for exercising any of these rights.

European Economic Area, UK, and Swiss residents (GDPR)

If you are located in the EEA, UK, or Switzerland, you have the right to access your personal data; rectify inaccurate data; request erasure of your data; restrict or object to processing; request data portability; and lodge a complaint with your local data protection supervisory authority. To exercise these rights, contact us at privacy@brightwingsystems.com.

9. Children's Privacy

The Service is intended for users aged 13 and older. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us at privacy@brightwingsystems.com and we will take steps to delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the revised policy.

11. Contact Us

If you have questions about this Privacy Policy, contact us at privacy@brightwingsystems.com.