Privacy policy

Updated 5 October 2026

We wrote this policy for the Garlic site builder at www.garlic.lol and the sites Garlic hosts. Here we set out what we collect, how we use it, who receives it and how we protect it. In this policy, “we” means the people who run Garlic. Send any question to personjerry@gmail.com.

Garlic runs apartments.garlic.lol as a separate experimental app with its own accounts. This policy does not cover that app.

What we collect

Your account

When you claim a site, you give us a site name, an email address and an owner password. We store the password only as a salted hash, so nobody at Garlic can read it. We also record the IP address you signed up from. The kind of site you pick at signup sets your starter pages. If another site on Garlic referred you, we record that site’s name with your account.

You can invite other people to build your site with you. We store the name each builder enters and set a cookie so that builder’s browser can return to your studio.

Your site

Your pages, site settings, the notes in About your site and build history are stored in our database. Published pages are public. If you turn on Clone site, visitors can copy your public pages into a new site. A clone copies your site’s look and the uploaded files those pages use as well. Your invite settings include “Allow builders to copy an app into a new site”. When it is on, each builder who joins through the invite can copy one published app page into a new site. The copy includes the uploaded files that page uses.

Files you upload to your site are stored on our server. Anyone who has a file’s address can open it.

Private files

Private files you add in the studio are stored in a private DigitalOcean Spaces bucket. Only you, signed in as the owner, can open them in Garlic. A private file becomes public only when you publish it to your site.

Build requests

Each message you send in the studio can start a build. We store your message, the AI’s reply and a list of the changes it made.

Payments

If you pay for a plan or credits, Stripe hosts the checkout page and collects your card details and billing address. Garlic never receives your full card number or security code. Stripe sends us a record of each payment event, and we store those records. They can include your name, email, billing address, card brand, the last four digits of your card and its expiry date. When you start a checkout, we store your Stripe customer number with your account. If you subscribe to a plan, we store your subscription number too.

Domains

If you buy a domain through Garlic, we register it in Garlic’s name through Namecheap, Inc. Namecheap receives the domain name and Garlic’s contact details. The public WHOIS record shows the registrar’s privacy service. When you search for a domain, we send Namecheap each name we check for you. Under the Domain terms, we may pass your contact details to the registrar, ICANN, courts or dispute providers. The same terms allow us to pass them to anyone who gives reasonable evidence of actionable harm.

Visitors to sites on Garlic

Each site on Garlic belongs to its owner. Our web server logs requests to those sites and to www.garlic.lol. Each log line holds the visitor’s IP address, the time and the requested page. It also holds the response status and size, the referring page and the browser’s user agent. Garlic’s application server keeps a second request log. Each line there holds the time, the requested page and the response status and size, with no IP address.

Some sites include interactive apps, such as a poll or a game. Garlic saves what you enter in an app, and anyone viewing that page can see it. The site owner can read it too. Apps can also keep data in your browser’s local storage.

Some sites have forms, such as a booking or contact form. What you send through a form goes to the owner of that site. On the site, only the owner, signed in to the studio, can read it. Builders the owner invites see each form’s title, how many responses arrived and when the newest one arrived. They never see what you wrote. Garlic stores each response with the time it arrived and a code made from your IP address, so the owner can remove repeated spam. The owner cannot turn that code back into your IP address. Form responses stay in Garlic’s database, which runs on DigitalOcean. Garlic’s operator runs that database and its backups, so the operator can read responses too. The AI that builds sites never receives what you wrote. Forms on Garlic cannot take card numbers or passwords.

Pages on these sites use fonts from Google Fonts. Pages with an app can load script libraries from Cloudflare cdnjs and jsDelivr. Owners may also show photos hosted elsewhere, such as Unsplash, Pexels or Wikimedia Commons. Your browser fetches those files directly, so those services see your IP address. For questions about how a site owner uses your data, contact that owner.

How we use it

We use your account details to sign you in, run your site and contact you about your account and payments.
We use your signup IP address to limit how many sites one connection can create in a day.
We use your site content, your requests and any private files you select to build the site you ask for.
If you pay, we use payment records to apply your plan, grant edits or credits, handle refunds and keep our accounts.
We use server logs to run the service, fix faults and stop abuse.

We do not use your data for advertising.

We share personal data with the services below to run Garlic. Garlic does not sell personal data. Each API call Garlic’s server makes to these services travels over an encrypted HTTPS connection. DNS lookups travel unencrypted. These include the checks in the table. Before requesting a certificate for a custom domain, the server also looks up the domain through its hosting provider’s resolver.

Service	What it receives	How
Anthropic, PBC	Your build requests and earlier build history. Your pages, site settings, the notes in About your site and upload names and captions. Screenshots of unpublished pages and app data a build reads. Private files you select for a build, after you tick the box agreeing to send them. Builds never receive what visitors wrote in a form.	Garlic’s server sends them to Anthropic’s API during each build. Anthropic runs the Claude models that write your site, and the web searches a build makes.
Stripe, Inc.	Your email address, Garlic account number and site address. The name of the plan or domain you buy. On Stripe’s checkout page, your card details and billing address.	When you start a checkout, Garlic’s server calls Stripe’s API. You type card details into Stripe’s page. Stripe sends payment events back to Garlic as signed webhooks.
DigitalOcean, LLC	Everything Garlic stores. Its New York data centers host our server, database and private file bucket.	We rent the server and storage. Private files travel to the Spaces bucket through its API.
Namecheap, Inc.	Each domain name checked when you search for a domain. The domain name you buy, with Garlic’s contact details.	A separate Garlic worker calls Namecheap’s API.
Let’s Encrypt (ISRG)	Each custom domain on Garlic. A site address ending in .garlic.lol whenever that site gets a certificate of its own.	Garlic’s server requests HTTPS certificates from Let’s Encrypt. When Garlic runs with one wildcard certificate for every address ending in .garlic.lol, a new site gets no certificate of its own. Otherwise, or when that certificate is missing or near expiry, the server requests a certificate for each new site address. Sites created before 28 September 2026 each have their own certificate. Custom domains always get their own certificate. Let’s Encrypt publishes every certificate in public Certificate Transparency logs, so anyone can look up those addresses.
Google and Cloudflare public DNS	The name of each domain bought through Garlic, and its www address.	Before requesting a certificate for that domain, Garlic’s server looks up where it points. It asks Google Public DNS, Cloudflare DNS and Namecheap’s name server.
Pexels, Wikimedia Commons and Unsplash	Short photo search phrases the builder writes for your site.	Garlic’s server calls their search APIs. It calls Pexels or Unsplash only while Garlic holds an API key for that service.
Google Fonts and photo hosts	A visitor’s IP address and browser details when a site page loads its fonts or photos.	The visitor’s browser requests the files directly.
Cloudflare cdnjs and jsDelivr	Your IP address and browser details when a page loads a script library from them. The studio loads two libraries from cdnjs. App pages on hosted sites may load libraries from either.	Your browser requests the files directly.

We may also disclose data when the law requires it. For a domain you buy through Garlic, the Domain terms let us pass your contact details to the registrar, ICANN, courts and dispute providers. They let us pass them to anyone who gives reasonable evidence of actionable harm too.

Cookies and browser storage

Garlic sets the three cookies below on www.garlic.lol. Garlic sets no cookies on the sites it hosts. We use no advertising or analytics cookies.

Cookie	Purpose	Lasts
`__Host-sessionid`	Keeps you signed in to the studio.	2 weeks.
`__Host-csrftoken`	Blocks forged form submissions.	1 year.
`garlic_bid`	Lets a builder who joined by invite link return to the studio.	1 year.

The studio can also keep a build request in your browser’s session storage until you confirm it.

How long we keep it

Your account, pages, uploads and private files stay until you delete them or ask us to delete your account.
What visitors enter in an app is deleted when the page holding the app, or the whole site, is deleted.
The owner of a site can delete form responses at any time. Garlic deletes each response 12 months after it arrives, and deletes all of them when the site is deleted. A deleted response can remain in a database backup until that backup is deleted, as described below.
A sign-in session can hold a builder’s name, the site that referred you and your first build request. A sweep that runs every 10 minutes deletes expired sessions.
We delete finished builds after 90 days. We keep a build longer when it holds your newest undo snapshot or your latest published draft. A build that carries a credit charge stays with our payment records and has no time limit.
We delete domain searches after 90 days.
Private file content prepared for a build is deleted when the build ends. If the build has not ended 24 hours after you send the request, the same 10-minute sweep deletes it.
Web server logs, which hold IP addresses, are deleted after 14 days.
The application server’s request log stays in the server’s system journal. The journal has a size cap and no time limit. Its oldest entries are removed when it fills.
Nightly database backups are deleted after 14 days. Each night’s backup run deletes the copies that have passed 14 days once its own copy is complete.
We back up the database before each release of Garlic. We keep each release backup until an operator removes it.
Before storage maintenance, we copy the database and stored files. We keep each storage copy until an operator removes it.
We keep payment records for our accounts after an account closes.

Security

Sign-in, the studio and the billing pages on www.garlic.lol use HTTPS only. We tell browsers to keep using HTTPS there for a year. Published sites are available over HTTPS. A visitor who follows an http:// link to a hosted site can receive the page over an unencrypted connection.

Owner passwords are stored as salted hashes. The sign-in cookie is marked Secure and HttpOnly and is limited to www.garlic.lol.

Each private file is stored with no public access. Before serving a private file, we check that our storage account holds its sole permission. We serve private files only to the signed-in site owner, and we tell browsers to keep no copy.

You enter card details on Stripe’s page, so they never reach our server. The Namecheap key lives in a separate worker process that handles domains. Nightly backups sit in a folder that only the Garlic service account can open. Only the server’s administrator account can open release backups and storage copies.

Your choices

You can edit or delete your pages, uploads, private files and form responses in the studio at any time. Email us to correct your email address or to delete your account. We handle each deletion request by hand. We delete your site, its pages, its uploads, its private files and its form responses. We keep payment and invoice records, with the account details they belong to, as our accounting requires. Nightly backups holding your site are deleted after 14 days. Release backups and storage copies stay until an operator removes them.

Changes and contact

When we change this policy, we update this page and the date at the top. Email personjerry@gmail.com about anything in it.