Studio by Ecodia

Data handling

Last updated 29 June 2026

The specifics behind the Privacy Policy: where each kind of data sits, how it is protected, and who can read it. Run by Ecodia Pty Ltd (ABN 89 693 123 278).

1. Your website lives on infrastructure you own

The site your Friend builds runs on your own code repository, your own host, and your own database. Ecodia keeps a pointer to it and a deploy key, held in your encrypted vault, so the Friend can ship your changes. We do not hold your website’s own data, and you can disconnect and keep all of it.

2. Your keys are encrypted and the studio cannot read them

Each secret you save is encrypted with AES-256-GCM under a key unique to your site. The encrypted columns are blocked at the database itself from your browser and from every other account, so the plain values are not reachable from the app at all. Our server decrypts a single secret only at the instant it is needed to run a job you asked for, and writes that access to an audit log.

3. The Friend runs on infrastructure we control, with a swappable model

Your Friend’s reasoning runs on an engine Ecodia operates (on Google Cloud), not handed wholesale to a single AI vendor, and the underlying model can be swapped. Today it is DeepSeek. The engine receives your message and the context for the task; it does not receive your saved secrets.

4. Every AI change passes a safety gate

Before any AI-written change goes live it is checked automatically: it must type-check and build, and it is blocked from importing secrets or reading environment variables. A change that fails the gate is never applied.

5. Who can read what

Data	Where it is stored	Who can read it
Email and sign-in	Supabase Auth	You; our server, to sign you in
Sites and content	Our database (Supabase), row-level scoped	You only, through the studio
Saved keys and passwords	Your vault, encrypted	Nobody as plain text, except our server at the moment of use
Your website's own data	Infrastructure you own	You

The studio runs no third-party analytics or trackers, so none of the above is shared with an advertising or analytics network.

6. Deleting data

Delete a site and everything attached to it is removed with it. Close your account and your data is removed from our database. To request a copy or a deletion, email code@ecodia.au.