Privacy Policy

We collect only what we need to provide the Service:

Account information. When you create an account, we collect your name, email address, and a securely hashed password. We do not store your password in plain text.

Your ideas and materials. The ideas you write and the files you upload are stored so you can return to them. You own this content, and you can delete it at any time.

Payment information. If you start a free trial or become a member, your payment details are collected at signup and processed directly by Paddle, our payment processor. We do not receive or store your full card number; we keep a record of your subscription status and a customer reference so we can manage your access.

Usage and device data. We collect limited, aggregated analytics about how the site is used (for example, page views) to keep the Service working well.

We use your information to operate and secure your account, to store and display your ideas and materials, to power the Explore feature and the Milo help assistant, to process subscriptions, to send you essential account emails (such as password resets), and to understand and improve how the Service is used.

When you use the Explore feature, the idea details you choose to discuss are sent to an AI model provider through Vercel’s AI Gateway so it can generate a response for you. We send only what is needed to produce the response. Please avoid sharing sensitive personal information in Explore conversations.

Milo is an optional chat assistant that answers questions about how to use Concept Sandbox. Milo uses artificial intelligence (AI) to read your question and write a reply. You don’t need an account to use Milo, and you don’t have to use it at all.

What Milo can and can’t see. Milo only knows general, public information about how Concept Sandbox works. It does not have access to your ideas, files, account details, subscription, or billing information, and it cannot make changes to your account.

What is sent to the AI provider. When you ask Milo a question, we send your question, the most recent messages in your current Milo chat (up to eight, including Milo’s replies), and our own instructions describing the website. These are sent to an AI model provider (for example, OpenAI) through Vercel’s AI Gateway. We do not send your name, email address, account details, ideas, or billing information. Before sending, we automatically try to remove email addresses, phone numbers, and card-style or Social Security–style numbers from your question. This filter can’t catch everything, so please don’t type personal or sensitive information into Milo.

Talking to Milo (voice). Voice is optional; you can always type instead. If you tap the microphone in Milo’s panel, your browser first asks for permission to use your microphone. Milo only records while the red “Listening” indicator is showing, and the microphone is turned off after each question. If you turn on hands-free, the microphone turns back on by itself after Milo finishes speaking, and the red indicator shows again. Your recording is sent through Vercel’s AI Gateway to a speech-to-text provider (for example, OpenAI) to turn your words into text. That text is then handled like a typed question, including the filter described above. To read Milo’s answer aloud, the text of the answer is first shortened into a brief spoken version by the same kind of AI model that writes Milo’s answers, then sent the same way to a text-to-speech provider (for example, Microsoft), and the audio is played in your browser. The full written answer stays in the chat. You can mute Milo’s voice, stop listening or speaking at any time, or end voice to turn the microphone off.

Whether your chat is stored. We do not save your Milo conversations or voice recordings, and we do not record the text or audio of your questions, or Milo’s spoken answers, in our logs. Recordings and spoken answers are only held in memory long enough to process and play them. Your chat lives only in your open browser page and disappears when you leave or reload the page or start a new chat. Vercel’s AI Gateway deletes the questions, recordings, and replies after each request is completed.

How the AI provider handles it. Vercel may send a request to more than one AI provider (for example, if one is unavailable). Milo is set up so that, whichever provider is used, it must be one that has agreed not to use your questions, recordings, or Milo’s replies to train its AI models. This applies to typed and spoken questions and to Milo’s spoken answers. The provider that handles a request may keep it for a limited time to detect and prevent abuse, under its own terms and policies. For example, OpenAI’s standard policy for its API is to keep this information for up to 30 days unless the law requires it to be kept longer. If a different provider handles a request, that provider’s retention terms apply instead.

Preventing misuse. To keep Milo available for everyone, we limit how many questions can be asked in a short time. Voice has its own, lower limit. To do this, our server keeps a scrambled (hashed) version of your network address and the times of your recent questions in temporary memory for up to 24 hours. This is not linked to your account.

Not professional advice. Milo gives general guidance about using Concept Sandbox. It does not give legal, tax, financial, or other professional advice, and its answers may sometimes be incomplete or wrong. You make your own decisions and choose your own providers.

What is sent to the AI provider. When you ask Milo to create, refine, or redraw a concept drawing, we send your drawing request, the drawing being changed (for a refinement or redraw), and, only if you turned on “Let Milo help with this idea”for that idea, that one idea’s title, description, category, problem, and audience. This goes through Vercel’s AI Gateway to an image model provider (currently Google). We do not send your name, email address, account details, or your other ideas or files. Drawing requests are routed only to providers that have agreed with Vercel not to keep the content after the drawing is made and not to use it for training, although a provider may apply automated checks for misuse.

Where drawings are kept. Drawings, and pictures you upload with “Upload Your Own Drawing,” are stored privately with the idea they belong to and are shown only to you. Uploaded pictures are kept as you uploaded them, except that hidden details stored inside the file, such as camera information and location, are removed (very large photos are first reduced in size in your browser). Uploads are never sent to the AI provider unless you choose to have Milo redraw them. Unsaved drawings stop appearing after 24 hours and are permanently deleted the next time you open one of your ideas or use the drawing feature, or when you delete the idea. You can delete a saved drawing at any time, and deleting an idea deletes its drawings. We keep a record of how many AI drawings you have made (not the pictures) so we can apply usage limits.

We do not sell your personal information. We share information only with providers that help us run the Service, and only as needed:

Vercel — hosting, file storage for your uploads, and privacy-friendly, aggregated analytics. Neon — our managed database, where your account and ideas are stored. Paddle — payment processing and subscription management. Brevo — delivery of transactional emails such as password resets. An AI model provider (accessed via Vercel’s AI Gateway) — to generate Explore and Milo responses and concept drawings.

Concept Sandbox uses a small number of essential, first-party cookies to keep you signed in and to maintain the security of your session. These cookies are required for the Service to function.

Our current analytics are designed to be privacy-friendly and do not rely on cross-site tracking cookies.

We keep your account information and content for as long as your account is active. If your subscription lapses, your saved ideas and materials remain stored unless you delete them, so they are waiting for you if you return. You can delete individual ideas and materials at any time, or contact us to close your account and delete your data.

We take reasonable measures to protect your information, including hashed passwords and encrypted connections. No online service can be guaranteed to be perfectly secure, so we cannot promise absolute security.

You can view, edit, and delete your ideas and materials from within the app, manage your subscription through the billing portal, and contact us to request access to or deletion of your personal information. Depending on where you live, you may have additional rights under applicable law.

The Service is not directed to children under 13, and we do not knowingly collect personal information from them.

We may update this policy from time to time. If we make material changes, we will update the effective date above and, where appropriate, provide additional notice.

Questions or requests about your privacy? Contact us at hello@conceptsandbox.com. You can also review our Terms of Service.