What is stored
TweakLane stores layout documents (layouts, themes, user screens, navigation, designs and versions) keyed by your app and your user id. You choose the id; TweakLane needs no email address, name or other contact details of your users.
| Data | Purpose |
|---|---|
Your user id (or anon:<installId>) |
whose designs these are |
| Layout documents | the user's designs: component ids from your catalog, order, visibility, size, options, style, props |
| Catalog manifests | your components and default documents, to validate writes |
| Audit rows per write | app, user id, screen, action, versions, size, app version, time |
| AI consent | provider name shown, consent version, granted and revoked time |
| AI log rows | see below |
The SDKs send no device identifiers, no location and no analytics events. Props are whatever your catalog puts there, so keep personal data out of props and default documents.
Where it runs
| Service | Provider | Region |
|---|---|---|
| Database, authentication, API (edge functions) | Supabase | EU, eu-central-1 (Frankfurt) |
| AI requests | Anthropic (Claude) | only when you enable AI and the user consents |
| Website, dashboard hosting, DNS | Cloudflare | global edge |
Access control
- Every request carries your app's public key and a user token signed with your app's secret key. A request reads and writes only the data of the user in the token, in that app.
- Database tables have row-level security forced with no policies, and the public data API has no table privileges. Only the API function touches the tables, always scoped to the app and user from the verified token.
- Writes lock the row, compare versions and write the audit row in one transaction.
AI
- AI is off until you switch it on for your app, and each user must consent before their first request leaves the device.
- The model receives the screen's layout, your catalog's ids and the user's request. It receives no user id, token or device data.
- Prompts are logged per app for 30 days by default. Change the retention, or switch prompt
storage off (
ai_store_prompts) and only the prompt length is kept. - Every AI answer is re-validated on the server and again on the device before it is shown.
Locks hold everywhere
A design can come from edit mode, a stored file, a restore, a design switch, sync, the API or the AI. Every path runs the same validator against your catalog and locks. In the Memory Tin limits run, 40 stored-document attacks, 19 edit-mode attacks and 8 AI attack prompts in each of 5 editors were all refused or repaired.
Kill switches
Send an app, a screen or a component back to your defaults for every user, from the dashboard. Nothing is deleted; turning the switch off restores the users' designs.
Your users' rights
You are the controller of your users' data; TweakLane processes it on your behalf. Use
GET /users/:userId/export to answer access and portability requests and DELETE /users/:userId
to erase a user. See API: server routes.
Reporting a vulnerability
Email support@tweaklane.com with the details. We answer every report.