Privacy
The short version: your sites are yours, we collect only what hosting them requires, and we don't sell any of it. Effective August 7, 2026.
Drivethrough hosts websites you create through an AI assistant or our command-line tool. This policy explains what information we collect while doing that, what we do with it, and the choices you have. It covers drivethrough.dev, sites hosted on drivethrough.site, and the Drivethrough connector (MCP server) at mcp.drivethrough.dev.
Account information. You sign in with Google, and we receive your name and email address. We never see your Google password, and we don't ask for one of our own.
Your sites and their data. The pages you publish, every saved version of them, and anything stored in a site's database — including information guests submit through forms on your site. This content is yours; we store it to host it.
Payment information. Paid plans are billed by Stripe. Your card details go directly to Stripe and never touch our servers; we keep only your plan and subscription status.
Operational records. Standard server logs (IP address, request time, user agent), usage counts against plan limits, and the results of the automated safety scan every site goes through before it's served.
When you use Drivethrough through Claude, ChatGPT, or another assistant, the assistant sends us only what's needed to do what you asked: the content of a site to deploy, an edit to apply, a query against your site's database. We don't receive your conversations, and we don't ask assistants for anything beyond the tool call in front of us.
To run the service: hosting your sites, enforcing plan limits, sending the emails you trigger (like share invitations), keeping the platform safe from scams and abuse, and helping you when something goes wrong. We don't sell your information, we don't run ads, and we don't use your sites or their data to train AI models.
Everything is stored on Cloudflare's global infrastructure — the same network that serves your sites. Private sites are private: they're served only to you and the guests you've shared them with.
Only the services that make Drivethrough work: Cloudflare (hosting and storage), Google (sign-in), Stripe (payments), Resend (transactional email), and — if you connect a custom domain — the DNS setup involves your own domain registrar. Each receives only what its job requires. Beyond that, we disclose information only if the law requires it.
Your sites and their version history stay as long as your account does. A deleted site is recoverable for 30 days, then destroyed for good. If you want your account and everything in it removed, email us and we'll do it.
People you share a private site with never create accounts. A guest's visit is recorded like any web request (server logs), and anything they submit through your site's forms is stored in that site's database — visible to you, the site's owner. If you invite a guest by email, we use that address once to send the invitation.
If this policy changes in a way that matters, we'll note it here with a new effective date. Questions, or a data request? Email hello@drivethrough.dev — a human reads it.