Privacy Policy

This policy is published by App Campus, the operator of https://appcampus.dev (the "Service"). In this policy, "we", "us", and "our" mean App Campus.

Privacy questions, access requests, and deletion requests go to support@appcampus.co. Build-related mail is also read at build@appcampus.dev. We will provide a postal address on request where the law requires it.

It covers personal data we process when you visit the public site, create an account, pay for the course, use the member portal, post in community, open a support ticket, or use Campus Code (including GitHub, Railway, and bring-your-own API keys).

It does not control GitHub, Railway, Stripe, or the model providers you connect. Those companies have their own policies. If you publish an app you built with Campus Code, you are the controller for that app's users.

We collect what you give us, what the product must store to work, and limited technical data from the browser and our servers.

Account and profile

• Email address and a hashed password.
• Optional name if you enter one at sign-up.
• Course entitlement records after a successful purchase.

Payments

• Stripe Checkout session id and, when Stripe sends it, a Stripe customer id.
• We do not store full card numbers, CVC, or expiry on our servers. Stripe processes the card.

Portal, course, and support

• Lesson progress and related portal activity needed to keep your place.
• Support tickets: your email, subject, and message.
• Optional build-request details you send to build@appcampus.dev.
• Community posts you publish: title, body, links, and images you attach.

Campus Code projects

• Project name, files, chat messages, brand settings, and related workspace state.
• Usage counters (credits used and last model label) so we can run limits.
• GitHub and Railway connection metadata (for example repo or project ids) after you connect.
• OAuth access tokens for GitHub and Railway, stored encrypted at rest.
• Bring-your-own (BYOK) model API keys, stored encrypted at rest. After save, the product shows only the last four characters (last4). We do not display the full key again.

Sessions, cookies, and device

• An httpOnly session cookie (ac_session) so you stay signed in.
• Short-lived OAuth state cookies while you connect GitHub or Railway.
• Local storage used by the product: an access token, a pending checkout session id, a portal theme preference, and a device id used for the single-device lock.
• User-agent and similar request headers when you register or heartbeat a device.

Technical logs

Our hosts record IP address, timestamps, request paths, and error traces so we can keep the Service up and investigate abuse. We do not use that log stream as a marketing list.

We process this data to:

• Create and authenticate your account.
• Take payment, confirm an order, and unlock the course.
• Deliver lessons, documents, kits, Campus Code, and support.
• Connect GitHub and Railway when you ask us to, and to deploy or sync on your behalf.
• Call a model provider with your BYOK key or our hosted capacity, using your prompts and project files as needed to generate or edit code.
• Enforce one active device per account.
• Prevent fraud, spam, and security incidents.
• Meet tax, accounting, and other legal duties.
• Email you about access, billing, or a request you opened. We do not sell your address to advertisers.

Legal bases (as they apply in your country) include performance of a contract, legitimate interests in running a secure paid product, consent where you connect a third-party account or paste a key, and legal obligation for payment records.

Passwords are stored as hashes, not in plain text. GitHub and Railway tokens and BYOK API keys are encrypted at rest (AES-256-GCM) before they are written to our database. The product UI exposes BYOK keys as last4 only after they are saved.

No method of transmission or storage is perfect. If we learn of a breach that affects you, we will notify you and the authorities as the law requires.

We use essential cookies and browser storage to sign you in, complete OAuth, and remember product settings. These are required for the Service to function. We do not currently set a separate advertising cookie or a third-party analytics pixel on the marketing site.

The public site loads the Plus Jakarta Sans font from Google Fonts. Your browser may contact Google to fetch that file. Google's policy applies to that request.

You can clear cookies and local storage in your browser. Doing so will sign you out and may reset theme and device lock until you sign in again.

We share data only as needed to run the Service:

• Railway hosts the application and database.
• GitHub receives OAuth identity and, if you connect Campus Code, tokens and repo actions you authorize.
• Railway receives OAuth identity and, if you connect Campus Code, tokens and deploy actions you authorize.
• Stripe processes course payments and holds card data. We store session and customer identifiers, not the card.
• Model providers (for example OpenAI, Anthropic, or Google, depending on the key in use) receive prompts, file context, and tool calls when Campus Code generates or edits code.
• Google Fonts may receive a font request from your browser, as described above.
• Professional advisers or authorities if the law requires it, or to defend a claim.
• A successor if App Campus is transferred, in which case this policy will still apply until you are told otherwise.

We do not sell personal data and we do not rent your email for other people's campaigns.

• Account and entitlement records: for as long as the account exists, then as long as tax or dispute rules require.
• Campus Code projects and chat: until you delete the project or the account, unless we must keep a copy for security or legal reasons.
• GitHub and Railway tokens: until you disconnect the provider or we delete the account.
• BYOK keys: until you remove the key or we delete the account. last4 is dropped with the key.
• Support tickets and build requests: while we need them to help you and improve the product, then we delete or anonymize them.
• Community posts: until you delete them or we remove them under the Terms.
• Server logs: for a short operational window, longer if we are investigating an incident.
• Stripe records: according to Stripe and our accounting duties.

When you ask us to delete your account, we will delete or irreversibly anonymize personal data we no longer need, typically within 30 days, except where we must retain a record.

Depending on where you live (including Brazil under the LGPD, and the EEA/UK under the GDPR, as permitted by law), you may have the right to:

• Access a copy of the personal data we hold about you.
• Correct inaccurate data.
• Delete data we no longer need (including closing the account).
• Receive a portable copy of data you provided, where that right applies.
• Withdraw consent (for example, disconnect GitHub or Railway, or remove a BYOK key).
• Object to or restrict certain processing.
• Lodge a complaint with your local data-protection authority.

Email support@appcampus.co from the address on your account. We may need to verify it is you. We will answer within the time the applicable law sets.

App Campus is operated for an international audience. Hosts and processors may handle data in the United States, Brazil, the European Economic Area, and other countries. When we transfer personal data across borders, we rely on the safeguards the law allows (including contractual clauses and the fact that you asked us to send data to a provider you chose).

The Service is not directed at children under 13, and we do not knowingly collect personal data from them. You must be at least 16 to create an account, or older if your country requires it to form a contract. Paid purchases require the legal capacity to buy. If you believe a child gave us data, write to support@appcampus.co and we will delete it.

We will update this page when the product or the law changes. The "Last updated" date at the top is the current version. Material changes will be posted here. Continued use after a change means you accept the new policy, as permitted by law. If a change requires consent, we will ask for it.

App Campus · https://appcampus.dev
Privacy and account requests: support@appcampus.co
Build requests: build@appcampus.dev

Related: Terms of Service.