PafPrivacy policy
Last updated October 19, 2026
With Paf, you make a website by talking. To do that, we need some data: what you say, the photos you choose, the site you build. This page explains which data, why, who we share it with, how long we keep it, and how to erase all of it.
Our promise
- No password, and email is optional. By default you stay anonymous: the app recognizes you by a random ID kept on your phone. You can add your email to get your sites back on another phone.
- No ads. We don’t sell or rent your data to anyone.
- You stay in control. A button in the app erases your sites, your requests and your photos from our servers.
Data controller
Paf is the controller of your data. For any question: aide@paf.live.
What we collect
Your device
Each time you open the app, it sends our server:
- an anonymous ID, created by the app the first time you launch it and kept in your iPhone’s keychain (it survives reinstalling the app);
- your iPhone model, iOS version, app version and phone language;
- your IP address, which the server records each time you open the app.
We use this to recognize you and your sites without an account, to keep track of the free trial (one free page and 3 edits per phone), and to fix problems.
Your voice
When you speak, Apple’s speech recognition, built into iOS, turns your voice into text. Our server never receives the audio, only the final text. Depending on your iPhone and your settings, Apple may process your voice on the device or on its servers, under its own privacy policy. The app asks for access to the microphone and to speech recognition the first time.
Your requests and your sites
- The text of each request, the page shown at that moment, and what the agent did (summary, pages changed, cost in credits).
- Your sites’ files (pages, styles, photos) and each of their versions, so that “Undo” works.
- Your site’s name and, once published, its
.paf.liveaddress.
Your photos
The photos you add go through the iOS photo picker: the app only sees the ones you choose, never the rest of your photo library. They are sent to our server, which resizes and re-saves them, which removes their metadata, including where the photo was taken. The ones the agent puts in your site become public when you publish it.
Email address for forms
If your site has a form, you give the address where you want to receive the answers. We send it a 6-digit code to confirm it (we only keep a hash of the code, for 15 minutes), then each answer.
Your account email address, if you add one
In the app, in Account › Email, you can add your email address, confirmed with a 6-digit code (or with no code if you already confirmed it for a form). It is only used so you don’t lose your sites and credits, and to get them back on another phone: if you enter the same address there, the two accounts are merged into one. We don’t use it to send you anything other than that code, and we don’t give it to anyone. It is erased when you delete your account.
Your purchases
Credits are bought in the app, through the App Store. Apple takes the payment: we never see your card or your Apple ID. RevenueCat, our in-app purchase provider, sends us the purchase details (product, transaction ID, country, price) linked to your anonymous ID, so we can add the credits to your balance. We keep a record of your credit transactions.
Your domain, if you buy one
A domain is registered in its owner’s name, as domain name rules require. For this, the app asks you, one piece of information per screen:
- for a business or an association: its SIREN (or RNA) number, which we use to find its name and address in the French State’s public business directory; then the name of the person to contact;
- for an individual: your first name, last name and postal address;
- in every case: an email address and a phone number.
We send this information to OVH, the registrar, which creates the owner’s record and registers it with the extension’s registry (AFNIC for .fr, Verisign for .com, Public Interest Registry for .org). OVH emails the owner to confirm their email address.
The public domain name directory (Whois). Depending on each extension’s rules, some of the owner’s details may be publicly available. For an individual, they are normally hidden (only a way to contact them remains); for a business or an association, its name and address may be published.
We keep this information with the subscription record, to register and renew the domain, and to offer it again if you buy another one.
Crashes and app usage
The app sends to Google Firebase, Google’s service for apps:
- crashes (Crashlytics): what happened in the app just before, your iPhone model, the iOS and app versions, your anonymous ID;
- usage (Analytics): the screens opened and the main steps (a request sent, a site published, a purchase), with your iPhone model, the iOS and app versions, your country and your anonymous ID. Never what you say, the content of your sites, your photos or your addresses.
Firebase creates an app-specific identifier on your iPhone for this. We do not use Apple’s advertising identifier, and Google’s ad personalization is turned off. This data is used to fix bugs and understand what is used, on the basis of our legitimate interest in running and improving the app.
Why, and on what basis
| What we do | Legal basis (GDPR) |
|---|---|
| Running Paf: creating, editing and publishing your sites, keeping your credit balance | Performance of the service you use (Art. 6(1)(b)) |
| Registering, renewing and connecting a domain you buy, in its owner’s name | Performance of the contract (Art. 6(1)(b)) and the obligations of domain name registries (Art. 6(1)(c)) |
| Selling credits, keeping a record of purchases and refunds | Performance of the contract and our accounting obligations (Art. 6(1)(b) and (c)) |
| Preventing abuse: limiting the free trial, filtering bots on forms, taking down a reported site, keeping the service secure | Our legitimate interest in protecting the service (Art. 6(1)(f)) |
| Fixing errors using technical logs | Our legitimate interest (Art. 6(1)(f)) |
We don’t make any automated decision about you within the meaning of Article 22 of the GDPR.
Our providers
We only share your data with the providers the service needs, and only what each one needs.
| Provider | What for | Data | Where |
|---|---|---|---|
| Fly.io | Hosts our server and its database | All the data above | Server in Paris (France), US company |
| Cloudflare | Stores site files and database backups (R2), serves published sites and previews | Site files, backups, visitors’ IP addresses | Storage in the European Union; global network to serve pages; US company |
| Anthropic (Claude) | The agent that writes your site | Text of your requests, site files, attached photos | United States |
| Apple | Speech recognition, payment for purchases | Your voice (processed by iOS), your purchase | As set out in Apple’s policy |
| RevenueCat | Tracking in-app purchases | Anonymous ID, purchase details | United States |
| Resend | Sending emails (confirmation codes, form answers) | Receiving email address, content of the answers | United States |
| Pixabay | Free stock photo library | Search keywords chosen by the agent, with no personal data | Germany |
| OVH | Registrar for the domains bought in the app; for a domain you connect that is at OVH, changing its DNS zone, with your authorization | The owner’s details and the domain name; for a connected domain, only its name and the access you grant to its DNS zone | France |
| Annuaire des entreprises (French State) | Finding the name and address of a business or an association | The SIREN or RNA number entered | France |
| OpenStreetMap (Nominatim) | Finding places for a map | Names or addresses of the places to show, sent by our server | United Kingdom |
| Google (Firebase Crashlytics and Analytics) | Crash reports and app usage measurement | Anonymous ID, device, version, country, screens and steps; never the content | United States |
Anthropic commits not to use data sent through its API to train its models. When you ask for a site “in the style of” another one (paid sites only), the agent may search for and read that site on the web, using Anthropic’s search tools.
Transfers outside the European Union
Anthropic, Cloudflare, RevenueCat, Resend, Google and Fly.io are US companies. These transfers are covered by the EU-US Data Privacy Framework for the companies that are part of it, or by the European Commission’s standard contractual clauses.
Visitors to sites made with Paf
Sites published on .paf.live are public and can be found by search engines. Their content is the responsibility of the person who made the site: if you put information about other people on it, make sure you have the right to.
If you visit a site made with Paf:
- No cookies. We count visits, so the person who made the site knows how many people come: for each arrival on the site, we keep the time, the page, the site you come from (only its name, like google.com) and your country. Nothing that could identify you: not your IP address, not your device. These visits are deleted with the site.
- Your IP address goes through Cloudflare, which serves the page. Some elements come from elsewhere and also receive your IP address, as with any browser: fonts from Google Fonts (Google, United States) and, on pages with a map, the MapLibre library (through the jsDelivr CDN) and map tiles from OpenFreeMap.
- If you fill in a form, your answers are saved on our server and emailed (through Resend) to the person who made the site. For this, we act on their behalf: it’s up to them to explain what they do with your answers, and they are the first person to contact. If you gave your email, they can reply to you directly.
- To stop bots, we keep a hash of your IP address (never the address itself) with each answer, to limit how many answers each visitor can send.
- The Report link at the bottom of each site opens an email to aide@paf.live; we read that message to handle the report.
How long we keep your data
- Your sites, their versions, your requests and your photos: for as long as you keep them. Deleting a site takes it offline and immediately erases its versions, its requests and its form answers from our database; its files and our backups are erased within 30 days (see below).
- Form answers: for as long as the site exists. Answers received before the email address is confirmed are sent when it is confirmed (those from the past month at most).
- Purchases: for as long as our accounting obligations require, even after your data is deleted.
- A domain owner’s details: while the domain is active, then for as long as our accounting obligations require. OVH and the registry keep them under their own rules, even if you delete your data in Paf. Deleting your data does not stop the Apple subscription: cancel it in iPhone Settings.
- Your device information and the IP addresses from app opens: for as long as you use Paf. They are erased when you delete your data (see below).
- Server technical logs: a few days, for troubleshooting.
- Backups: the database is backed up continuously, with 30 days of history; our host also takes a daily snapshot of its disk, kept for 5 days.
Deleting your account and your data
In the app, Help and privacy › Delete my account and data immediately erases from our database: your account email address, your sites (taken offline), their versions, your requests, their form answers, your photos, your credit history and your balance. This deletion is permanent.
Your site and photo files become inaccessible immediately, and are erased from our storage within 30 days. Our database backups don’t keep anything beyond 30 days either. After that, nothing is left of your sites anywhere.
Those 30 days are there for you
This delay protects you: if you delete a site or all your data by mistake, or change your mind, write to us within 30 days from the app (Help and privacy › Contact us, which includes your anonymous ID so we can find your phone), and we can put everything back. After 30 days, that’s no longer possible.
We keep, with no content at all:
- the record of your purchases, for our accounting obligations;
- a hash of your phone’s ID, with only a note that its free page has been used. This hash says nothing about your phone; it only lets us recognize it if it comes back, so that deleting its data doesn’t unlock a new free page (to prevent abuse).
The IP addresses from app opens and your device information (model, iOS version, app version, language) are erased.
Security
- Traffic between the app, our server and the sites is encrypted (HTTPS).
- Our database is on an encrypted volume, hosted in Paris. Site files and database backups are encrypted and stored in the European Union (Cloudflare R2).
- Access to the data is limited to the Paf team, for support and to fight abuse.
Your rights
You can ask to access your data, correct it, erase it, receive it in a readable format (portability), object to processing based on our legitimate interest, or ask for it to be restricted.
Write to us at aide@paf.live with your anonymous ID, shown at the bottom of the Help and privacy screen: without an account, it’s the only way to find your data. We reply within one month.
If you think your rights are not being respected, you can file a complaint with the CNIL, the French data protection authority (www.cnil.fr, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France).
Changes
If this policy changes, we update this page and its date.
Contact us
For any question about your data: aide@paf.live.