Trust & security
Your work is safe here.
No security theater, no badges for certifications we don't have. Just the five plain promises we build byow.site around — and what each one actually means.
You own the file
Every site we make is a single, complete HTML file — and it belongs to you, not us.
- Download your HTML anytime, from any plan, with one click.
- Host it anywhere — another provider, your own server, a folder on your laptop.
- No export fees, no proprietary format, no hostage sites. If you leave, your work leaves with you.
One complete file. Yours.
Private by default
Nothing you make is discoverable unless you decide it should be.
- Password-protect any hosted site — visitors see a lock, not your work.
- Set an expiry date on a link and it simply stops working after that day.
- Review links use long, unguessable codes. Nobody stumbles onto a draft by typing a lucky URL.
Locked-down data
The database enforces who owns what — it doesn’t just trust our code to remember.
- Row-level security: the database itself refuses to hand one person another person’s rows.
- The database is only reachable from our servers — never directly from a browser.
- Every API route re-checks that you own the thing you’re touching before it does anything.
Served safely
Hosted pages are user-made pages, so we serve them defensively.
- Every hosted page ships with a strict content-security policy in its headers.
- That policy tells the browser exactly what the page may load and run — and blocks the rest.
- It limits the damage even in the case we don’t expect, which is the point of the exercise.
allow what the page needs —
block everything else.
Fair AI use
AI features are metered so costs stay predictable — for you and for us.
- Your plan includes a monthly quota of AI builds and revisions; it resets every month.
- When you’re close to the limit we tell you plainly — no silent overage charges.
- Platform-wide spend safeguards mean one runaway job can’t degrade the service for everyone else.
What we won't claim
We're a small product and we'd rather be straight with you: we don't hold SOC 2, ISO 27001, or similar certifications today, and we won't put their logos on this page until we do. What you read above is what we actually build and maintain — and if something changes, this page changes with it.
Questions about any of this? Email hello@byow.site — a human reads it.