Security

Data & privacy

Where your code, data and secrets go — and where they don't.

Updated 21 Sept 2026

Your code

  • Stored in Qyant's database, versioned, private to your account.
  • Pushed only to a GitHub repository you own, and only when you click Sync.
  • Exportable at any time via that repository.

Your secrets

  • .env values you add are stored with the project and injected into your app at runtime.
  • Managed secrets are never shown to the model — it sees <managed-by-qyant> in place of values.
  • .env is never pushed to GitHub and never included in a deployment image.
  • Credentials Qyant holds on your behalf (GitHub tokens, database passwords) are encrypted at rest.

Prompts and model providers

Your prompts, the relevant project files and any attachments are sent to the model you selected, via OpenRouter. What each provider does with request data is governed by that provider's terms; the picker shows you which vendor you're sending to on every request. We do not train models on your data.

Your app's data

Whatever your app stores in its database is yours. Qyant staff do not read project databases except when you ask us to help with a specific problem.

Sessions

Signing in sets a single httpOnly cookie scoped to qyant.dev. There are no tokens to leak into local storage or URLs. Sessions expire after a period of inactivity and can be ended from Settings.

Deleting a project

Deleting a project removes its files, versions, chat history, attachments, sandbox and its database. This is immediate and cannot be undone. The GitHub repository, if any, is untouched.

Deleting your account

Contact support@qyant.dev from your account's email address. All projects and their databases are deleted; billing is cancelled.