Trust
Your app, your code, your data.
What you get to keep, what we do with your Bubble export and data, where it is processed and who is behind deBub — in plain words, and only what our systems actually do today.
01Ownership
You own 100 % of the generated code.
Assigned to you once paid
When you have paid, we assign to you all rights we hold in the code and files generated for your app — including later changes made by the assistant. Modify it, deploy it anywhere, sell what you build with it. See Terms: Who owns the code.
What stays under a licence
Generic helper code we reuse across projects comes with a perpetual, royalty-free licence to use, change and distribute it in your project, and open-source packages keep their own licences. Neither can be taken back.
No lock-in
The result is a standard Next.js + TypeScript project with a Supabase Postgres database. It runs without deBub: push it to your GitHub, download it, and host it wherever Next.js runs.
Not used for training
We don’t use your app, your code or your data to train AI models.
02Your export & data
We only process what you give us.
deBub only processes the .bubble export you upload and the data you authorise us to copy. We never ask for your Bubble login, and nothing we do changes your Bubble app.
Secrets removed at ingest
As soon as our processing server receives your export, it removes your app’s API keys, passwords, private keys and private API Connector values, and empties recorded API responses. Only their names are kept, so the generated code can read them from environment variables. The stored upload is then replaced by this redacted copy.
Upload deleted after the full scan
Once the full scan has finished (after you’ve paid and code generation starts), the file you uploaded is deleted from our storage. Only the redacted copy on our processing server is kept, for generation, your free regeneration and the assistant.
Data copy you authorise
Your records, users and files are copied only when you start the data copy, with a Bubble Data API token you create. Our client only reads from Bubble. The data passes through our processing server and is stored in your own Supabase project, not in our database. You can delete the token in Bubble once you’ve gone live.
How long we keep it
Project data stays while your account is open, so you can download again, regenerate and keep building. Files you attach to the assistant are deleted after 30 days. When you ask us to delete a project or close your account, we delete it within 30 days; payment records are kept for 6 years as UK law requires. Full retention table
Encrypted in transit and at rest
Connections to debub.io, our processing server and the preview use TLS. Access tokens and keys you give us are encrypted in our database with AES-256-GCM.
If you stop after the free scan
The redacted copy of your export stays with the project until you delete the project or your account. Nothing is generated or copied without a purchase and your go-ahead.
03Sandboxing
Customer code runs in a sandbox.
Your generated app and the assistant’s work run on our processing server — never with access to other customers’ projects or to our own keys.
One sandbox per project
Builds, the hosted preview and the assistant’s commands run in an isolated sandbox that can only see that project’s own files; its history is read-only.
Its own network
Each sandbox gets its own network. It cannot reach our server or any private or internal network — at most the public internet your app needs.
No server secrets, hard limits
Our keys are never passed in. Memory, CPU, process count and run time are capped per sandbox, and for all sandboxes together.
The assistant stays in your project
Its file tools refuse paths outside your project, symbolic links and .env files. Every change it saves is type-checked and security-checked first, and every saved change can be undone.
A security report with every app
Each delivered app gets a report on its database rules (checked against your Bubble privacy rules), secrets, server routes, dependencies and configuration. Problems our conversion introduced are fixed for free.
Found a security issue?
Write to hello@debub.io with “Security” in the subject, and we’ll get back to you.
04Location
Your export and data stay in the EU.
Your export, scans, generated code and the data copy are processed in Germany and stored in Ireland. Some services we rely on are in the United States; we name them here instead of hiding them.
| What | Where | Data |
|---|---|---|
| Processing server | Germany (EU) — Contabo GmbH | Scans, code generation, the sandboxed builds and hosted previews, the assistant’s workspace, the data copy |
| Our database and file storage | Ireland (EU) — Supabase, region eu-west-1 | Your account and projects, your upload until it is deleted, delivery files, assistant conversations |
| Your app’s database | Your own Supabase project — Frankfurt (EU) by default, or a region you choose | Your app’s records, users and files after the data copy |
| Website and API | Vercel — United States, with a global edge network | Requests to debub.io and data passing through our API |
| AI models | Anthropic — United States | Your messages to the assistant and the project files it reads |
Sign-in (Clerk), payments (Stripe), email (Resend, Google Workspace) and GitHub, if you connect it, are also listed, with their transfer safeguards, on Sub-processors. For your app’s end users we act as your processor under our Data Processing Agreement, which applies automatically — nothing to sign.
05Who we are
The company behind deBub.
Appmetize LTD
deBub is a trading name of Appmetize LTD, a company registered in England and Wales (company no. 12896378). Registered office: 112c High Street, Hadleigh, Suffolk IP7 5EL, United Kingdom.
Contact and documents
hello@debub.io for questions, data requests and security reports.
Terms · Privacy · DPA · Sub-processors · Refunds
deBub is not affiliated with Bubble. Bubble is a trademark of Bubble Group, Inc.
Leave Bubble.
Keep building.
The scan is free and shows your exact price. No card needed until you choose to generate.