Privacy policy

Last updated: 2 November 2026.

Who we are

This site, the HotLayout editor, the admin and the sandbox are operated by Erika Dyendyeshy, HotLayout. Questions and requests about your data: contact@hotlayout.com.

The “Get access” form

When you send the form, we receive your name, your company, your work email, your message if you wrote one, and the language of the page. We use them only to reply to your request and, if we agree on it, to send you an invitation.

The request is stored in our database on Google Firebase, and a copy of it comes to our own mailbox as a notification.
That notification and, if we invite you, the invitation email are sent through Resend, an email delivery service.
To stop automated spam, we count requests per IP address and per email address. The counters hold a one-way hash, not the address itself, and are deleted automatically within two days.

We keep the request until you ask us to delete it. If you write to us directly instead, your email stays in our mailbox on the same terms.

The sandbox

Everything you make in the sandbox stays in your browser (IndexedDB and local storage). Nothing is sent to us. The page’s security policy does not let it connect anywhere except our own domain, and it has no analytics.

This website

The website has no analytics scripts and sets no cookies. It remembers your choice of light or dark theme in your browser’s local storage. The overview video is loaded from YouTube (youtube-nocookie.com) only when you open the video; from then on, Google’s privacy policy applies to the player.

Server logs

The site is hosted on Firebase Hosting (Google). Request logging is turned on: for each request, Google Cloud Logging records your IP address, the address of the page, your browser’s user agent and the time. We use these logs for security and to count visits. They are kept for 30 days and then deleted by Google.

Accounts in the admin

Access to the admin is by invitation only. An account is your email and a password, held by Firebase Authentication (Google); we never see the password, and Google stores it only as a hash. We also keep which organisations you belong to and your role there, and the activity log records which account changed, approved or published what, and when. Your sign-in session is kept in your browser’s local storage, not in a cookie.

Your organisation’s content

Screen documents, themes, images and the data dictionary that your team makes are stored in Firebase (Cloud Firestore and Cloud Storage) in the Google Cloud region europe-central2 (Warsaw, Poland). We keep them until you or your organisation ask us to delete them.

Your app’s users

Data about the users of your app does not pass through us. A screen document names data paths such as user.firstName; the values travel from your own backend to your own app when the screen is shown. One caveat: the data dictionary holds sample values that your team types in for the preview, so use made-up ones.

Who processes data for us

Google (Firebase Hosting, Firestore, Cloud Storage, Authentication, Cloud Functions, Cloud Logging) — hosting and storage;
Resend — sending emails (invitations and our notifications about new requests);
Zoho Mail — our mailbox for hotlayout.com.

We do not sell your data and do not share it with anyone else.

Your rights

You can ask us to show you the data we hold about you, to correct it or to delete it. Write to contact@hotlayout.com from the address in question, and we will do it. If you are in the EU, you also have the other rights the GDPR gives you, including the right to complain to your data protection authority.

Changes

We may change this policy. The current version is the one on this page, with the date above.