Last Updated: September 14, 2026 | Effective for existing accounts: September 29, 2026
StackBlitz, Inc. (“StackBlitz,” “we,” “us,” or “our”) operates the StackBlitz development environment (www.StackBlitz.com), the Bolt application (www.Bolt.new), and related products and services. This Privacy Policy describes how we collect, use, disclose, and safeguard personal information when you visit our websites or use those products and services (collectively, the “Services”).
Your use of the Services is also governed by the StackBlitz Terms of Service, available at https://stackblitz.com/terms-of-service (the “Terms”), and the Acceptable Use Policy incorporated into them.
This Privacy Policy applies to personal information collected:
This Privacy Policy governs information about users of StackBlitz and Bolt, including website visitors and account holders.
It does not apply to personal data processed by our customers within applications they build or deploy using the Services, which is governed by applicable customer agreements and data processing addenda (“DPA”), where applicable.
We collect information you provide directly, including:
When you upload or attach files to a project, conversation, or prompt within the Services (including files used to “build” or “plan”):
StackBlitz does not seek to collect special categories of personal data or other sensitive personal information through Bolt AI Features, although users may submit prompts, code, or files that contain such information. Users should not submit sensitive personal information unless they are authorized to do so. For the Bolt model-development and dataset-licensing purposes described in Section 5.C, we do not intentionally select content that we have identified as containing special-category or sensitive personal data, or personal data relating to a child as defined under applicable law, unless applicable law permits the processing and any additional legal condition required for that data has been satisfied. We may use technical and organizational measures designed to identify and exclude such content.
When you visit our websites, we automatically collect certain information, including:
We use cookies, web beacons, and similar technologies to collect this information.
We and our service providers use cookies, web beacons, and similar technologies to:
We do not display third-party advertisements on our website. However, we may use web beacons or similar technologies to support retargeting or promotional campaigns on third-party platforms.
You may control cookies through your browser settings and available preference tools.
The Services (principally Bolt) include artificial intelligence–powered features that generate, modify, analyze, or assist with software code and related content (“AI Features”).
To provide these features, we process:
We use AI Input and AI Output as necessary to provide, maintain, secure, troubleshoot, and operate the Services, including to generate requested responses; detect, investigate, and prevent fraud, abuse, and security incidents; enforce our terms and policies; and perform quality assurance on individual interactions. We may also use aggregated or de-identified information for analytics and product-performance measurement. Pseudonymized information remains personal information and continues to be protected under this Privacy Policy. For clarity, these operational and safety uses do not include using your AI Input or AI Output to train, fine-tune, improve, or benchmark artificial-intelligence models or to prepare datasets for licensing to third parties. Those separate uses are described below. Ownership of, licenses to, and responsibility for AI Input and AI Output are addressed in the Terms.
For accounts to which Section 5.C applies, the model-development and dataset-licensing controls described below are available free of charge and regardless of plan, except that the uses of Forge Content are a condition of Bolt Forge while Forge is enabled as described below.
Scope; Bolt Model Development Content. The model-development and dataset-licensing practices in this Section 5.C apply only to “Bolt Model Development Content”: (i) AI Input you submit through Bolt; (ii) AI Output generated through Bolt; (iii) related interaction data generated in connection with your use of Bolt AI Features, including error messages, correction or fix traces, tool invocations, and edit histories; and (iv) project files, code, and configuration to the extent submitted to or processed by Bolt AI Features. Whether content is Bolt Model Development Content depends on the Bolt AI Features through which it is submitted or processed, not on the AI model, mode, or inference provider used to generate or process it. Content used solely through www.StackBlitz.com or other non-Bolt Services, including the StackBlitz SDK and embeddable editor and the WebContainer API, is not Bolt Model Development Content and is not used for the model-development or dataset-licensing purposes described in this Section 5.C. If you use a project created or stored through StackBlitz with Bolt, only content submitted to or processed by Bolt AI Features, together with related Bolt interaction data, is Bolt Model Development Content.
AI Model Development. Unless you opt out and subject to the regional and consent rules below, we may use Bolt Model Development Content that is eligible under “Prospective Application” below to train, fine-tune, evaluate, benchmark, and improve artificial-intelligence models developed by or for StackBlitz. This processing is separate from the operational and safety uses described above and is subject to the controls described in this Section 5.
Dataset Licensing; Recipients; De-Identification and Anonymization. Separately, unless you opt out and subject to the regional and consent rules below, we may prepare datasets derived from Bolt Model Development Content that is eligible under “Prospective Application” below and license them, including for compensation, to third parties such as AI developers and researchers for artificial-intelligence research and for the development, training, evaluation, and improvement of artificial-intelligence models. Before any content is included in a licensed dataset, we remove or transform information that could reasonably be used to identify an individual, maintain the resulting data in de-identified form, do not attempt to re-identify it (except as permitted by law to test our de-identification processes), and do not disclose the content to dataset licensees in a form that reasonably identifies an individual. For personal data subject to the GDPR or UK GDPR, we treat data as anonymous only where it meets the applicable standard for anonymization; data that remains pseudonymized remains personal data and continues to be protected under applicable data-protection law. We contractually prohibit dataset recipients from attempting to re-identify the data and from onward disclosure except subject to equivalent restrictions.
Opting Out and Withdrawing Consent. Except as described under “Bolt Forge” below, you may opt out of the model-development and dataset-licensing uses of Bolt Model Development Content described above at any time, free of charge and regardless of your plan, through your account settings or by contacting privacy@stackblitz.com. When we receive an opt-out request, we promptly place the account on a suppression list designed to prevent the selection of that account’s Bolt Model Development Content for new model-training runs or new licensed datasets while we process the request, and we complete implementation across applicable systems as soon as reasonably practicable and in any event within fifteen (15) days after receipt of your request. An opt-out or withdrawal does not, by itself, unwind processing completed before the request, models already trained, or datasets already delivered to licensees; however, this does not limit any right or remedy available under applicable law or any action we are required to take under applicable law. If you ask us to delete your Bolt Model Development Content, we also remove it from our training corpora and from any dataset not yet delivered to a licensee, subject to applicable law and valid exceptions. No opt-out is needed for accounts located in the European Economic Area, the United Kingdom, or Switzerland; see “Accounts in the EEA, United Kingdom, and Switzerland” below.
Timing and Prospective Application. We will not use Bolt Model Development Content for model development or dataset licensing before September 29, 2026. Only Bolt Model Development Content created or generated on or after September 14, 2026 is eligible for those purposes. Content created or generated before September 14, 2026 is not eligible, even if it remains stored in your account or project or is later opened, accessed, submitted to, retrieved by, or otherwise processed by Bolt AI Features. For project files, code, and configuration that existed before September 14, 2026, only new versions, edits, or other content created or generated on or after September 14, 2026 are eligible. If we cannot reasonably distinguish eligible content from earlier ineligible content, we exclude the affected content from these uses. Content used solely through StackBlitz or other non-Bolt Services remains outside these practices. This does not limit the operational and safety processing described in Section 5.A.
Excluded Accounts. These model-development and dataset-licensing practices do not apply to Bolt Model Development Content in accounts governed by a separate written agreement with us that addresses these uses, or to organization-managed accounts except to the extent the organization’s administrator has enabled such uses and we have provided any notice and choices required by applicable law. These practices also do not apply to accounts located in the European Economic Area, the United Kingdom, or Switzerland, as described under “Accounts in the EEA, United Kingdom, and Switzerland” below.
Exercise of These Practices. The practices described in this Section 5.C are disclosed to you when they take effect for you and do not depend on whether we are exercising them at any given time. We may commence, pause, or resume any practice described in this Section 5.C at any time, subject to the controls, regional rules, and exclusions described above. Commencing or resuming a practice described in this Section 5.C is not a change to this Privacy Policy. This paragraph does not apply to accounts located in the European Economic Area, the United Kingdom, or Switzerland.
Accounts in the EEA, United Kingdom, and Switzerland. We do not use Bolt Model Development Content, including Forge Content, associated with an account we determine to be located in the European Economic Area, the United Kingdom, or Switzerland for AI model development or for preparing datasets for licensing, and we do not rely on legitimate interests or consent for those purposes for such accounts. We determine an account’s location from billing address, account country, network location, and other information available to us, and we treat an account whose location we cannot determine as located in those regions for these purposes. Location is evaluated each time content is selected for these purposes; content selected while an account was located elsewhere may remain in use. If you believe we have located your account incorrectly, contact privacy@stackblitz.com. We will not begin using content associated with these accounts for these purposes without first amending this Privacy Policy, giving the notice described in Section 17, and establishing a lawful basis under applicable law. Our processing of your content to provide the Services, including operating Bolt AI Features and sending your requests to the AI service providers described in Section 5.D, is necessary to perform our contract with you and is described in Sections 5.A and 6.
Bolt Forge. Bolt Forge is a lower-priced mode of the AI Features available on eligible plans (optional on plans that include other AI modes, and the only AI mode on the Bolt Lite plan) that uses open-weight AI models hosted by us or by third-party inference providers. Forge Content is subject to the timing and eligibility limitations above, in addition to the affirmative-consent requirements in this paragraph. Forge is offered on the condition that we may use the AI Input, AI Output, and related interaction data (such as error-and-fix traces) generated while Forge is enabled, together with the project files processed by Forge (“Forge Content”), to train AI models and to prepare de-identified datasets that we license to third-party AI developers, including for compensation, for AI model development, training, and evaluation. You enable Forge only by taking an affirmative action (such as clicking “Use Forge and consent to data use”) after being shown a summary of, and a link to, these terms. We present the consent to that processing as a statement that is separate from, and clearly distinguishable from, your acceptance of the Forge terms, and the affirmative action you take states that it constitutes your consent. Taking that action is your express consent to that processing. If your account is located in the European Economic Area, the United Kingdom, or Switzerland, we do not ask for this consent and Forge Content from your account is not used for these purposes. While Forge is enabled, the opt-out described above does not apply to Forge Content. You can stop using Forge at any time: on a plan that includes other AI modes, by switching to another agent or mode; on a plan in which Forge is the only AI mode, by changing your plan (including to a free plan). Stopping use of Forge ends the collection of new Forge Content but does not by itself withdraw your consent, and we may continue to use Forge Content collected while Forge was enabled for the purposes described in this paragraph until you withdraw that consent. You can withdraw your consent at any time, free of charge, by contacting privacy@stackblitz.com or, once available, in your account settings; we implement a withdrawal in the same manner as an opt-out under “Opting Out and Withdrawing Consent” above, and after withdrawal we will not select your Forge Content for new model-training runs or newly prepared or licensed datasets. Neither stopping use of Forge nor withdrawing consent unwinds processing completed before that time, models already trained, or datasets already delivered to licensees, except as required by applicable law. After you stop using Forge, the standard AI Features and pricing of your plan (or of the plan you select) apply prospectively. Content submitted after you stop using Forge is governed by the standard rules in this Section 5.C if it qualifies as Bolt Model Development Content and is otherwise eligible under the “Prospective Application” rule above. Your deletion, access, and other rights described in this Privacy Policy continue to apply. Forge is further described in the Bolt Forge Supplemental Terms in Section 3.6 of the Terms, and California residents should also see the Notice of Financial Incentive in Section 15.
StackBlitz relies on third-party AI service providers to deliver certain Bolt AI Features. These providers process AI Input solely to provide services to StackBlitz and are subject to contractual confidentiality and data protection obligations. When Bolt Forge is enabled, AI Input is processed by third-party inference providers that host open-weight models; the models and providers we use may change over time. These inference providers process AI Input only to generate responses for you and are contractually prohibited from using it to train their own models. If a provider also licenses datasets from us, it receives those datasets only in de-identified form under the dataset-licensing terms described in Section 5.C and Section 8.B.
For individuals located in the European Economic Area or United Kingdom, we process personal data only where we have a valid legal basis under applicable data protection laws. These legal bases include:
Where we rely on legitimate interests, we assess the specific interest pursued, whether the processing is necessary for that interest, the reasonable expectations of affected individuals, potential impacts on their rights and interests, and available safeguards. You may object to processing based on legitimate interests as described in Section 14.
We do not use Bolt Model Development Content associated with accounts located in the European Economic Area, the United Kingdom, or Switzerland for AI model development or dataset licensing; see “Accounts in the EEA, United Kingdom, and Switzerland” in Section 5.C.
For individuals located in Switzerland, we process personal data in accordance with the Swiss Federal Act on Data Protection, including its transparency, proportionality, purpose-limitation, and data-security requirements, and obtain consent where applicable law requires it.
We process personal information for the following purposes:
We do not process personal information in a manner that is incompatible with these purposes.
We share information with trusted service providers who perform services on our behalf, including hosting, analytics, billing, customer support, and AI processing. These providers are authorized to process information only as necessary to provide services to StackBlitz and are subject to contractual obligations appropriate to their role. We share personal information with subprocessors under written data processing agreements that impose confidentiality, security, and data protection obligations consistent with applicable law and, where applicable, we pseudonymize personal information before disclosure. Pseudonymization does not remove information from the protections of this Privacy Policy.
Unless you have opted out as described in Section 5 (and, for Forge Content, in accordance with your consent when enabling Bolt Forge), we may disclose datasets derived from Bolt Model Development Content that is eligible under Section 5.C to third parties, such as AI developers and researchers, that license datasets from us for artificial-intelligence research and for the development, training, evaluation, and improvement of artificial-intelligence models. All such datasets are de-identified as described in Section 5 before disclosure, and recipients are contractually prohibited from attempting to re-identify the data and from further disclosing it except under the same restrictions. We do not license datasets derived from content associated with accounts located in the European Economic Area, the United Kingdom, or Switzerland.
We may disclose information if required by law or in connection with a merger, acquisition, or sale of assets.
StackBlitz, Inc. is headquartered in the United States, and personal information may be transferred to, processed, and stored in countries outside of your jurisdiction, including the United States.
Where required by law, we rely on appropriate safeguards for such transfers, such as standard contractual clauses approved by relevant authorities or other lawful transfer mechanisms.
The Services may allow users to publish, deploy, or share applications, codebases, or projects (“Published Projects”).
Security Reminder: Do not include secrets, API keys, passwords, or confidential information in prompts, source code, or publicly shared content.
We retain personal information and user content for as long as necessary to provide the Services, support active accounts, comply with legal obligations, resolve disputes, and enforce our agreements. Where we terminate or suspend an account other than for cause, we will make available a reasonable means to retrieve or export your content for thirty (30) days following the effective date of the termination or suspension, after which we may delete it. This period applies to all accounts, except where the Terms or applicable law provide otherwise.
Active Accounts**.** Personal information and user content associated with an account are retained while the account remains active.
Voluntary Account Closure**.** When an account is voluntarily closed, the account and associated data enter an inactive or expired state. We will delete or anonymize such data within a commercially reasonable period following account closure not to exceed thirty days, subject to backup retention, legal obligations, and security requirements.
Account Suspension**.** If an account is suspended (for example, due to non-payment or other account-related issues), associated data may be retained during a limited grace period to allow for potential account reinstatement. During this period, data may be inaccessible until the account is restored to good standing.
Abuse or Policy Violations**.** If an account is suspended or terminated due to abuse of the Services or violation of applicable terms or policies, we may permanently disable the account and delete associated data, subject to applicable legal requirements.
Backups and Residual Copies**.** Residual copies of personal information and user content may persist in backups, logs, or archival systems for a limited period following deletion or account termination. Such data will not be used for active processing except as necessary for security, fraud prevention, or legal compliance.
Users may request deletion of personal information by contacting us. Data deletion requests are handled in accordance with internal access controls and data management procedures. Retention periods are determined based on the nature of the data, the purposes for which it is processed, and applicable legal requirements.
Some browsers transmit “Do-Not-Track” signals. Because there is no industry-standard interpretation, StackBlitz does not currently respond to DNT signals. However, where required by applicable law, we recognize browser-based Global Privacy Control (GPC) signals as a valid request to opt out of certain data sharing or targeted advertising.
The Services are intended for users who are at least eighteen (18) years old and are not directed to, and may not be used by, anyone under eighteen (18). We do not knowingly collect personal information from anyone under eighteen (18), or from any user below a higher minimum age required by the laws of the user’s jurisdiction. If we learn that we have collected personal information from a user below the applicable minimum age, we will delete that information and terminate the associated account. If you believe a user below the applicable minimum age has provided personal information to us, please contact us at privacy@stackblitz.com.
If you are located in the European Economic Area or United Kingdom, you have certain rights under applicable data protection laws, including the right to:
You also have the right to lodge a complaint with a supervisory authority in your country of residence, place of work, or where you believe a violation has occurred.
You may exercise these rights by contacting us at privacy@stackblitz.com.
If you are located in Switzerland, you may have rights under the Swiss Federal Act on Data Protection, subject to applicable conditions and exceptions, including rights to request information about processing, correction of inaccurate data, deletion or destruction or restriction of processing in appropriate circumstances, objection to processing, and data portability where the statutory conditions are met. You may also report data-protection concerns to the Swiss Federal Data Protection and Information Commissioner (FDPIC).
To protect privacy and security, we may take steps to verify your identity before fulfilling your request. Requests may be subject to certain exceptions or limitations permitted by applicable law.
Authorized agents may submit requests on behalf of individuals where permitted by law, provided we are able to verify the agent’s authority.
We will not discriminate against you for exercising your privacy rights.
Residents of certain U.S. states, including California, may have rights under applicable privacy laws, such as the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA). These rights may include the right to know, access, correct, delete, or obtain a copy of personal information we collect, and the right to opt out of certain data uses.
StackBlitz does not sell personal information as defined under the CCPA. Datasets licensed to third parties under the AI training and data licensing practices described in Section 5 are derived only from Bolt Model Development Content and are de-identified in accordance with the CCPA before disclosure; because we maintain that data in de-identified form, do not attempt to re-identify it, and contractually require recipients to commit to the same, we do not treat that licensing as the sale of personal information. If our practices change such that we sell personal information, we will update this Privacy Policy and provide any notices and opt-out mechanisms required by law. However, we may share limited identifiers or device information with advertising or analytics partners to support marketing or promotional campaigns. Where required by law, users may opt out of such sharing, which may constitute “sharing” for cross-context behavioral advertising under the CPRA. You may opt out of such sharing by contacting us at privacy@stackblitz.com or through a browser-based Global Privacy Control (GPC) signal, which we honor as described in Section 12.
Requests may be submitted to privacy@stackblitz.com. Appeals may be submitted by replying to our response or contacting us with “Privacy Appeal” in the subject line.
To protect privacy and security, we may take steps to verify your identity before fulfilling your request. Requests may be subject to certain exceptions or limitations permitted by applicable law.
Authorized agents may submit requests on behalf of individuals where permitted by law, provided we are able to verify the agent’s authority.
We will not discriminate against you for exercising your privacy rights.
Bolt Forge is offered at a lower price than our other paid AI modes in exchange for your consent to our use of Forge Content (including your prompts, code, generated output, and related interaction data, which may contain personal information) to develop AI models and to prepare de-identified datasets that we license to third parties, as described in Section 5. Although we de-identify data before licensing it and do not consider that licensing a sale of personal information, the price difference is offered in exchange for the use of your data, so we provide this notice under the California Consumer Privacy Act.
Material terms. Categories of personal information involved: prompts, code, configuration files, generated output, and interaction data submitted or generated while Forge is enabled, and account identifiers used to associate that content with your account before de-identification.
Uses: AI model development by or for StackBlitz, and licensing of de-identified datasets to third-party AI developers.
Incentive: Forge pricing as shown on the Pricing Page, which is $16 lower than standard pricing for equivalent usage.
How to opt in and withdraw. You opt in by affirmatively enabling Forge in the Services after being shown a summary of these terms. You may withdraw from the incentive at any time by stopping your use of Forge: on a plan that includes other AI modes, by switching to another agent or mode; on a plan in which Forge is the only AI mode, by changing your plan. The standard pricing of your plan (or of the plan you select) then applies prospectively. Stopping use of Forge ends the collection of new Forge Content but does not by itself withdraw your consent to our use of Forge Content already collected; you may withdraw that consent at any time by contacting privacy@stackblitz.com or, once available, in your account settings, after which we will not select your Forge Content for new model-training runs or newly prepared or licensed datasets. Withdrawal does not by itself unwind processing completed before withdrawal, models already trained, or datasets already delivered to licensees, except as required by applicable law. We will not charge you retroactively for the period Forge was enabled.
Value of your data. We have made a good-faith estimate that the value of a participating user’s data is approximately $6.50 per month. We calculate this as the value of the participating-user dataset to our business, consisting of license fees we receive from third-party licensees of the dataset and our estimated cost of obtaining equivalent training data from other sources, net of the costs of de-identifying, storing and delivering the dataset, divided by the number of expected participating users as of October 1, 2026. The estimate does not attempt to quantify other benefits the dataset may provide to our business. The Forge price or service difference is reasonably related to that value because Forge tier costs us materially less to operate than tiers using other models, and the remaining difference is funded by the value we derive from the participating-user dataset, which does not exceed our estimate above. We recalculate at least annually and will update this notice if the estimate changes materially.
For privacy-related inquiries, contact us at privacy@stackblitz.com or by mail at StackBlitz, Inc., Attn: Privacy, 1160 Battery Street, Suite 30W, San Francisco, CA 94111. Where applicable law requires StackBlitz to appoint a data protection officer or an EU, UK, or other local representative, the applicable contact details will be provided in this Privacy Policy or on our privacy page.
Enterprise customers should note that customer data processing is governed by applicable DPAs rather than solely by this Privacy Policy.
We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we do so, we will update the “Last Updated” date at the top of this policy.
If we make material changes, we will provide notice through the Services or by other appropriate means where required by law. If we amend Section 5 to permit new uses of Bolt Model Development Content or disclosure to new categories of recipients, we will announce that change by email and within the Services at least fifteen (15) days before it takes effect. Commencing or resuming a practice already described in Section 5 is not such a change.
Your continued use of the Services after any update indicates your acceptance of the revised Privacy Policy.
