Developer / Coding · bolt.newBolt.new (StackBlitz)
Graded against 804 verified platforms, from its own policy text. Automated assessment against a published rubric — not legal advice.
“You are solely responsible for any content and other material that you submit, publish, transmit, or display on, through, or with our Site or Services. In addition, you agree to provide notices and obtain any consents, if necessary, related to your use of the Site or Services, including those related to the collection, use, processing, transfer and…”
Watch: Moderation and enforcement
Start here. These are the highest-risk verified clauses AIRIN found in the platform's own policy text.
Prohibits removal or alteration of proprietary notices and prohibits reproduction, modification, translation, reverse engineering, decompilation, or creation of derivative works from the Services.
Addresses cross-border data transfer by disclosing processing in the US and other countries, and obtains user consent to international transfer by conditioning use of services on acceptance of transfer to jurisdictions with potentially lesser data protection standards.
Establishes the obligation to retain personal information and user content for the duration necessary to provide services, support active accounts, comply with legal obligations, resolve disputes, and enforce agreements; specifies that data linked to active accounts is retained while the account remains active.
How to read this page: Overall risk rates what Bolt.new (StackBlitz)'s own policy terms mean for your prompts, outputs, and data. The benchmark bands below grade those same verified terms relative to peers — a platform in a risky-by-default category can rate HIGH risk and still grade STRONG against its peer set. Both trace to the cited findings.
Policy benchmark
rubric v1.0 — how this is scoredBased on 140 verified, verbatim-cited findings below — read the citations.
Based on 165 verified, verbatim-cited findings below — read the citations.
Automated assessment against a published rubric — not legal advice.
Fully verified — complete core corpus captured and read in full.
- Privacy PolicyVerified - read in full - 128 citationsstaticLast captured 2026-06-10
- Terms of ServiceVerified - read in full - 16 citationsstaticLast captured 2026-06-10
Only citation-backed plan differences are shown here; absent cells mean AIRIN has not verified a tier-specific claim.
Grants users a limited, personal, non-exclusive, non-transferable license to use the Services, and specifically extends commercial-use rights to Teams and Enterprise plan subscribers while restricting all other users to personal, non-resale use.
" Subject to these Terms, we grant to you a limited, personal, non-exclusive, non-transferable license to use our Services. If you are using our Services under the StackBlitz Teams or Enterprise Plans, this license includes the right to use ..."
Prohibits use of automated tools to access or collect StackBlitz Content, sublicensing of access, non-personal use outside Teams/Enterprise plans, and circumvention of access controls; carves out commercial use for Teams and Enterprise subscribers.
"StackBlitz Content as part of a database or other work; (ii) use any automated tool (e.g., robots, spiders) to access or use our Services or to store, copy, modify, distribute, or resell any StackBlitz Content; (iii) rent, lease, or sublice..."
Grants active commercial plan customers permission to integrate the WebContainer API on their website, subject to a restriction of 500 sessions per month, and prohibits exceeding that limit without a separate commercial license.
"Customers with active commercial StackBlitz plans may integrate the StackBlitz WebContainer API on their website, subject to a usage limitation of 500 sessions per month. Customers may not exceed this limit without a commercial license; ple..."
Permits use of personal information for business analysis and operational decision-making, authorizing internal analytical data use.
" To conduct analysis and develop insights that enable us to operate, protect, make informed decisions, and report on our business;"
Grants California residents the right to request disclosure of categories of personal information collected, sources, business/commercial purposes, third-party recipients, and categories sold or shared, implementing CCPA transparency rights.
" Provide you the categories of Personal Information we have collected or disclosed about you; the categories of sources of such information; the business or commercial purpose for collecting, “selling,” or “sharing” your personal informatio..."
Discloses that Personal Information may be used for business analysis and generating operational insights, permitting internal analytics and decision-making uses of collected data.
" Conduct analysis and develop insights that enable us to operate, protect, make informed decisions and report on our business;"
Establishes consent as a legal basis for processing and grants data subjects the right to withdraw consent at any time, free of charge, with prospective effect, while preserving the lawfulness of prior consent-based processing.
" With Your Consent: Where required by law, and in some other cases, we use or disclose Personal Information on the basis of your consent. You may withdraw any consent you previously provided to us regarding the processing of your Personal I..."
Identifies legitimate interests as a legal basis permitting the controller to use or disclose Personal Information for enumerated business purposes where those interests are not overridden by data subjects' rights and freedoms.
" Legitimate Interests: In many cases, we use or disclose Personal Information on the grounds that it furthers our legitimate business interests in ways that are not overridden by the interests or fundamental rights and freedoms of the affec..."
Evidence appendix
Showing priority citations first. The full appendix is available for audit trails; not every citation is a severe risk.
"integrity, performance, or availability of, our Services; (vii) remove, alter, or obscure any proprietary notices (including copyright and trademark notices) on any portion of our Services or any StackBlitz Content; or (viii) reproduce, modify, translate, enhance, decompile, disassemble, reverse engineer or create derivative works of any of our Services."
Prohibits removal or alteration of proprietary notices and prohibits reproduction, modification, translation, reverse engineering, decompilation, or creation of derivative works from the Services.
AI-generated interpretation, not legal advice.
" To understand and analyze how you use the Services and to develop new products, services, and features;"
Permits use of personal information to analyze service usage and develop new products and features, authorizing analytical and product development data use.
AI-generated interpretation, not legal advice.
" Commercial information such as information about your transactions with us, for example, products or services you have purchased All the same purposes for which we may use Identifiers (see above) "
Defines the category of commercial information (transaction history, products/services purchased) collected and cross-references Identifiers purposes, establishing scope of use for this data type.
AI-generated interpretation, not legal advice.
" To conduct analysis and develop insights that enable us to operate, protect, make informed decisions, and report on our business;"
Permits use of personal information for business analysis and operational decision-making, authorizing internal analytical data use.
AI-generated interpretation, not legal advice.
" Internet network and device activity data such as information about your device hardware (e.g., device type) and software (e.g., operating system and browser type) and browsing and usage information (e.g., how often you visit our Services, the pages you visit, referring pages, and the version of the Services you’re using) All the same purposes for which we may use Identifiers (see above) "
Defines the category of internet network and device activity data collected and enumerates the purposes for which it may be used, cross-referencing Identifiers purposes.
AI-generated interpretation, not legal advice.
" The specific reward or incentive offered, if any, will be made available to you on the Services. The monetary value of the reward or incentive is a reasonable approximation of the monetary value of the Personal Information to us in connection with participating in the incentive. We arrived at this conclusion based on consideration of multiple factors, including the following: (1) the revenue we generate from referrals; and (2) the expenses we incur in operating the incentive program."
Obligates the company to disclose the monetary value of the incentive and explains the methodology used to determine that value, satisfying CCPA financial incentive notice requirements.
AI-generated interpretation, not legal advice.
" Location Information: We may collect information about your general location that we infer from your IP address. Certain of our vendors may collect this information on our behalf."
States that general location information inferred from IP address may be collected by the platform and its vendors, defining the scope of location data collection.
AI-generated interpretation, not legal advice.
" Other information any other information you provide to us that directly or indirectly identifies you, such as information you include in emails or other communications to us Purposes of use will depend on the additional information you provide. Disclosure will depend on the additional information you provide. "
Defines a residual category of other personal information provided by users and notes that purposes and disclosures are determined by the specific information provided, creating a flexible but legally operative scope clause.
AI-generated interpretation, not legal advice.
" Identifiers such as name, email address, and personal information described in California Civil Code Section 1798.80 "
Identifies 'Identifiers' as a CCPA category of Personal Information collected, including name, email address, and data described in California Civil Code Section 1798.80, satisfying the statutory categorical disclosure requirement.
AI-generated interpretation, not legal advice.
" Conduct analysis and develop insights that enable us to operate, protect, make informed decisions and report on our business;"
Discloses that Personal Information may be used for business analysis and generating operational insights, permitting internal analytics and decision-making uses of collected data.
AI-generated interpretation, not legal advice.
" We collect the categories of Personal Information identified above from the following sources: (1) directly from you; (2) through your use of the Services; (3) from affiliates or vendors or service providers; and (4) from other parties such as marketers and other users."
Defines the sources from which personal information is collected (directly, through service use, affiliates/vendors, and other parties), establishing the data-collection provenance for compliance and disclosure purposes.
AI-generated interpretation, not legal advice.
" Audio or visual information such as when you call customer support (if applicable) All the same purposes for which we may use Identifiers (see above) "
Defines the category of audio or visual information collected (e.g., customer support calls) and cross-references Identifiers purposes, establishing scope of collection and use.
AI-generated interpretation, not legal advice.
" Log Data: We may collect information that your browser or device automatically sends us when you interact with the Services, such as your IP address, your browser type and settings, and the date and time of your interaction with the Services. Certain of our vendors may collect this information on our behalf."
Discloses that the platform and its vendors automatically collect log data including IP address, browser type, and interaction timestamps, establishing the scope of automatic technical data collection.
AI-generated interpretation, not legal advice.
" If you are interested in more information about tailored browser advertising and how you can generally control cookies from being put on your computer to deliver tailored marketing, you may visit the Network Advertising Initiative’s (“NAI”) Consumer Opt-Out Link , the Digital Advertising Alliance’s (“DAA”) Consumer Opt-Out Link , and/or the European Interactive Digital Advertising Alliance to opt-out of receiving tailored advertising from companies that participate in those programs. To opt out of Google Analytics for Display Advertising or customize Google Display Network ads, you can visit the Google Ads Settings page . Please note that to the extent advertising technology is integrated into the Services, you may still receive advertising content even if you opt out of tailored advertising. In that case, the advertising content may not be tailored to your interests. Also, we do not control any of the above opt-out links and are not responsible for any choices you make using these mechanisms or the continued availability or accuracy of these mechanisms. If your browsers are configured to reject cookies when you visit these opt-out pages, or you subsequently erase your cookies, use a different computer or change web browsers, your opt-out may no longer be effective."
Grants users the procedural right to opt out of tailored advertising via third-party industry opt-out mechanisms (NAI, DAA, EDAA, Google Analytics), constituting a permission/right regarding control over personal data used for behavioral advertising.
AI-generated interpretation, not legal advice.
" Legitimate Interests: In many cases, we use or disclose Personal Information on the grounds that it furthers our legitimate business interests in ways that are not overridden by the interests or fundamental rights and freedoms of the affected individuals, such as in connection with providing customer service, offering or providing certain promotional activities, analyzing and improving our business, providing security for the Services, preventing fraud, and managing legal issues."
Identifies legitimate interests as a legal basis permitting the controller to use or disclose Personal Information for enumerated business purposes where those interests are not overridden by data subjects' rights and freedoms.
AI-generated interpretation, not legal advice.
" Usage Data: We may collect information about the way you use the Services, such as the frequency of your use, the types of content that you view or engage with, the actions you take, and ways in which you navigate the Services. Certain of our vendors may collect this information on our behalf."
Describes collection of usage data such as frequency of use, content types viewed, and navigation behavior, defining the scope of behavioral data collection by the platform and its vendors.
AI-generated interpretation, not legal advice.
" To investigate and prevent fraud, and respond to trust and safety issues that may arise;"
Permits use of personal information to investigate and prevent fraud and address trust and safety issues, authorizing data use for enforcement and safety purposes.
AI-generated interpretation, not legal advice.
" Protect the safety and/or integrity of our users, employees, third parties, members of the public, and/or our Services;"
Discloses that Personal Information may be used to protect the safety and integrity of users, employees, third parties, and the Services, permitting processing for safety and security purposes.
AI-generated interpretation, not legal advice.
Common questions about Bolt.new (StackBlitz)'s policies
- Who owns the content you create with Bolt.new (StackBlitz)?
- You own your outputs — based on 3 verified findings from Bolt.new (StackBlitz)'s published policy. Informational only, not legal advice.
- Can you use Bolt.new (StackBlitz)'s output commercially?
- Commercial use allowed — based on 5 verified findings from Bolt.new (StackBlitz)'s published policy. Informational only, not legal advice.
Clause detail — protections, your obligations, and coverage
Every clause below is a verbatim quote from Bolt.new (StackBlitz)'s own published policy, read in full and linked to its exact location. Protections and user obligations are reported separately from risk because they are different kinds of clause — an obligation on you is not a risk to your data. Informational only, not legal advice.
✅ Protections found
22 verified clausesClauses in Bolt.new (StackBlitz)'s policies that work in your favour — commitments the platform made to you.
- Privacy & data usesale/sharing of personal data
“You also have the right to opt out of “sales” and “sharing” of personal information, as described below. You may have the right to receive information about the financial incentives that we offer to you, if any. You also have the right to not be discriminated…”
Enumerates multiple consumer rights under CCPA including opt-out of sales/sharing, right to financial incentive information, non-discrimination protections, and explains consequences of deletion requests on service acces…
📍 Privacy Policy › “Your CCPA rights:”Jump to exact text → - Privacy & data use
“If would like to exercise any of these rights, please submit a request to us at contact@support.shop.bolt.new or contact us at this toll-free number: 1-833-484-9255. You will be required to verify your identity before we fulfill your request, and we may reques…”
Establishes the procedure for exercising CCPA rights, specifying contact channels, identity verification requirements, and authorized agent designation process including written authorization or power of attorney.
- Designated security contact: contact@support.shop.bolt.new or 1-833-484-9255
📍 Privacy Policy › “Your CCPA rights:”Jump to exact text → - Privacy & data usesale/sharing of personal data
“We may provide certain incentives, such as discounts for referrals. You can opt into the incentives by providing us with the information requested or as otherwise described in the Services. We collect Personal Information as described in the incentive, such as…”
Describes the user's right to voluntarily opt into and withdraw from financial incentive programs, and identifies the personal information collected in connection with such programs, establishing both a permission and a…
📍 Privacy Policy › “Notice of financial incentives:”Jump to exact text → - Privacy & data use
“With Your Consent: Where required by law, and in some other cases, we use or disclose Personal Information on the basis of your consent. You may withdraw any consent you previously provided to us regarding the processing of your Personal Information, at any ti…”
Establishes consent as a legal basis for processing and grants data subjects the right to withdraw consent at any time, free of charge, with prospective effect, while preserving the lawfulness of prior consent-based proc…
📍 Privacy Policy › “Residents of the European Economic Area and United Kingdom”Jump to exact text → - Privacy & data usesale/sharing of personal data
“Provide you the categories of Personal Information we have collected or disclosed about you; the categories of sources of such information; the business or commercial purpose for collecting, “selling,” or “sharing” your personal information; the categories of…”
Grants California residents the right to request disclosure of categories of personal information collected, sources, business/commercial purposes, third-party recipients, and categories sold or shared, implementing CCPA…
📍 Privacy Policy › “Your CCPA rights:”Jump to exact text → - Privacy & data use
“The exact scope of these rights depends on your location, and whether we are subject to the applicable data privacy laws of such jurisdiction. To learn more about your rights or to exercise them, please contact us at contact@support.shop.bolt.new. We may reque…”
Describes the procedure for exercising data subject rights, including contacting the controller at a specified email address and the controller's right to verify identity before responding to requests.
- Designated security contact: contact@support.shop.bolt.new
📍 Privacy Policy › “What are your rights with respect to your Personal Information?”Jump to exact text →
+ 16 more verified clauses of this kind on this platform, cited in full in the report.
📋 Rules you must follow
0 verified clausesWhat Bolt.new (StackBlitz) requires of YOU. These are your obligations, not risks to your data or IP, so they are cited here and excluded from this platform's risk rating.
No user-conduct rule has been verified in Bolt.new (StackBlitz)'s published policies yet.
What the policies actually cover
8 topics- Product telemetry & usage tracking20 clauses
- Advertising & tracking1 protective7 clauses
- Sale or sharing of personal data4 protective6 clauses
- Sensitive data (biometric, location, health)1 protective4 clauses
- Children's data1 protective1 clause
- Government & law-enforcement disclosure1 clause
- Terms can change at any time1 clause
- Deletion rights & post-termination survival1 clause
103 further verified clauses are cited on this page but not yet assigned a topic.
Cross-clause notes
Verified retention clauses point in different directions: the Privacy Policy, § 11 (Data Retention) describes broad or open-ended retention, while the Privacy Policy, Privacy Policy › “Retention” describes deletion or erasure. Which clause controls in a given situation is not resolved by the documents' text alone — this is surfaced as an ambiguity, treated as Caution.
Automated cross-reference against the published rubric — not legal advice.
Clause intelligence
Canonical clauses and stance patterns extracted from the same gate-verified citations shown on this page.
The clause restricts commercial use.
“Limited License. Subject to your complete and ongoing compliance with these Terms, Creator grants you, solely for your personal, non-commercial use, a limited, non-exclusive, non-transferable, non-sublicensable, revocable license to access and use the Service and any Memberships to which you have subscribed during the term of your subscription.”Open source citation
The clause allows indefinite, perpetual, or necessity-based retention.
“We retain personal information and user content for as long as necessary to provide the Services, support active accounts, comply with legal obligations, resolve disputes, and enforce our agreements. Active Accounts. Personal information and user content associated with an account are retained while the account remains active.”Open source citation
The clause includes sublicensable, transferable, or assignable rights.
“Limited License. Subject to your complete and ongoing compliance with these Terms, Creator grants you, solely for your personal, non-commercial use, a limited, non-exclusive, non-transferable, non-sublicensable, revocable license to access and use the Service and any Memberships to which you have subscribed during the term of your subscription.”Open source citation
The clause includes sublicensable, transferable, or assignable rights.
“Except for your pre-existing rights and this license granted to you, StackBlitz owns the text, photographs, videos, visual interfaces, interactive features, graphics, design, compilation, computer code, products, software and all other elements and components of the Site and Services (“StackBlitz Content”), excluding your content. StackBlitz owns the copyrights, trademarks, service marks, trade names and other int...”Open source citation
The clause includes sublicensable, transferable, or assignable rights.
“StackBlitz Content as part of a database or other work; (ii) use any automated tool (e.g., robots, spiders) to access or use our Services or to store, copy, modify, distribute, or resell any StackBlitz Content; (iii) rent, lease, or sublicense your access to our Services to another person; (iv) use any Services or StackBlitz Content for any purpose except for your own personal use, unless you are operating under t...”Open source citation
Tier matrix
Plan-level conditions detected from citation-backed clauses. Empty tiers mean AIRIN has not captured decisive tier language yet.
| Tier | Surface | Verdict | Risk | Citations |
|---|---|---|---|---|
| All applicable tiers | audit rights dpa residency | worsens | HIGH | 1 |
| All applicable tiers | commercial use | conditional | MEDIUM | 3 |
| All applicable tiers | data retention | conditional | MEDIUM | 2 |
| All applicable tiers | indemnity liability | worsens | HIGH | 4 |
| All applicable tiers | moderation enforcement | worsens | HIGH | 1 |
| All applicable tiers | output ownership | worsens | HIGH | 1 |
| All applicable tiers | privacy data use | worsens | HIGH | 12 |
| All applicable tiers | subprocessors data sharing | worsens | HIGH | 10 |
| Enterprise | commercial use | worsens | HIGH | 3 |
| Enterprise | tier differences | worsens | HIGH | 1 |
| Free | output ownership | worsens | HIGH | 2 |
| Free | prompt ownership | worsens | HIGH | 2 |
Policy evolution
Open full timelineBefore/after stance changes across captured policy versions. When no material delta exists yet, AIRIN shows the latest citation-backed stance events instead.
data sharing worsened from medium/third party or vendor sharing to high/sale or sell.
“We share information with trusted service providers who perform services on our behalf, including hosting, analytics, billing, customer support, and AI processing. These providers are authorized to process information only as necessary to provide services to Bolt.”Before citation
“Bolt does not sell personal information as defined under the CCPA. However, we may share limited identifiers or device information with advertising or analytics partners to support marketing or promotional campaigns. Where required by law, users may opt out of such sharing.”After citation
model training improved from high/training permitted to medium/training with opt out.
“We may use AI Inputs and AI Outputs to operate, maintain, and improve the Services, including improving AI performance, reliability, and safety. Such use shall be on aggregated, anonymized, or de-identified data.”Before citation
“Depending on account type or plan, users may have the ability to limit or opt out of the use of AI Inputs and AI Outputs for model training or improvement, as described in product documentation or account settings.”After citation
data sharing improved from high/sale or sell to medium/third party or vendor sharing.
“Bolt does not sell personal information as defined under the CCPA. However, we may share limited identifiers or device information with advertising or analytics partners to support marketing or promotional campaigns. Where required by law, users may opt out of such sharing.”Before citation
“We share information with trusted service providers who perform services on our behalf, including hosting, analytics, billing, customer support, and AI processing. These providers are authorized to process information only as necessary to provide services to Bolt.”After citation
data sharing improved from high/sale or sell to medium/third party or vendor sharing.
“The following chart lists the categories of personal information we have sold or shared over the last 12 months, and the categories of third parties to whom we have sold or shared such personal information.”Before citation
“We may provide you with a mechanism to provide feedback, suggestions, and ideas, if you choose, about our Site or Services (“Feedback”). You agree that we may, in our sole discretion, use the Feedback you provide to us in any way, including in future enhancements and modifications to our Site or Services. You hereby grant to us and our assigns a perpetual, worldwide, fully transferable, sublicensable, irrevocable, royalty free license to use, reproduce, modify, create derivative works from, distribute, and display the Feedback in any manner any for any purpose, without in any media, software, or technology of any kind now existing or developed in the future, without any obligation to provide attribution or compensation to you or any third party.”After citation
Latest stance: sublicensable or transferable on output ownership
“We may provide you with a mechanism to provide feedback, suggestions, and ideas, if you choose, about our Site or Services (“Feedback”). You agree that we may, in our sole discretion, use the Feedback you provide to us in any way, including in future enhancements and modifications to our Site or Services. You hereby grant to us and our assigns a perpetual, worldwide, fully transferable, sublicensable, irrevocable, royalty free license to use, reproduce, modify, create derivative works from, distribute, and display the Feedback in any manner any for any purpose, without in any media, software, or technology of any kind now existing or developed in the future, without any obligation to provide attribution or compensation to you or any third party.”Open timeline citation
Latest stance: broad license on output ownership
“We may provide you with a mechanism to provide feedback, suggestions, and ideas, if you choose, about our Site or Services (“Feedback”). You agree that we may, in our sole discretion, use the Feedback you provide to us in any way, including in future enhancements and modifications to our Site or Services. You hereby grant to us and our assigns a perpetual, worldwide, fully transferable, sublicensable, irrevocable, royalty free license to use, reproduce, modify, create derivative works from, distribute, and display the Feedback in any manner any for any purpose, without in any media, software, or technology of any kind now existing or developed in the future, without any obligation to provide attribution or compensation to you or any third party.”Open timeline citation
Latest stance: third party or vendor sharing on output ownership
“We may provide you with a mechanism to provide feedback, suggestions, and ideas, if you choose, about our Site or Services (“Feedback”). You agree that we may, in our sole discretion, use the Feedback you provide to us in any way, including in future enhancements and modifications to our Site or Services. You hereby grant to us and our assigns a perpetual, worldwide, fully transferable, sublicensable, irrevocable, royalty free license to use, reproduce, modify, create derivative works from, distribute, and display the Feedback in any manner any for any purpose, without in any media, software, or technology of any kind now existing or developed in the future, without any obligation to provide attribution or compensation to you or any third party.”Open timeline citation
Latest stance: sale or sell on audit rights dpa residency
“Bolt does not sell personal information as defined under the CCPA. However, we may share limited identifiers or device information with advertising or analytics partners to support marketing or promotional campaigns. Where required by law, users may opt out of such sharing.”Open timeline citation
Capture recency
- Privacy Policy:Last captured 2026-06-10· verified 2026-06-10not re-verified in 93 days
- Terms of Service:Last captured 2026-06-10· verified 2026-06-10not re-verified in 93 days
Dates state when our pipeline captured and verified each document — not when the vendor last changed it. Documents are re-scanned on a recurring cadence; a document verified once says so until a re-scan confirms it again.
↑ 816 more findings this quarter vs last (908 vs 92). First scan: June 2026.
Compare and stack are saved in your browser. Open compare · View your stack. A correction triggers an automated re-read of Bolt.new (StackBlitz)'s policies — no human edits the data.
Need this for procurement or legal diligence?
Free shows today's risk. A Stack Audit gives you a citable, verbatim-sourced PDF across your whole AI stack — and flags the moment a vendor's terms change.
Every finding above is a verbatim quote from Bolt.new (StackBlitz)'s own published policy, captured to an immutable snapshot and read in full through a two-gate verification pipeline. Confidence labels and any analysis are AI-generated and informational only — not legal advice.
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.