What the bots receive, send, save, and return.

Website questions are checked before a model request

Design Bot accepts a current question and limited recent history. For the model request, the server keeps user-role history and adds the current user question. It does not send prior assistant messages back as conversation history. Before contacting the AI provider, the server checks the current question and user history against a website-topic boundary. Off-topic material can receive a local refusal without a model call.

Accepted questions pass through Vercel AI Gateway to the configured model. Current code defaults to Anthropic Claude Haiku 4.5, but a runtime environment setting can select another model. The request includes system instructions, user content, a keyed session-derived pseudonymous user value, and tags for the feature and deployment environment. The response is streamed back as plain text.

Five answers become a sanitized rough concept

Website Draft Bot collects business type, town or service area, business name, desired customer action, visual direction, and a starting color. Those values are placed in a structured prompt. A revision sends the sanitized current draft and a bounded instruction because the model needs the existing content to make the requested change.

The server requires structured output and sanitizes the result. It removes or rejects scripts, event handlers, forms, frames, embeds, unsafe metadata, working navigation, authentication, payments, tracking, and unapproved asset behavior. If the first generation does not produce valid structured output, current code can return a local fallback built from the five answers. A failed revision returns an error instead of that fallback.

First draft

One anonymous AI draft, subject to session and coarse network limits.

Revisions

Exactly three AI revisions after email verification.

Palette

Color changes happen in the browser and do not call a model or consume a revision.

Preview

Sanitized static HTML and CSS appear in a sandboxed frame.

Email is optional until you request an email feature

You can ask Design Bot questions and create the first Website Draft Bot draft without giving an email address. Design Bot offers an optional Send Conversation action. If you use it, your email and up to twelve user and assistant messages are sent through PixelForged's server and Resend so the transcript can be delivered.

Website Draft Bot asks for email when you choose to unlock revisions. Resend sends a six-digit code that expires after ten minutes. The server stores keyed hashes for verification and quota controls instead of the raw email in Redis. After verification, a keyed email hash and a three-credit balance can remain associated with the random session for up to ninety days. These email actions do not include a marketing signup in current code.

Draft work stays in the browser when storage is available

Design Bot messages remain in the open page's memory unless you request an email copy. The application does not save the Design Bot chat transcript in localStorage. Website Draft Bot saves progress and draft data in localStorage when available, with sessionStorage as a fallback. Saved data can include answers, generated HTML and CSS, palette, labeled stand-ins, summary, signature, verification status, and revision count. It does not include the verification email or code.

The Clear Saved Draft control removes that browser record and resets the open draft state. Server-side systems hold session, rate, anonymous-draft, verification, revision-credit, and short-lock records. These use random or keyed pseudonymous identifiers. Quote and transcript email can remain with Resend and in receiving mailboxes. Clearing browser data does not remove delivered email or provider records.

Application code cannot answer every provider-data question

The current application routes AI requests through Vercel AI Gateway and defaults to an Anthropic model. Source code shows the request fields and safety controls. It does not prove which model override is active in every deployment, whether a provider keeps prompt or output logs, how long logs or backups remain, where processing occurs, or whether provider terms permit model improvement from a particular request.

Because those details are not established here, PixelForged does not answer yes or no to model-training questions on this page. Do not submit data that depends on a specific retention, location, confidentiality, deletion, or training guarantee. Provider policies and runtime settings need separate verification before a broader statement can be made.

Treat every result as a draft that needs review

AI can invent facts, miss context, produce inaccessible choices, misunderstand local requirements, or repeat common website patterns. A generated business name, review, photo description, certification, price, service area, guarantee, or performance claim is not verified because it appears in a draft. Labeled stand-ins identify some missing proof, but they do not replace human checking.

Design Bot is not intended for legal, medical, tax, financial, safety, emergency, or other high-stakes advice. Website advice can still affect public claims and customer experience. Review accuracy, permissions, accessibility, privacy, security, and suitability before acting. The rough Website Draft Bot preview is not a finished site and cannot be published through the bot.

You decide whether to use the bots and what to send

You can avoid both bots, stop a request, create the first draft without email, decline transcript delivery, and change draft colors without another model call. You can use Clear Saved Draft to remove locally saved work. Browser settings can also clear the session cookie and site storage, although that can prevent restoration and disconnect prior verification or revision credits.

Do not enter passwords, payment data, government identifiers, health information, private customer records, confidential contracts, proprietary code, or other material that should not pass through the named providers. This page does not promise a provider-level deletion route, jurisdiction-specific data rights, an appeal process, or an incident-notification schedule because those operational and legal details have not been confirmed.