Security & how AVA handles your stuff

What AVA does and doesn't see

AVA reads your repository's structure (file names, what files import each other) to draw your project as a graph. We don't see the contents of your files — your code stays in your browser, and the AI descriptions you generate (if you bring an AI key) go straight from your browser to the AI provider you chose. AVA doesn't store the AI's responses for free users either; they live in your browser memory while the tab is open and disappear when you close it. If you upgrade to Pro, AVA can save the AI's descriptions across visits (the AI's descriptions — again, not your code) so you don't pay your AI to regenerate them next time.

About ads on the free tier

AVA shows ads on the free tier to help support the site. We use third-party ad networks, and like most ad networks, they may track users for advertising purposes. AVA itself doesn't track your usage — but the ad networks do; that's how they work.

To limit what an ad can reach, we load ads inside a sandboxed iframe on a separate subdomain. That means the ad script can't read anything from your AVA session — your AI key, your data, or your project graph. The browser walls it off.

The trade-off: even sandboxed, an ad network knows a user visited a page where their ad loaded. If that's not okay with you, Pro removes all ads — and the third-party scripts that come with them — entirely.

A good habit: rotate your AI key

If you use AVA's AI description feature with your own API key, it's a good habit to rotate that key every few months. The reason it matters here specifically: any site that runs ads — including ours — relies on the ad network not slipping a bad ad through. It almost never happens, but rotating your key periodically means that even in the rare case something did slip through, an old key wouldn't be useful to anyone. Most major AI providers (OpenAI, Anthropic, Google) let you rotate a key in a couple of clicks.

If something looks off

If anything in your AI provider's dashboard ever looks unexpected — charges you don't recognize, activity you didn't make — just rotate the key there. The key only lives in your browser, so there's nothing on AVA's end to revoke. That's it.

Pro and what it changes

If you upgrade to Pro (or link an Airy account for a free unlock), AVA stops loading any ads or ad-network scripts for you. The site itself doesn't track you either way — but Pro removes the third-party layer entirely.