Safety, Risks and Limits

Part 1: privacy, the non-negotiables

Everything you type into an AI builder travels to servers you do not control, and everything you publish is visible to the whole internet. So these five rules have no exceptions:

1. No real personal details in prompts: no full names, school name, home address, phone numbers, passwords, or daily schedule. Use nicknames and made-up examples; your app works exactly the same.
2. No photos of friends or family in published apps without their (and their parents') clear yes.
3. Adults own the accounts on Lovable and Google AI Studio (their terms require it); Replit and Canva allow teens with parental permission. Parents keep the passwords.
4. Your published app must not collect other people's personal information. A form that asks users for names, ages, or contacts turns your fun project into a serious legal responsibility (yes, really). Build apps that inform, entertain, and organize instead.
5. If anything feels off (a weird message, a request to chat elsewhere, content the AI generated that disturbs you), stop and show a parent. Not after. Now.

Part 2: money, the honest table

All 4 builders are companies. Free tiers exist to teach you the product, and that is a fair deal, as long as your family decides on purpose when free stops being enough. As of mid-2026 (check current prices together before paying anything):

Part 3: what AI builders get wrong

Knowing the limits is what separates builders from believers:

• Confident nonsense. The AI will present a broken feature with the same cheerful certainty as a working one. Your tests are the truth, never its claims. It may also put wrong facts INTO your app (a "fun facts" app can generate fiction), so check content against a source you trust.
• Big asks tangle it. Ask for a whole social network and you get a beautiful mess. Small apps, built feature by feature, is how the pros use these tools too.
• It can undo your work. A "fix" sometimes rewrites parts you loved. Use the builder's version history (Lovable and Replit both have one) so you can roll back, and take screenshots of versions you like.
• Security is shallow by default. Vibe-coded apps are not built to guard secrets. Do not build apps that handle passwords, money, or medical or private information; that needs professional engineering and review.
• Same prompt, different app. Rebuilding from the identical prompt gives a sibling, not a twin. That is normal; models generate rather than repeat.

Part 4: scams and look-alikes

Popular tools attract impersonators. Type the real addresses yourself (lovable.dev, aistudio.google.com, replit.com, canva.com) instead of clicking ad links. "Free unlimited credits" sites, browser extensions promising builder upgrades, and DMs offering to "boost your app" are harvesting accounts. When in doubt: close it, type the real URL, tell a parent.

Part 5: keep the builder healthy

Vibe coding is genuinely absorbing; the loop always whispers "one more fix". Work in 25-minute sprints with movement between them, keep builds out of the last hour before sleep, and remember the point of the whole course: the app serves people in your real life. Show it to them. That is where the good feeling actually lives.