Lovable Review: AI App Building, Pricing, Credits, Cloud, Connectors and Security

Lovable's most important 2026 story is not one model release or one funding announcement. It is the way the product is expanding around the generated application. Lovable still begins with the familiar promise: describe a web app in ordinary language, review a working preview, and keep iterating. The current platform now reaches much further into hosting, backend services, AI usage, integrations, security, publishing, and governance. That changes both the value proposition and the due diligence a buyer should perform.

The clearest signal is Lovable's gradual move to one credit balance. Current documentation says credits can now pay for three distinct types of activity: building in the editor, running a deployed app through Lovable Cloud, and making AI model calls from features inside the deployed app. Some workspaces may still see the older Cloud and AI balance experience while the rollout proceeds. Existing dollar balances for Cloud and AI are converted at the workspace's plan rate, and Lovable says the underlying costs have not changed because of that conversion.

This is a meaningful product simplification. A founder no longer has to think of generation, hosting, backend activity, and in-app AI as unrelated billing systems. The same balance can cover them after any usage-specific grants have been used. It also makes the subscription price only the first line of a real cost model. Build mode is usage based, with simple edits often costing less than a larger multi-step change. Cloud consumption is driven by database server time and size, stored data, network transfer, file storage, backend compute, and realtime events. AI gateway consumption is driven by model choice, token volume, call frequency, and the kind of feature the app provides.

The free tier remains useful and unusually concrete. It includes 5 build credits per day, capped at 30 per calendar month, plus monthly grants of 20 Cloud credits and 4 credits for AI features in deployed apps. Pro starts at $25 per month with 100 general credits, while Business starts at $50 per month with 100 Business credits and more workspace controls. Paid workspaces also receive daily build credits and Cloud and AI grants. Usage-specific grants expire on their reset schedule and do not roll over. Monthly paid credits can roll over while the subscription remains active, but they still expire under published time limits. Buyers should therefore model both workflow and runtime usage rather than compare tools only by the number of prompts in a plan.

Lovable's expansion into connections is equally significant. Its connector system distinguishes between a shared app connection, a personal chat connection used by the builder, and an app user connection. The last category became a headline product feature in July 2026. It lets each person using a published Lovable app connect their own supported account, so the app works with that person's data and permissions rather than one central credential. A team can build one CRM helper, calendar tool, or productivity dashboard while every user authenticates independently. Lovable says tokens are stored through its connector gateway and are not exposed in the project.

That separation solves a real multi-tenant design problem, but it does not remove the builder's responsibility. The app still needs correct server-side authorization, minimal OAuth scopes, clear disclosure, safe error handling, tenant-isolation tests, revocation behavior, and an audit trail. Connecting Salesforce, Gmail, Slack, Microsoft 365, or another business system turns a prototype into a security boundary. A generated interface that displays the right sample data is not evidence that another user's data can never be reached.

Lovable also added a route from a public app into AI assistants. Agent integrations can expose selected application actions through a hosted Model Context Protocol server. A user can connect the app to ChatGPT, Claude, or another compatible client and ask the assistant to read information, run a workflow, create a record, or apply the app's logic. Lovable proposes tools based on the app, hosts the MCP server, follows the published version, supports OAuth, and security-checks the server during publishing. Separately, Lovable itself offers an MCP server that lets supported clients create projects, send build messages, inspect code, and deploy apps.

This is a distribution opportunity and a new attack surface. A graphical interface naturally constrains what a person can click. An MCP server describes callable actions to another AI system. Every exposed write, payment, deletion, publication, or account change therefore needs server-side authorization, strict input validation, rate limiting, meaningful logs, and often explicit user confirmation. The assistant's decision to call a tool must never be the only permission check. Teams should begin with low-impact reads, verify identity and ownership on every request, and add consequential actions only after abuse and prompt-injection testing.

Security has become a more visible product layer. Lovable documents two built-in scanners. The Basic scan reviews areas such as row-level security policies, database schema and access control, and vulnerable dependencies. The Deep scan adds an agentic review of the codebase, including permissive access, unprotected backend endpoints, exposed secrets, unsafe input handling, insecure storage, and information leakage. In June, Lovable also announced automatic checks during publishing, with results that can pass, warn, or identify critical issues. Higher plans add broader workspace views and governance.

On August 5, Lovable introduced a trust center for published businesses. The page is intended to show observed security controls, data protection information, access and authentication, subprocessors, compliance details, and vulnerability handling at an app-specific address. This can make an early security conversation easier for a small software business. Lovable is explicit that the page is informational and is not itself a certification. It cannot prove that an application's business logic is correct, that authorization covers every path, or that a company satisfies a particular regulation.

The portability story remains one of Lovable's strongest practical advantages. Current documentation supports two-way Git sync with GitHub and GitLab, code download on paid plans, external deployment, and self-hosting. Lovable says customers own their code, data, projects, and AI output as between the customer and Lovable, subject to third-party rights. This makes it possible to treat Lovable as an accelerator instead of a permanent closed runtime. The limitation is that an existing external repository still cannot be imported to start a new Lovable project, so the platform fits greenfield work better than direct modernization of a mature codebase.

Data policy deserves immediate attention because a published change is approaching. Lovable says that from September 9, 2026, customer data from Free and Pro plans may be used to train, develop, or improve Lovable's AI models and AI-powered features unless the individual opts out. The described customer data can include prompts, attached files and images, code, project files, configurations, hosted applications, and generated output. App end-user data and account or billing details are excluded. Business and Enterprise workspace data is excluded from training by default. Free and Pro users can disable model training in account settings before or after the effective date, although a later opt-out applies prospectively.

Lovable's current terms, effective August 15, also underline familiar AI software risks. Outputs may be inaccurate, non-unique, incomplete, or affected by third-party rights. The service relies on infrastructure and AI providers, and data processing or storage in a particular region is not guaranteed without a written agreement. Standard service terms warn against sensitive categories such as protected health information unless the applicable plan or contract expressly permits them. Credits may be consumed even when an AI action does not produce a satisfactory result.

The commercial backdrop is rapid growth. Lovable announced a $400 million Series C at a $13.3 billion valuation on August 12, led by Menlo Ventures and the Scaleup Europe Fund managed by EQT. That is the company's own announcement and should be treated as such. Funding can support infrastructure, research, and enterprise development, but it is not evidence that any generated app is secure, maintainable, or economically efficient. Those claims still need to be tested project by project.

For buyers, the right conclusion is neither that Lovable replaces engineering nor that it is merely a toy. It is becoming an integrated software creation and operations environment with credible code portability. A disciplined team can use it to compress discovery, prototyping, and implementation, then carry the work into ordinary source control, testing, review, and deployment. A careless team can also turn a convincing preview into a public application with weak access controls, unmeasured runtime spend, broad connectors, and no exit plan.

The best evaluation is one representative application and one controlled release. Put the code in Git from the beginning. Define acceptance tests before generation. Choose Cloud or external infrastructure deliberately. Run both security scans. Test cross-user access and failure paths. Set credit limits and measure build, Cloud, and AI consumption separately. Review the training-data setting. Publish first to a restricted audience where the plan supports it. Keep backups and an external deployment runbook. Lovable's wider platform can remove a great deal of setup work, but it does not remove accountability for the software that reaches users.

WhatAI Decision Box

Lovable is an AI software development platform for turning a written product brief into a working web application. It can generate and revise the interface, application logic, database, authentication, connectors, payments, AI features, and publishing configuration from a conversation. Build mode changes the project, while Plan mode investigates or designs an approach without touching code. The platform is approachable for non-developers, but the generated result is still software. Production use requires testing, source control, access-control review, security scanning, monitoring, backups, cost controls, and a responsible owner.

Lovable Cloud provides hosting plus a built-in backend covering database, authentication, storage, networking, edge functions, and realtime features. A project can instead connect to external Supabase, sync code in both directions with GitHub or GitLab, and deploy outside Lovable. Connectors can use one shared account, give the builder private context while working, or let every end user connect their own account. Publicly published apps can also expose selected actions through a Lovable-hosted MCP server for assistants such as ChatGPT and Claude. These conveniences reduce setup work but introduce provider dependencies, runtime credit usage, credential scope, and data-flow decisions that need deliberate review.

The Free plan includes 5 daily build credits, capped at 30 per calendar month, plus monthly grants of 20 Cloud credits and 4 deployed-app AI credits. Pro starts at $25 per month with 100 monthly general credits. Business starts at $50 per month with 100 Business credits and additional workspace, publishing, design, privacy, and security controls. Enterprise is custom. Paid monthly credits can roll over while the subscription remains active but expire under published rules. Lovable is strongest for founders, product teams, designers, operators, and developers who want to produce or validate a web app quickly and retain code portability. It is a poor substitute for professional engineering and compliance review when correctness, sensitive data, safety, or complex legacy architecture is central.

Use Cases

Pricing varies by plan and region — see current pricing.

Plan features change — last updated: 2026-08-15.

Lovable Community Discussions

Explore community discussions. Ask and answer questions on Lovable to grow and learn together.

Lovable Pros & Cons

How to Get Results with Lovable: Step-by-Step Workflow

1. Define the release and its evidence

   Write the users, problem, required screens, data classes, core journeys, integrations, non-functional requirements, acceptance tests, excluded scope, owner, budget, and release decision before opening the builder.

2. Start with a narrow product brief

   Ask Lovable to build one coherent vertical slice with realistic example data. State the visual direction, responsive breakpoints, accessibility target, authentication roles, database entities, and success criteria.

3. Use Plan mode for risky changes

   Have Plan mode inspect architecture, data migration, permissions, integrations, and possible regressions before implementation. Review its plan and split broad changes into focused Build mode requests.

4. Create an external source-control copy

   Connect GitHub or GitLab early, verify two-way sync on a test change, protect the main branch, and use pull requests or reviewed commits for consequential work.

5. Choose backend and deployment boundaries

   Decide whether Lovable Cloud or external Supabase fits the data, region, portability, operations, and cost requirements. Document the database, storage, authentication, secrets, AI gateway, and hosting dependencies.

6. Connect least-privilege services

   Use dedicated test accounts, minimal OAuth scopes, separate development and production credentials, and app user connectors when each user should act as themselves. Never expose secrets in client code.

7. Test like conventional software

   Run unit, integration, end-to-end, authorization, accessibility, browser, mobile, performance, failure, duplicate-event, abuse, prompt-injection, and recovery tests using representative users and data.

8. Review security and privacy

   Run Basic and Deep scans, resolve findings, inspect row-level security and every backend endpoint, map data transfers, review provider terms, set the training-data preference, and obtain professional review where risk demands it.

9. Measure credits and runtime cost

   Track Build, Cloud, and AI gateway usage separately. Load-test realistic traffic and model-call volume, configure credit limits and top-up controls, and record a normal and worst-case monthly cost.

10. Release with an exit path

    Publish first to a controlled audience, monitor logs, errors, security, latency, spend, and user feedback, then expand gradually. Keep tested exports, backups, ownership records, rollback steps, and an external deployment runbook.

Lovable Gotchas and Limits to Know Before You Start

• The Free plan's 5 daily build credits are capped at 30 per calendar month.
• Lovable's single credit balance for Build, Cloud, and deployed-app AI usage is still rolling out gradually, so some workspaces may show the previous balance experience.
• Build mode is usage based. A short prompt can trigger broader exploration, verification, web search, browser work, image generation, or code changes and therefore use more credits.
• Credits are consumed for AI actions based on work performed even if the output is wrong, incomplete, or must be regenerated.
• Included Cloud and AI grants are described as temporary and subject to change.
• Free and Pro published apps are externally accessible to anyone with the link. Private and custom audiences require Business or Enterprise.
• Automated security scans reduce common risks but do not prove an app is secure, compliant, or ready for sensitive workloads.
• A published-app trust center reports observed controls and certifications but is not itself a security certification.
• Lovable relies on third-party infrastructure and model providers, and its terms do not guarantee processing or storage in a particular region unless agreed in writing.
• Lovable cannot currently start a project by importing an existing external code repository.
• Git sync operates on one active branch at a time and should be tested before a team relies on it as its release process.
• Custom integrations and connectors can read or write external data according to granted scopes. Use least-privilege accounts and verify every operation.
• From September 9, 2026, Lovable says Free and Pro customer data may be used for AI model training unless the user opts out. Business and Enterprise workspace data is excluded by default.
• The standard terms caution against uploading protected health information and other sensitive categories unless a plan or written agreement expressly permits it.
• Custom domains, app login, payment processing, email delivery, external APIs, and AI features introduce separate provider costs, policies, quotas, and failure modes.
• Generated interfaces, database policies, authentication, business logic, and accessibility can all require manual correction and independent testing.
• A lovable.app subdomain is controlled by Lovable and should not be treated as a permanent mission-critical identifier. Use a custom domain for an important production service.
• Monthly paid credits roll over only under the published subscription and expiry rules. They are not cash, are generally non-refundable, and can be frozen or forfeited in stated circumstances.

Which Lovable Feature Fits Your Use Case

Starter Prompts for Lovable

What is Lovable?

Lovable is an AI software development platform that builds and edits web applications from natural-language instructions. It can work across the interface, application logic, database, authentication, integrations, AI features, and publishing setup, while leaving the generated code available for inspection, export, Git sync, and external deployment.

Is Lovable free?

Yes. The current Free plan grants 5 build credits per day, capped at 30 per calendar month, plus 20 Cloud credits and 4 deployed-app AI credits each month. These usage-specific grants expire on their own reset schedule and do not roll over.

How much does Lovable Pro cost?

Pro currently starts at $25 per month with 100 monthly general credits. It also includes 5 daily build credits, a 20-credit Cloud grant, and a 4-credit deployed-app AI grant. Larger bundles, annual pricing, taxes, and promotions should be checked at live checkout.

What is the difference between Pro and Business?

Business starts at $50 per month and adds team, access, publishing, security, connector, design, and privacy controls beyond Pro. Lovable documentation says Business workspace data is excluded from AI model training by default. Enterprise adds deeper identity, audit, data, security, publishing, and infrastructure controls.

How do Lovable credits work?

Lovable is gradually rolling out one balance for three kinds of usage: building inside the editor, running hosting and the built-in backend through Cloud, and AI model calls made by deployed apps. Plan mode costs 1 credit per message. Build mode varies by task complexity. Runtime costs depend on resources and model usage.

Do Lovable credits roll over or expire?

Unused monthly plan credits roll over while a paid subscription remains active, but they still expire. Monthly-plan credits expire two months after issue, annual-plan credits expire one month after the annual period ends, and top-up credits expire twelve months after purchase. Daily and monthly usage-specific grants do not roll over.

Does Lovable own the code it generates?

Lovable's pricing page and current terms state that, as between the customer and Lovable, the customer owns their code, projects, customer data, and AI output, subject to third-party rights. Lovable retains ownership of its platform and materials. Review the live contract for your situation.

Can Lovable projects be exported or self-hosted?

Yes. Lovable supports code download on paid plans and two-way Git sync with GitHub and GitLab. Its portability documentation says projects can be cloned, changed outside Lovable, deployed on other infrastructure, or self-hosted. Existing external repositories cannot currently be imported to start a new Lovable project.

Is Lovable secure enough for production?

Lovable provides Basic and Deep security scans, publish-time checks, project security views, and higher-plan workspace controls. Lovable explicitly says these tools cannot guarantee complete security or replace a thorough review. Sensitive, regulated, or critical apps should receive professional security, privacy, architecture, and compliance assessment.

Can a Lovable app connect to each user's own tools?

Yes. App user connectors let each signed-in end user connect their own supported account, and the app acts with that user's granted permissions and sees that user's data. This differs from a standard app connector, where every visitor uses one shared account connected by the builder or workspace.

Can a Lovable app work in ChatGPT or Claude?

Yes, for supported public apps. Agent integrations can turn selected app functionality into tools exposed through a Lovable-hosted MCP server. Lovable also operates its own MCP server so supported clients such as ChatGPT, Claude, Cursor, and VS Code can create, inspect, iterate, and deploy Lovable projects.

Will Lovable use project data for AI training?

Lovable has announced that from September 9, 2026, customer data from Free and Pro users may be used to train or improve Lovable AI unless the user opts out. The setting is under Account settings and can be changed before or after that date. Business and Enterprise workspace data is excluded by default, and app end-user data is excluded.

Related AI, Coding and Development Tools

Explore the Network