Who Owns Your Code: Lovable, Base44, v0, Bolt.new and Replit Compared

Here is the assessment in one table, with the basis for each verdict named so you can check it. Note the last column: only two of these five verdicts rest on published terms. | Platform | Source code out? | Backend portable? | Data and users out? | Verdict | Basis of assessment | |---|---|---|---|---|---| | Lovable | Yes. Two-way GitHub sync, or ZIP download on paid plans. Standard Vite and React | Partially. Supabase-compatible, so moving to your own Supabase project is documented. Plain Postgres is "not supported out of the box" | Schema and storage policies via SQL migrations. Data, secrets, auth providers and files manual. Passwords cannot be exported | Genuine code ownership, backend portable within Supabase | Lovable's own documentation | | Base44 | Frontend and function source via ZIP or GitHub on Builder tier and above. Entity schemas excluded from the repo | No. MongoDB-compatible database, Deno functions, auth, storage and automations all run on Base44. Exported code calls back via the SDK | Per-table CSV only. No private auth records, no automations, no secrets | Weakest here. You own a client for someone else's runtime | Base44 developer documentation and public SDK | | v0 (Vercel) | Yes. Standard React and Next.js you copy or sync into your own repo | Not applicable. v0 generates application code, it is not a managed backend runtime | Your data lives in stores you chose from the start | Strongest legal position of the five | Vercel AI Product Terms, sections 6 and 7 | | Bolt.new (StackBlitz) | Yes. ZIP download or StackBlitz export. Core is MIT licensed, with `bolt.diy` as the open-source variant | Depends entirely on what you wire up, commonly Supabase. No proprietary runtime layer | Yours, in whichever backend you chose | Strong, on architecture and licence | Public repository licence and product docs | | Replit Agent | Yes. Real code in JavaScript, TypeScript or Python, with git history preserved | Defaults are sticky. Replit DB, Replit Auth, Replit secrets and Replit hosting are all swappable, none automatic | Database exportable at any point | No contractual lock-in we could verify, meaningful default lock-in | Product documentation and third-party commentary |

Vercel's AI Product Terms contain the clearest ownership language of any platform in this set. Section 6, on intellectual property rights, states: "As between you and Vercel, and to the extent permitted by applicable law, you own Customer Content and Vercel assigns to you Vercel's rights, if any, in the Output." That is an assignment, not a licence, and it is written down where a lawyer can read it. It is the strongest contractual position of the five platforms here, and it applies at real scale: Vercel says more than 4 million people have used v0 since general availability, with over half of v0 revenue coming from team and enterprise accounts. The same terms include two caveats that deserve equal airtime, because quoting only the favourable sentence would be dishonest. First: "Output may not be unique, and the AI Products and Services may provide the same or similar Output to other users." Two customers describing similar apps can receive similar code, so the assignment does not create exclusivity. Second, Vercel asks you to "make your own determination regarding the intellectual property rights you have in Output and its commercial usability," taking your usage and the laws of your jurisdiction into account. In plain terms, they assign what rights they have without warranting what those rights amount to. Section 7 adds a training commitment for subscribers with opt-out rights: Vercel warrants it will not use v0 customer content to train its own or third-party models, or to improve the AI products, except with your consent. One clarification worth making, because it circulates as a misreading. Vercel's terms also reserve rights in "the AI Solution." That refers to Vercel's platform and models, not to the code v0 generates for you. The two are separate, and the section 6 assignment is unambiguous.

Lovable's documentation makes a stronger case for portability than most of its competitors' marketing does, and it is worth quoting because it doubles as a commitment you can hold them to. "Lovable is intentionally built so that you are never locked in. You can export your code, migrate your data, self-host parts or all of your stack, or move to another provider at any time. We want you to stay with Lovable by choice, never by necessity." On code specifically: "You own your code... You can clone your repository, modify it outside Lovable, deploy it on your own infrastructure, or fully self-host without restriction." The generated app is a standard Vite and React project on open-source foundations, so this is architecturally true rather than aspirational. The honest boundary is the backend. Lovable's services are Supabase services, which makes moving to a Supabase project you own a supported, documented path. Moving to anything else is not. Lovable's own words: migration to plain PostgreSQL or another provider "would require implementing equivalent authentication, storage, and edge services and is not supported out of the box." There is also one component that stays theirs regardless: "The Lovable platform itself (the editor and AI agent) is a managed service and cannot be self-hosted or deployed inside a customer VPC." That is reasonable, and it means the thing you cannot take is the building experience, not the built thing. The single hardest constraint is user passwords, which Lovable's docs state cannot be exported. That is covered in detail in migrating off Lovable.

Base44 is the clearest case in this set of owning source code without owning an application. The exported frontend still requires an environment variable pointing back at Base44's servers, because Base44 is still doing the work behind every screen. The architecture explains why, and it did not change when the company did. Wix acquired Base44 in June 2025 for approximately US$80 million (about A$122 million at July 2026 rates) in initial consideration plus earn-out payments through 2029, which moved hosting onto Wix infrastructure without altering the SDK-mediated design. Base44's own developer documentation describes a MongoDB-compatible database, Deno-based serverless functions, built-in authentication handling registration, login and session management, and included hosting. Everything is reached through the Base44 SDK. A typical line of a Base44 app reads like `base44.entities.Products.list()` or `base44.auth.loginViaEmailPassword(...)`. Every data read and every login is a call to their servers. That is not a licensing restriction. It is an architectural one, which is harder to fix. You can host the exported code on your own infrastructure and every button will keep working, precisely because the subscription is still live. Cancel it and the app stops. The export mechanisms reinforce the point. The ZIP download and GitHub sync give you frontend and function source, with entity schemas excluded from the repository. Data comes out per-table as CSV, without private authentication records, automations, agents or secrets. The CLI command named `eject` creates a new backend on Base44 with a new app ID and an empty database, so despite the name it does not eject you from anything. One firm selling Base44 migrations puts it better than we could, and they have a commercial interest in the framing: "An export gives you the files. A migration is what gets the app out of Base44."

Bolt.new is the only platform in this set where a public open-source licence carries part of the ownership argument. StackBlitz released the core of Bolt.new under the MIT licence, and maintains `bolt.diy` as the official open-source variant, both verifiable in the public repository rather than in a terms document. MIT is about as permissive as software licences get. Use, modify, distribute and sell, with attribution and no warranty. That does not automatically settle the question of who owns AI-generated output, which is a separate legal issue, but it does mean the tooling layer itself is not something a vendor can withdraw from you. Architecturally, Bolt.new has no proprietary runtime layer of its own. It generates an application that talks to whatever backend you wire up, most commonly Supabase. Your data lives wherever you put it from the first day, which means there is no equivalent of the Base44 problem where an export leaves you holding a client for someone else's servers. You export a ZIP or push to StackBlitz, and the app's dependencies are the dependencies you chose. The honest limit on this assessment: we were not able to retrieve Bolt.new's terms of service. The MIT licence on the core is verifiable, and the architecture is documented, but no claim here about their contractual position should be treated as read. If you are relying on it commercially, read the current terms yourself.

Replit, reported at a US$3 billion valuation in 2025 (about A$4.6 billion at July 2026 rates), is the most instructive case in this comparison, because it shows that lock-in does not require a contract. Nothing in Replit's product prevents you from leaving. You get real code in JavaScript, TypeScript or Python, git history is preserved, and the database can be exported at any point. The friction is in the defaults. When the agent builds something, it reaches for Replit DB rather than a Postgres instance you own, Replit Auth rather than a standard authentication library, Replit's secrets manager rather than your cloud provider's, and Replit hosting rather than a deployment target you chose. Every one of those is swappable. Not one of them is swapped automatically. That is the pattern worth naming, because it generalises well beyond Replit. Each default makes the app faster to build and harder to leave, and neither effect is announced. Nobody agrees to be locked in. They agree to a series of sensible-looking conveniences, and six months later the exit cost is the sum of those conveniences: a database with no equivalent elsewhere, an auth system with no standard interface, secrets in a proprietary store, and hosting nobody has ever replicated. The test is not "am I allowed to leave." It is "how many vendor-specific services would I have to replace, and has anyone here ever run this app anywhere else." We could not retrieve Replit's terms of service, so this assessment rests on documented product behaviour and third-party commentary rather than on contract language.

Three of the five assessments above are not based on the platform's terms of service, because we could not retrieve them. This matters enough to state on its own rather than in a footnote. We read and quoted Vercel's AI Product Terms directly, and we read Lovable's published documentation on ownership, export and self-hosting directly. Those two verdicts rest on the vendors' own words. We could not retrieve the terms of service for Base44, Bolt.new or Replit. The assessments for those three rest on documented architecture, published product behaviour and, in Bolt.new's case, a verifiable open-source licence on the public repository. They are evidence-based, but the evidence is technical rather than contractual. That distinction has practical consequences. Architecture tells you what is hard to move. Terms tell you what you are permitted to move, who may use your code to train models, what happens to your data on account termination, and what changes the vendor can make unilaterally. A platform can be architecturally open and contractually restrictive, or the reverse. So treat this guide as the technical half of the assessment. Before you commit a business to any of these platforms, read the current terms of service yourself, or have someone read them for you, with three questions in hand: who owns the generated output, what may the vendor do with your code and data, and what happens to both if you stop paying. Terms change, and the version in force when you sign is the one that governs you.

The fastest way to find out whether you can leave a platform is to try, on a copy, before you need to. Most teams discover their real dependency position during an outage or a pricing change, which is the worst possible time to learn it. Run this as a half-day exercise: 1. Export or clone the code into a repository you own, on an account the vendor does not administer. 2. Search the codebase for the vendor's name, SDK package and API base URL. Every match is a service you would have to replace, not merely reconfigure. A count of zero means you are portable. A count in the hundreds means you own a client. 3. Install and build it locally with no vendor tooling. If `npm install && npm run build` fails outside the platform, you have found the first real dependency. 4. Point it at a fresh database and see what breaks. This separates "the schema is portable" from "the runtime is portable." 5. List everything that is configuration rather than code: OAuth providers, secrets, webhooks, scheduled jobs, storage buckets. These rarely appear in any export and are the most common source of a migration that looks finished and is not. 6. Check whether user passwords can be moved. On several platforms they cannot, which converts a technical migration into a customer communications exercise. Run that once a quarter while the app is small. The argument for owning your repository from the outset is made in full in own your GitHub rather than rent your app.

If I own my code, why can I not just leave? Because code and runtime are different assets. On Base44, the exported frontend still calls Base44's servers for every database read and every login, so the code runs only while the subscription does. Ownership of source is necessary for independence and nowhere near sufficient. What decides it is how many services in the app belong to the vendor. Which of these platforms has the clearest ownership terms? v0, on the evidence we could read. Vercel's AI Product Terms state that "you own Customer Content and Vercel assigns to you Vercel's rights, if any, in the Output." The same terms note that output may not be unique and ask you to assess commercial usability yourself, so it is an assignment of whatever rights exist rather than a guarantee of exclusivity. Does an open-source licence mean I own what the AI generated? Not by itself. Bolt.new's MIT-licensed core means the tooling cannot be withdrawn from you, which is genuinely useful. The ownership status of AI-generated output is a separate legal question that varies by jurisdiction and is not settled by the licence on the generator. The licence protects the tool, not the artefact. How can a platform lock me in without a contract? Through defaults. Replit is the clearest example: its agent reaches for Replit DB, Replit Auth, Replit secrets and Replit hosting, all of which are swappable and none of which are swapped automatically. Nobody agrees to lock-in. They accept a series of conveniences, and the exit cost is the sum of them. Should I read the terms of service myself? Yes, particularly for Base44, Bolt.new and Replit, whose terms we could not retrieve for this guide. Ask three questions: who owns the generated output, what may the vendor do with your code and data, and what happens to both when you stop paying. Terms change, and the version in force when you sign is the one that binds you.