Privacy

The short version

We collect what the service needs to work and very little else. We do not sell your data, we do not use it to build advertising profiles, and our website analytics set no cookies at all.

The one thing worth knowing that most policies do not mention: when you publish, we keep a copy of the source files so a previous version can be restored. That copy is deleted when you delete the project.

What we collect

Account information. Your email address, and your name and profile picture if you sign in with Google. Optionally a phone number, if you choose to verify one.

What you publish. The files and source your assistant sends us, the manifest describing each version, and a snapshot of the source of each published version so it can be rolled back.

Usage records. Per website, per month: how many requests it served, how much computing time it used, and how much storage it holds. This is what the allowances are measured against.

Technical records. The IP address that published a deployment, kept so abuse can be traced to its source. A log entry when an application tries to reach a network address it is not allowed to reach, kept for thirty days. Ordinary server logs.

Payment records. Stripe handles the payment itself and we never see your card details. We keep the customer and subscription identifiers, and what plan you are on.

Your agreement to the terms. The version you agreed to, the sentence you were shown, when you agreed, the IP address it came from and the browser that sent it. It is recorded because a term nobody can show you accepted is not worth much, and it is the one record here we keep after an account is deleted.

Domain registrant details, if you buy a domain. Registries require a real name, address, email and phone number, and we pass those to the registrar to complete the registration.

Analytics, and why there is no cookie banner

Our public pages use Google Analytics with consent set to denied by default. In that mode it stores nothing on your device and sends anonymous, cookieless pings instead. That is why there is no banner to dismiss: there is nothing running that needs your permission first.

The honest trade is that our numbers are worse than they would otherwise be. Without a stable identifier, somebody returning tomorrow is counted as a new visitor.

Analytics does not run on signed-in pages at all.

Traffic to the websites you publish is measured in aggregate — requests, bandwidth, computing time — so that allowances can be enforced. We do not track the individual people who visit your sites, and we do not give you a tool that would.

Who else handles your data

Running this needs a small number of other companies. Each of them sees only what its job requires:

• Cloudflare — serves every published website, and stores its files.
• Neon — hosts the database holding accounts, projects and usage records.
• Google — sign-in, and the analytics described above.
• Stripe — payments and subscriptions.
• Resend — the emails we send you.
• Telnyx — the text message, if you verify a phone number.
• OpenProvider — the registrar, if you buy a domain.

We do not sell personal data to anyone, and we do not share it with anyone else except where the law requires it.

How long we keep it

Account and project data is kept while your account exists.

When you delete a project we remove its files, its stored source snapshots, the data its application stored, and its logs. A small marker recording that the project was deleted is kept deliberately and permanently, because it is what stops a credential taken before the deletion from working afterwards.

Egress denial logs are kept for thirty days. Usage batches are kept for a short period and then pruned.

Two things outlive a deleted account, and both are deliberate. Billing records, because tax and accounting law requires them. And the record that you agreed to the terms — the version, the time, the address — because it exists to be produced in a dispute, and a dispute is at least as likely to arrive after an account is closed as before. Your name and the rest of your profile go; that row stays, holding the email address it was agreed under.

Some records are kept longer where we have to keep them, mainly billing records for tax and accounting.

None of this is a backup service, and none of these copies is yours to rely on. What we keep, we keep so the platform can serve and roll back your website — not so that you can recover work you did not keep somewhere else. Deletion here is immediate and we cannot reverse it. Keep your own copies, off our servers; the terms say the same thing at greater length.

Your rights

You can ask us for a copy of the personal data we hold about you, ask us to correct it, or ask us to delete it. You can delete your account yourself from the dashboard, which removes your websites with it.

Depending on where you live you may have further rights, including to object to certain processing or to complain to a data protection authority.

To exercise any of these, or to ask anything at all about this page, email us and a person will answer.

Security

Everything is served over HTTPS. Access codes are stored hashed and cannot be read back out of the database. Environment variables and secrets you give your applications are encrypted before they are stored.

Websites you publish are served from a completely separate domain to this one, so nothing published here can reach the control panel’s cookies. Applications run in a sandbox that can only reach a fixed list of network addresses, and cannot open raw network connections at all.

No system is perfect. If you find a security problem, please tell us before you tell anyone else and we will work with you on it.