Privacy Policy

1. What we collect

When you sign in with GitHub: your GitHub account number, user name, display name and profile picture address, and an access token that GitHub gives us. The token is stored encrypted. We ask GitHub for the read:user and repo permissions; we use them only to list your repositories, read and clone the ones you deploy, check them for new commits, and — if you turn on pull request previews — post one comment on a pull request.

What you put into the Service: projects and their settings, code we clone to build, container images we build (the last three per project), environment variables (stored encrypted and never shown again), databases, Redis, files and disks, scheduled jobs, custom domain names, notification addresses (stored encrypted) and the names of people you add as members.

What the Service records while it runs: deployments and their build logs; what your applications print (with values of your variables masked); performance measurements; usage figures; and an audit log of who did what and when. API tokens and sign-in sessions are stored only as one-way hashes.

If you ask for access: the GitHub user name, email address and note you type into the form. When someone who runs the Service reviews the request, we also look up that user name's public GitHub profile (account age, number of public repositories and followers, name, bio and picture) and keep it with the request.

Technical data: your IP address is used in memory to limit how often sign-in and the access form can be used. The server behind the dashboard records the IP address, time and path of requests to it in a log that is overwritten as it fills up. The proxy that serves applications keeps no access log, but it passes each visitor's IP address on to the application they visit.

2. Cookies and storage in your browser

• A session cookie that keeps you signed in, for up to 14 days.
• A short-lived cookie used only while signing in with GitHub, to protect against forged sign-ins.
• Your light or dark theme choice, in your browser's local storage, if you pick one.

That is all. There are no analytics, advertising or tracking cookies, and no third-party trackers.

3. Why we use it

• To provide the Service: sign you in, build and run your applications, store and back up their data, show you logs and figures.
• To keep it secure and fair: limits, detecting abuse such as cryptocurrency mining, and investigating misuse.
• To decide on requests for access, and to write to you about your request or account.
• To meet legal obligations.

We do not sell personal data, use it for advertising, or use your code or data to train AI models. By signing in or sending an access request you consent to this use; you may withdraw consent at any time (see section 8), after which we can no longer provide the Service to you.

4. Who it is shared with

Google Cloud

Runs our server (Mumbai) and stores encrypted off-server backups (Delhi). Your data stays in India.

GitHub

Sign-in, access to the repositories you deploy, and public profile look-ups for access requests and members.

Let's Encrypt

Issues HTTPS certificates. The names of application addresses and custom domains are published in public certificate logs, as for every HTTPS site.

DuckDNS

Answers the DNS look-ups for the platform's addresses, so it sees which addresses are looked up.

Services you choose

Notification channels you add (ntfy, Slack, Discord or your own webhook) receive the notifications you ask for; container registries you deploy from receive our server's requests.

People you add

Members of your account see its projects, logs and settings, as their role allows.

Authorities

Only when Indian law requires it.

Your profile picture in the dashboard is loaded from GitHub's image server.

5. How long it is kept

Account details and audit log

While your account exists.

Application output (logs)

30 days.

Build logs

90 days.

Performance measurements

7 days.

Usage figures

400 days, also after a project is deleted.

Sign-in sessions

14 days, or until you sign out.

Daily backups on the server

Databases and Redis: 7 days. File storage and disks: the 3 newest.

Backups you take yourself

Until newer ones replace them (the newest 10 for databases, fewer for the others).

Off-server backups

Encrypted copies of the whole platform: daily for 7 days, weekly for 4 weeks, monthly for 6 months.

Access requests

Until they are removed. Ask us and we will remove yours.

Dashboard server log

Until it is overwritten as it fills up.

6. Deleting your data

• Deleting a project, database, Redis, file storage or disk removes it and its backups on the server, normally within minutes.
• To delete your account, use Settings → Your data → Delete my account. Your projects and everything in them are removed from our servers, normally within minutes; you are signed out everywhere, your API tokens stop working, and we ask GitHub to remove the access you gave us. If you cannot use the dashboard, write to avinash217k@gmail.com and we will do it within 30 days.
• Your actions in other people's accounts, as a member, stay in their audit logs, with your name removed.
• Data that is already in an encrypted off-server backup disappears as those backups expire, at the latest about six months later. It is not restored unless the whole platform has to be recovered.

7. Security

Traffic is encrypted with HTTPS. GitHub tokens, environment variables, database and storage passwords and notification addresses are encrypted with AES-256-GCM, with a key that is kept apart from the database. Each application runs isolated from the others. Off-server backups are encrypted before they leave the server. No system is perfectly secure; if a breach affects your personal data, we will tell you and the authorities as the law requires. More detail: security notes.

8. Your rights

Under the Digital Personal Data Protection Act, 2023, you can ask us to:

• tell you what personal data we hold about you and how it is used, and who it has been shared with;
• correct, complete or update it;
• erase it, and withdraw your consent;
• name someone to exercise these rights for you if you die or become unable to.

You can download what we hold about you at any time from Settings → Your data → Download my data, and delete your account there. For anything else, write to avinash217k@gmail.com. We answer within 30 days. If you are not satisfied with our answer you may complain to the Data Protection Board of India.

Grievance officer: Avinash Singh, avinash217k@gmail.com.

9. The people who use your applications

If your application collects personal data from its own users, you decide how that data is used and are responsible for it. We store and process it only to run your application, as described here, and do not use it for anything else.

10. Children

The Service is not for anyone under 18, and we do not knowingly collect their personal data.

11. Changes

We may update this policy. The date at the top shows the latest version; for significant changes we will give notice on the site before they take effect. See also the Terms of Service.