Privacy Policy

• Account data — your name, email address, and the SSH public key you save. Required to operate your account and your container.
• Payment data — we do not see or store your card number. Card payments are processed by Stripe (checkout and billing portal); we store only Stripe's customer/subscription references and the amounts paid. Manual payment submissions (receipt images, transaction IDs) are stored only until an admin approves or rejects them — the receipt images are then deleted, and only the transaction reference stays on your record.
• Technical data for security & abuse handling — your IP address, approximate country, browser type/OS/device, and the times you log in. We use this to protect the service, spot abuse, and respond to reports.
• Support & abuse messages — anything you send us through the support form.

To provide the service (provisioning your container, the key door, billing), to keep it secure (rate limiting, fraud and abuse prevention), to communicate with you about your account (welcome email, payment warnings), and to comply with legal obligations. We never sell, rent, or trade your data.

• Stripe — payments and subscription billing. Their privacy policy applies to the payment data they process.
• Resend — transactional email (welcome, payment warnings).
• Cloudflare — the site and key door are fronted by Cloudflare; they see network-level metadata (IP, TLS) like any CDN.
• Law enforcement / abuse escalation — where required by law, or where we reasonably believe an account is engaged in ongoing severe abuse (see the Terms, section 2).

We do not sell or rent your data, and we do not use it for advertising.

• Account data — until you ask us to delete your account.
• Payment records — as required by tax/accounting law (typically several years).
• Visit/log data (IP, country, browser) — up to 1 year, pruned automatically.
• Container data — deleted when the container is destroyed.

Passwords are stored hashed (Argon2). Session tokens live in HttpOnly cookies that JavaScript cannot read. Container access is by SSH key only. Your home network IP is never exposed to the internet: all container and host egress routes through our tunneled infrastructure, and customer containers sit on an isolated bridge where they cannot reach each other.

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. EU/EEA residents — see the GDPR notice. To exercise any right, use the support form or email the address on the support page; we respond within 30 days.

Questions about this policy: use the contact page. For data requests, please mention "data request" in the subject so we can route it correctly.