⚠
Draft — not final, not legal advice
This page is placeholder text generated to fill a real gap (no Terms of Service existed at all), not a reviewed legal document. It must be reviewed and finalized by qualified legal counsel before anyone relies on it, before it's presented as binding, and before real customer money or data depends on it.
Privacy Policy
DRAFT — not yet in effect
1. What this covers
This would describe what data openhost.sh collects, why, and how it's handled, once reviewed and adopted. Nothing here is currently a binding privacy commitment.
2. Data this app actually collects today
- Account identity — email and (if used) Google sign-in identity, via Supabase Auth.
- Workspace/usage data — workspace membership, sandbox launch records, run history, audit events, and (as of this pass) basic sandbox usage duration.
- Saved provider API keys — encrypted at rest (AES-256-GCM) in a private Vercel Blob store; resolved server-side only when launching a sandbox, never returned to the browser in plaintext.
- Billing data — handled by Stripe; openhost.sh's own database stores a Stripe customer/subscription id and plan status, not raw card details.
- Operational logs — request logs with automatic redaction of tokens/cookies/credentials/env vars (see the app's own logging configuration).
3. Third parties data is shared with
Supabase (identity, database), Stripe (billing/payments), Vercel (hosting, Blob storage), and the sandbox microVM provider (executes the actual sandbox — receives whatever environment variables/commands a launch specifies). No data is sold to third parties. This list should be reviewed and expanded/formalized by counsel — it is not a subprocessor list in the format a real privacy policy needs.
4. Retention
Placeholder — no formal data retention schedule is defined or enforced yet. Audit logs and stored artifact/credential objects currently have no automatic expiry.
5. Your rights (access, deletion, export)
Account deletion (including cascading data cleanup) exists as a real product feature — see Settings → Danger Zone in the app. A separate, formal data-subject-request process (for jurisdictions that require one, e.g. GDPR/CCPA) is not yet built or documented.
6. Contact
See Security for a security-specific contact point. A general privacy contact is not yet published.