Privacy Policy
1. Information we collect
We collect account email addresses, password hashes, session records, app names, source archives, environment variables, sharing rules, deployment logs, usage totals, request timestamps, hashed email verification tokens, and basic security logs such as IP address and user agent.
2. How we use information
We use information to authenticate users, build and operate apps, enforce permissions and quotas, prevent abuse, diagnose failures, maintain security, communicate service changes, and improve the product.
3. Code and secrets
Source code is stored and processed on our infrastructure. Environment-variable values are encrypted at rest and injected only into the selected workload. Do not upload source archives containing credentials; use the environment-variable control instead.
4. Sharing
We disclose information to infrastructure providers as necessary to operate the service, when required by law, to protect users or the service, or in connection with a corporate transaction. We do not sell personal information or use submitted source code to train general-purpose AI models. If the operator enables AI-assisted build recovery, a bounded file listing and selected project excerpts may be sent to the configured model provider only after normal deployment fails; the deployment record identifies when this path was used. Amazon Simple Email Service processes account email addresses to deliver verification messages.
5. Retention
We retain account and app data while your account is active and as reasonably needed for security, legal compliance, backups, and dispute resolution. Email verification links expire after 24 hours and cannot be reused. Deleting an app removes its active container and source working directory; limited backup copies may persist temporarily.
6. Security
We use transport encryption, password hashing, access controls, workload isolation, resource limits, and restricted network paths. No method of storage or transmission is completely secure.
7. Your choices
You may delete apps from the dashboard. To request account access, correction, export, or deletion, contact privacy@getsmall.dev. Rights may vary by location.
8. Children
The service is not directed to children under 13, and we do not knowingly collect their personal information.
9. International processing
Information may be processed in the United States and other locations where our providers operate. Those locations may have different data-protection laws.
10. Changes and contact
We may update this policy and will revise the effective date. Questions may be sent to privacy@getsmall.dev.