Legal
Privacy Policy
This policy explains what personal data qhost collects when you use qhost.dev, the dashboard, the API and the CLI, what we do with it and the choices you have. We collect only what we need to run the service, and we don't sell personal data.
What we collect
| Data | Examples | Where it comes from |
|---|---|---|
| Account | Name, email address, password (stored only as a bcrypt hash), passkeys and two-factor settings | You, when you sign up and manage your account |
| GitHub connection | GitHub username, avatar, access tokens and the repositories you choose to deploy | GitHub, when you connect your account or install the qhost GitHub App |
| Billing | Plan, invoices, billing country and the last digits and brand of your card | Stripe; we never see or store full card numbers |
| Usage and operations | Deployments, resource usage (CPU, memory, storage, network), activity and audit logs, notifications and emails we send you | Generated as you use the service |
| Technical data | IP addresses, browser user agent, request logs of the dashboard and of the HTTP traffic to your apps | Collected automatically by our servers and network providers |
| Support | Messages you send us and anything you attach | You |
How we use it
- To provide the service: create and secure your account, build and run what you deploy, show logs and metrics, send the notifications you subscribe to. (Performance of our contract with you.)
- To bill you: calculate usage, charge your plan and keep invoices as tax law requires. (Contract and legal obligation.)
- To keep qhost safe: detect and stop abuse such as mining, spam and attacks, rate limit logins, investigate incidents and keep an audit trail of administrative actions. (Our legitimate interest in protecting the platform and our customers.)
- To talk to you: service and security emails, billing notices, and answers to support requests. You can turn off optional notification emails in Account settings.
- To improve qhost: aggregate, non-identifying statistics about how features are used.
We don't use your data for advertising, we don't sell it, and we don't build profiles of you.
Your content
The code, data and files you deploy, and any personal data your applications handle, belong to you. For that data you are the controller and qhost acts as your processor: we handle it only to run the service on your instructions, as described in the Terms of Service. Our automated abuse detection looks at process names, network destinations and build files, not at the contents of your databases, volumes or requests.
Who processes it
We share personal data only with providers that help us run qhost, under agreements that require them to protect it, or when the law requires it.
| Provider | Purpose |
|---|---|
| Hostinger | Servers that run the platform and your workloads |
| Cloudflare | DNS, network proxy and TLS, the website, and sending email |
| Stripe | Payments, subscriptions and invoices |
| GitHub | Sign-in with GitHub and access to the repositories you deploy |
Some of these providers process data outside your country, including in the United States. Where required, transfers rely on the safeguards the law provides, such as standard contractual clauses.
How long we keep it
- Account data: while your account exists. When you delete it, we delete or anonymize it within 30 days, except what we must keep by law.
- Workspaces suspended for non-payment: projects, databases and volumes are kept for 30 days, then permanently deleted.
- Resource metrics: about 8 days. Deployment and request logs: kept for a limited period and rotated.
- Invoices and billing records: as long as tax law requires (usually 5 years).
- Security and audit logs: up to 12 months, longer if needed to investigate abuse or as required by law.
- Backups are overwritten on a rolling basis, so deleted data can remain in them for a short period.
Your rights
Depending on where you live, including under Brazil's LGPD and the EU and UK GDPR, you can ask to access, correct, export or delete your personal data, object to or restrict some processing, and withdraw consent where we rely on it. Most of this you can do yourself in Account settings; for anything else write to [email protected]. We answer within 15 days. You can also complain to your data protection authority, such as the ANPD in Brazil.
Cookies
The dashboard uses only essential cookies: a session cookie that keeps you signed in and a short-lived cookie for the administrator area. They are HttpOnly and Secure, and we don't use advertising or third-party tracking cookies. The website at qhost.dev sets no cookies.
Security
We protect data with encryption in transit (TLS) and at rest for secrets, isolated workloads, firewalls and strict access controls. Read more on our Security page.
Children
qhost is not meant for anyone under 18, and we don't knowingly collect their data.
Changes
We may update this policy. The date at the top shows the current version, and we email account owners about significant changes before they take effect.
Contact
Questions or requests about privacy: [email protected].