Privacy Policy

Cloady is a cloud application platform operated by NeptoLab LLC ("we", "us"). This policy explains what data we collect when you use cloady.com and the services deployed through it, why we collect it, and the choices you have. Questions go to hello@cloady.com.

• Account data — your email address and display name. We also keep your security preferences. If you sign in with Google or GitHub, we receive your name, email, and avatar from that provider; we never see your password for those accounts.
• Billing data — payments are processed by Stripe. We store a reference to your Stripe customer and subscriptions; card numbers never touch our servers.
• Workspace and application metadata — workspace names, members, application configuration, environment variables (values you mark as secret are encrypted at rest), domains, and deploy history.
• Your deployed content — the code, containers, and data volumes of applications you deploy. This is your content; we host it and access it only to operate the platform or when you ask us to help.
• Integration tokens — if you connect the GitHub App, we store the grant needed to list repositories and clone the ones you deploy.
• Operational logs — build logs, container status, and request logs needed to run and debug the platform.
• Support and AI requests — messages, attachments you supply, AI responses, and the application context needed to answer your request. AI support conversations are saved as support tickets that our support team can read.
• Connected assistants — OAuth grants, token identifiers and scopes, creation and last-used timestamps, and the tool arguments and results needed to carry out requests from an assistant you connect. We do not receive your entire conversation with that assistant automatically.
• Website analytics — page visits, traffic sources, browser and device information, and completed registrations, measured with Google Analytics. We link these measurements to Google Ads to understand which campaigns bring new users. Our registration event does not include your name, email, or application content.
• Devices — each time you sign in, a random identifier the browser keeps for us, an identifier calculated from its characteristics (a browser fingerprint), the IP address, the browser's user agent, language and device details it reports, and the sign-in method, kept per browser with when it was first and last seen. We use them to protect your account and to detect abuse, such as one person using several free accounts. They are computed on our own pages and are not shared with anyone.

• We don't sell your personal data.
• Our Google Analytics integration disables Google signals and advertising personalization.
• We don't read the contents of your deployed applications except to operate the service, investigate abuse, or at your request.

We use cookies to keep you signed in, and your browser's local storage holds the random identifier that lets us recognize it as the same device, which a short-lived cookie carries to our servers when you sign in. Google Analytics also uses cookies to measure visits and attribute registrations to traffic sources, including Google Ads. A short-lived registration marker lets us record a new account once after it reaches a workspace; the marker is then deleted or expires after one hour. You can control cookies and block analytics through your browser settings.

To provide the service: authenticate you, run your deployments, route traffic to your applications, issue TLS certificates, bill your subscriptions, send transactional email (sign-in links, invitations, alerts), and keep the platform secure and reliable.

When you use Cloady's AI assistance, we send your request, relevant conversation history, and requested application context to the configured provider, OpenAI or Anthropic, to generate a response. Depending on your request and permissions, that context can include application configuration, deployment history, logs, or content you ask the assistant to inspect. Avoid including passwords, API keys, payment card data, or other unnecessary sensitive information in prompts, attachments, or logs.

When you connect Cloady to ChatGPT, Claude, or another MCP client, that client sends tool arguments to Cloady and receives the results of permitted operations. Its provider handles those results under its own privacy policy. OAuth permissions limit the actions available; workspace membership is checked for each workspace request. An account-level OAuth grant can cover every workspace that account can access, not just the workspace currently open.

You can decline a connection, select a narrower scope, and revoke its token in your Cloady account settings. Revocation stops future requests using that token. Disconnecting does not delete your Cloady account, hosted applications, support tickets, or copies already held by the assistant provider; request deletion from the relevant provider separately.

We rely on a small set of providers to run Cloady:

• OpenAI / Anthropic — optional AI assistance and, when you connect their assistants, the tool results you authorize them to receive.
• Cloudflare Turnstile — checks that an email sign-up or password reset comes from a person; receives your IP address and technical information about your browser.
• Email delivery providers — recipients, message content, and delivery information for sign-in codes, invitations, alerts, and support messages.
• Stripe — payments and subscription management.
• Google / GitHub — optional sign-in and the deploy-from-repository integration.
• Google Analytics / Google Ads — website analytics and advertising conversion measurement.
• Infrastructure providers (OVH, Contabo, Hetzner) — the servers your applications run on, located in the region you choose.
• Porkbun — DNS for cloady.io application URLs.

You choose a region for each application. Its running workloads and attached volumes are placed there. This selection is not a promise that every copy of your data remains in that region: backups, control-plane records, support requests, and data sent to providers or connected assistants may be processed elsewhere. Our control-plane infrastructure is in the United States and Europe, and service providers may process data in other countries where they operate. Contact us before deploying data with specific residency requirements.

• Account, workspace, and integration records remain while you use the service, until removed through the dashboard or a verified deletion request. We retain records needed for outstanding billing, disputes, fraud prevention, or legal obligations for the relevant obligation's duration.
• Support tickets and saved AI conversations have no automatic time-based expiry. They remain until a verified deletion request is processed, subject to the exceptions above. Closing a ticket does not delete its messages.
• Deployment history and stored build logs remain with the application record until it is deleted. Runtime logs rotate according to the container and infrastructure configuration; there is no single retention period for all customer workloads.
• Sign-in codes expire after 15 minutes; OAuth authorization codes expire after 10 minutes and are single-use. Expired verification records are removed by periodic cleanup. Expiry is not a guarantee of immediate physical erasure.
• Device records are kept while your account exists and deleted with it.
• Access tokens remain usable until their configured expiry or revocation. Tokens without an expiry remain valid until revoked. Revoked token records can remain in account history until deletion is processed; the stored secret is a one-way hash.
• Unused project uploads become eligible for periodic cleanup after three hours. Uploads attached to an application follow that application's lifecycle.
• Application deletion removes the application record, workloads, and attached data volumes. It does not by itself confirm removal of every separate backup copy.
• Backups use snapshot-count retention: successful backup runs prune older snapshots, keeping the latest seven managed snapshots and one emergency snapshot. This is not a seven-day guarantee. Copies can remain when backup runs stop or an application is deleted; contact support to include backups in a deletion request. Backups are not a guaranteed recovery service for deleted applications.
• Analytics and records held by independent providers follow their configured retention and applicable policies. You can block analytics cookies and request deletion of identifiable data through us or the relevant provider.

Request account or data deletion at hello@cloady.com. We verify your authority, identify affected systems and backups, and respond within 30 days with completion or an explanation of any remaining retention requirement. This response period is not a promise that every provider copy is automatically erased after 30 days.

You can access, correct, export, or delete your personal data. Most of it is directly editable in the dashboard; for anything else, email hello@cloady.com and we'll respond within 30 days. If you're in the EU/EEA or UK, these rights follow the GDPR, including the right to lodge a complaint with your supervisory authority.

The Cloady website, API, and OAuth endpoints use HTTPS. Customer TCP services need their own protocol-level encryption configuration; we do not promise TLS for every workload or internal network hop. Secret environment variables and integration credentials are encrypted at rest, and backup contents are encrypted. Workspaces are isolated from one another at the infrastructure level. API tokens are stored as one-way hashes and can be revoked at any time.

Cloady is not directed to children under 13. If you believe a child under 13 has supplied personal data, contact us so we can investigate and remove it as appropriate.

We'll post any changes to this policy here and update the date above. For material changes we'll notify you by email or in the dashboard before they take effect.