Privacy policy

What we collect

• Account details: name, email and a hashed password, or login with Google or GitHub.
• Card details are typed on the secure page of our payment provider, Cardcom (Israel), which also issues our tax invoices. We do not see or store card numbers; we keep only an encrypted token, the last four digits and the expiry, to charge renewals.
• Technical information from the command line tool: a random install id made on your computer, the tool version, operating system, processor architecture and Node version; each command name and its result (success, blocked or error category); the linked project id, framework and its version; for each check, whether the site is compatible and the blocker and warning codes; and after login, your user id.
• Visits to our own website are counted with Cloudflare Web Analytics, without cookies and without storing IP addresses: the page, the site you came from, the country, the device and the browser, in totals only.
• Free tools (/tools): when you test a site we read the page and its public files (robots.txt, sitemap, llms.txt, security.txt), and keep the address tested and the result for 30 days, and your IP only as a one-way hash, to limit abuse. The page is loaded through Cloudflare, and a speed test goes to Google PageSpeed Insights, which receives the address tested.

What we never collect

• Your source code inside telemetry, file contents, or values from env files and secrets. We receive the code itself only when you deploy a site, in order to build it.
• You can turn telemetry off at any time with npx deployai@latest telemetry off.

Visitors to your sites

• Visit statistics for your sites are collected without cookies and without personal identifiers. To count unique visitors, each page view gets a code made from a random daily key, the IP address, the browser and the site; the key is deleted after two days, so the code cannot be traced back to a person or linked across days or sites, and the IP address itself is never stored. For each page view we keep only: the site, the country (from the network, no city and no precise location), the kind of source (for example Google, Facebook, WhatsApp, direct or another site, never the full address they came from), the page path without parameters, the device class (mobile, tablet or desktop), the browser family (for example Chrome or Safari, no version) and that daily code. We keep a daily summary per site.
• IP addresses are never stored. To protect sites from automatic copying and floods, the IP address is used for a moment to count requests in the Cloudflare network, and it is gone at the end of the short counting period. A blocked request is counted only as a number, with no address.

Emails we send you

• Security and billing emails are always sent, for example verification, password reset and payments.
• Offers and tips are sent only if you have not refused them. You can refuse them at signup, with the unsubscribe link at the bottom of any such email, or in your account settings.
• Every email of our lifecycle (offers, tips and usage alerts such as being close to a plan limit) has an unsubscribe link, and each kind can be turned off in your account settings. Emails about billing and security always arrive.

Temporary sites

• When a site is put online without an account, we keep a one-way hash of the IP address it came from, only to limit how many temporary sites one connection can create. The hash cannot be turned back into the address and is deleted with the site.
• If you ask us to email you the keep link, we keep that one email address with the temporary site, use it only for the link and one reminder 3 days before the site is deleted, and delete it when the site is kept or deleted. If you email yourself the steps from a phone, we send that one email and keep only a one-way hash of your IP address, to limit how many can be sent.

Staff access to your account

When a member of our staff enters your account to help, it is logged, they see a clear banner, and the record says it was the staff member and not you.

Your rights

• You can ask to see, correct or delete your data. Write to us and we will handle it.
• You can delete a site yourself in the dashboard. It goes offline at once and can be restored for 7 days. After that its code, versions, database, files and domains are removed for good. Payment records and invoices are kept as the law requires.