Privacy Policy (draft)

Draft. Not legal advice. This document describes what the Setup software does with data today. It has not been reviewed by a lawyer and must be reviewed before launch. Text in [square brackets] is a placeholder.

Setup is operated by [Company legal name], [Registered address] ("we"). This policy covers the Setup website, the web app and the runners that execute recipes. Questions and requests go to [Privacy contact email].

What we store

Your account

Accounts are managed by Better Auth, an open-source authentication library that runs inside our app. We store:

• your name, email address and whether you confirmed it
• a hash of your password, if you use one. We never store the password itself.
• passkeys (only the public key) and two-factor settings, if you turn them on
• your profile picture, if you upload one
• the workspaces you belong to, your role in each, and invitations you send or receive, including the invited email address
• for each signed-in session, the IP address and browser user agent. Sessions end when you sign out or they expire.

Analyses, projects, deployments, logs and runners created in a workspace are visible to every member of that workspace. Those created in your personal workspace are visible only to you, with one exception: our administrators can view accounts and can temporarily sign in as a user to investigate a problem. [Decide and document when administrators may do this.]

If you sign in with Google, GitHub or Apple, that provider sends us your name, email address, profile picture and an account ID. We only offer providers that are configured on this instance.

What you paste

When you paste a link or describe what you want, we store that input together with the result of the analysis: the steps it went through, any warnings, and the recipe it produced.

To analyze a public source, Setup fetches it as data. A GitHub repository is downloaded as an archive and read in memory. A Hugging Face Space is read through its public API. A docs page is read as text. Nothing from the source is installed or executed on our servers. We keep the project details we derive (name, description, license, star count, topics) and the recipe. We do not keep a copy of the repository.

Recipes and projects

We store every revision of a recipe and who created it. Projects you create are private by default. You can make a project unlisted or public; a public project, its recipes and its verification results appear in the public catalog.

Deployments

When you run a recipe, we store the deployment's name, the runner it was assigned to, its status and URL, and the values you entered for its inputs.

• Ordinary inputs, such as an admin email address, are stored as entered.
• Inputs marked as secret, such as passwords and API keys, are encrypted with AES-256-GCM before they are stored. They are decrypted only to hand them to the runner that executes your deployment.

While a deployment runs, the runner sends us:

• progress events (preparing, pulling, starting, checking and so on)
• the log output the software writes to stdout and stderr. Software can print anything, including data you entered into it, so treat logs as potentially sensitive.
• health checks (HTTP status code and response time) and CPU and memory usage
• for each backup, its size, checksum and storage location, but not the backup itself

Data inside the software you run

The software you start keeps its own data in volumes on the runner. On a runner you host yourself, that data stays on your hardware. On a runner we host, it is stored at [Hosting provider and region]. We do not receive the contents of these volumes.

Runners

For each runner we store its name, version, hardware capabilities (CPU, memory, GPU, architecture) and when it last checked in. A runner's access token is shown to you once. We store only a SHA-256 hash of it and a short prefix to help you recognize it.

Contact form

If you use the contact form, we receive your name, email address and message by email.

Email

We send only transactional email: address confirmation, one-time sign-in codes, password resets, email changes, account deletion confirmations and workspace invitations. Email is delivered through [Email delivery provider]. We do not send newsletters.

Analytics and error tracking

None are active by default. The app supports PostHog for product analytics and error tracking, but it stays off unless an analytics key is configured, and even then it only runs after you allow "Analytics" in the cookie preferences. When it runs and you are signed in, PostHog receives your user ID, name and email address so events can be linked to your account. See the Cookie Policy.

Who else receives data

• [Hosting provider] runs our servers and database.
• [Email delivery provider] delivers the email listed above.
• Stripe, if you buy a paid plan, processes your payment. We receive a customer ID and the status of your subscription and orders, not your card number.
• An AI model provider ([Model provider]), if this instance has one configured, receives excerpts of the public source being analyzed so it can draft a recipe. It does not receive your account details.
• GitHub and Hugging Face receive our requests for the public sources you paste. They see our servers, not your account.
• PostHog, only as described under analytics.

We do not sell personal data. We may disclose data when the law requires it.

How long we keep it

• Trial deployments expire after 60 minutes by default. The runner then removes their containers and volumes.
• Deleting a deployment removes its containers and volumes on the runner. Its database records and logs are kept for [Retention period].
• Deleting your account deletes your sessions, analyses, deployments and their logs from our database. Projects and recipes you created are kept, without the link to your account, and public ones stay in the catalog.
• Backups are kept for [Backup retention period].

[Retention periods for logs, health samples, backups and server access logs need to be decided. Confirm that deleting an account first destroys its running deployments on the runners, and decide whether its private projects should be deleted too.]

Security

Passwords and runner tokens are stored only as hashes, and secret inputs are encrypted. The sandbox that runs your software, and the gaps we know about, are described on the security page.

Your rights

You can change your name, email address and password, and delete your account, from your account settings. For anything else, such as a copy of your data, write to [Privacy contact email]. Depending on where you live, you may have further rights, including to object to processing or to complain to a data protection authority.

[The legal basis for each kind of processing, the applicable law and any required representative depend on the jurisdiction and must be filled in.]

Children

Setup is not meant for people under [Minimum age].

Changes

We will post changes to this policy on this page and update the date below.

Last updated: [Date].