Privacy Policy

Last changed September 8, 2026. Terms of Service · Privacy Policy

In one paragraph. We collect what we need to run your workspace: your email, a password we store only as a hash, the name of your workspace, and whatever you put in your tools. Payments go through Stripe; we never see your card number. We do not sell data, run ads, or use tracking scripts. Your tools live on our servers in New York, backed up nightly for 30 days. You can export or delete everything yourself.

What we collect

• Account. Email address, a hashed password, your workspace names, the keys your agent uses (stored hashed), and when you last signed in.
• Referrals. Your referral code, which workspaces used it, and the earnings we owe and have paid you, with the payout reference.
• Money. A Stripe customer ID and the last four digits and brand of your card, so you can recognise it. Stripe holds the card itself. Your balance and a ledger of every charge and top-up.
• Your tools. The source code, database, files and settings of each tool, and its nightly backups. This may include personal data about the people who use the tool; you decide what goes in.
• People you share with. Their email address, the level you gave them, and their own hashed password once they set one.
• Domains. Domain names you buy through us and their DNS records. The registrar records our contact details on the domain so yours stay private.
• Logs. Our servers and your tools write logs (requests, errors, deploys) that include IP addresses and timestamps. We keep them for a short time for debugging and security, typically days, and an audit trail of actions in your workspace (who deployed, shared, or bought what) for as long as the workspace exists.
• Email. When we send an email on your behalf (a share, an invite, a request), we record that it was sent, to whom, and whether it bounced.

We do not collect analytics about your browsing, and there are no third-party scripts on our pages.

How we use it

To run the Service: sign you in, host and back up your tools, meter and charge your balance, send the emails you trigger, register domains, answer your questions, and keep the Service safe from abuse. We do not sell it and do not use it to advertise to you.

Who else sees it

Only the companies that help us run the Service, each under its own privacy terms and only for that purpose: DigitalOcean (servers and backup storage, New York), Stripe (payments), Resend (sending email), Porkbun (domain registration), and Let's Encrypt (HTTPS certificates). We share data with the law only when the law requires it, and we tell you when we are allowed to.

The people who use your tools

If you build a tool that holds data about other people, you are responsible for that data under whatever privacy law applies to you, and we process it on your instructions. We keep each tool's database separate from every other tool's. If you need a data processing agreement, ask.

Cookies

We set only the cookies that keep you signed in: one on boathousecloud.com for your account, and one on each tool's own address. They last up to a year and hold a random session ID, nothing else. Signing out removes them. No advertising or tracking cookies.

Where it lives and for how long

Your data lives on servers in New York, United States, and in backup storage there. Tools and their data stay as long as your workspace exists. When you delete a tool with purge, its data is removed at once and leaves the backups within 30 days. When a workspace closes, we remove its data 30 days later. Logs are kept for days, not months.

Your rights

Wherever you live, you can see, export, correct or delete your data: bh export gives you a tool as one file, your account page shows what we hold, and an email to us does the rest, usually within a week. If you are in the European Union, United Kingdom, or California, you also have the rights those laws give you, and you can ask us to explain how we handle a specific case.

Security

Everything travels over HTTPS. Passwords and keys are stored hashed; secrets you give a tool are encrypted at rest. Each tool runs in its own container with its own database. Access to our servers is by key only. If we ever learn of a breach that affects you, we tell you promptly.

Children

The Service is for businesses and adults. We do not knowingly collect data from anyone under 18.

Changes

If this policy changes in a way that matters, we email the address on your account before it takes effect.

Contact

allen@boathousecloud.com, or Boathouse Cloud, Boston, Massachusetts.