Privacy Policy

Last updated: July 31, 2026

This Privacy Policy explains what personal data DeployYourApp collects, why we collect it, how long we keep it, who we share it with, and what rights you have. It covers the deployyour.app website, the DeployYourApp dashboard, the API and CLI, and the DeployYourApp Capacitor plugin and Electron updater (together, the "Service").

We have written this document to describe what our software actually does. Where we do not have a capability, a certification, or a retention job in place, we say so rather than implying otherwise.

1. Who We Are (Data Controller)

The controller responsible for the personal data described in this policy is:

DeployYourApp
[Legal entity name and registered address — TO BE COMPLETED]
Company registration number: [TO BE COMPLETED]
Privacy contact: info@deployyour.app

We have not appointed a Data Protection Officer. We are not required to under Article 37 GDPR: we are not a public authority, our core activities do not consist of large-scale regular and systematic monitoring of data subjects, and we do not process special categories of data at scale. Privacy enquiries go to info@deployyour.app.

EU / UK Representative (Article 27 GDPR)

Our representative in the European Union is: [EU representative name and address — TO BE COMPLETED].

Our representative in the United Kingdom is: [UK representative name and address — TO BE COMPLETED].

2. Two Different Roles: Controller and Processor

DeployYourApp handles two distinct kinds of data, and our legal role differs between them:

Your account and organization data — we are the controller. This is the data described in Sections 3.1 to 3.4 below, about you as our customer.
Your end users' device and analytics data — we are a processor. When your app uses our plugin or Electron updater, our servers receive data about your end users' devices. You are the controller of that data; we process it on your instructions in order to deliver updates and analytics to you. Section 3.5 describes exactly what we receive. Our Data Processing Agreement governs that processing.

If you are the end user of an app built by one of our customers, we are not the controller of your data. Please contact the developer of that app to exercise your rights. We will assist them in responding.

3. What We Collect

3.1 Account Information

Name and email address.
Password, stored only as a salted cryptographic hash produced by our authentication library. We never store or log plaintext passwords.
If you sign in with Google, GitHub, or Microsoft, we receive your name, email address, and provider account identifier from that provider.
If you enable two-factor authentication, we store your TOTP secret and backup codes in encrypted form (AES-256-GCM) and a flag recording that 2FA is enabled.
Organization name, your role within each organization, and team invitations you send or accept.
API keys you create. We store only a SHA-256 hash of the key plus a short display prefix; the full key is shown once at creation and cannot be recovered by us.

3.2 IP Address and User Agent

Your IP address and browser or CLI user agent are processed in the following specific places. We are calling these out individually because they are the least obvious part of what we hold:

Audit log. Every audited action in your organization (deployments, channel changes, member changes, key creation and revocation, bundle deletion, and similar) is recorded with the acting user's ID, the IP address the request came from, and the user agent string, plus a timestamp. Organization owners and admins can view and export this log from the dashboard.
Security notification emails. When your password is changed or reset, or two-factor authentication is enabled or disabled, we email you a notice. That email includes the IP address and user agent of the request that made the change, so you can recognise activity that was not you. The email is sent to your account address through our email provider (Section 6).
Rate limiting and server logs. Request IP addresses are used to enforce per-endpoint rate limits and appear in operational server logs.

3.3 Service Usage Metrics

Bandwidth served, storage consumed, active device counts, and build minutes, aggregated per organization for plan-limit enforcement and billing.
Records of apps, channels, bundles, deployments, and builds you create, including bundle metadata (version, size, checksum, release notes).

3.4 Payment Information

Payments are processed by Stripe. Card numbers are entered directly into Stripe and never reach our servers. We store your Stripe customer and subscription identifiers, plan, subscription status, trial state, billing email, and invoice history metadata.

We also store a SHA-256 hash of your email address in a trial ledger when your organization consumes a free trial. This lets us enforce the one-trial-per-customer rule even after an account is deleted. The ledger stores only the hash — no name, no plaintext address, and nothing else.

3.5 Device Data From Your End Users

When an app that embeds our Capacitor plugin or Electron updater checks for an update (POST /api/update), our server stores the following device record:

Device identifier — a random UUID generated on the device by our SDK on first run. It is not an advertising ID, IDFA, GAID, MAC address, or hardware serial, and it is not derived from any hardware identifier.
Platform — for example ios, android, electron-windows, electron-macos, electron-linux.
Native app version — the version of the app binary installed from the store or installer.
SDK version — the plugin or Electron updater version.
CPU architecture — for example x64 or arm64, where the SDK reports it.
First seen and last seen timestamps, and the set of update channels the device is subscribed to.

The device also transmits its currently installed bundle version so the server can decide whether an update applies. We do not store that value on the device record.

What we do not store. Our Android SDK additionally transmits the operating system version and the device manufacturer and model in the update-check request. Our server validates the request against a strict schema that does not include those fields, so they are discarded and never written to the database. A previous version of this policy stated that we collect operating system and version; that was inaccurate and has been corrected. We also do not collect precise or coarse geolocation, contacts, photos, advertising identifiers, or the contents of your end users' app data.

3.6 Analytics Events From Your End Users

Our SDKs also send batched analytics events (POST /api/stats). This was not disclosed in previous versions of this policy. For each event we store:

Event type — a string, for example page_view, error, or an update lifecycle event such as update_download_complete.
Event data — an arbitrary JSON object supplied by the app. Its contents are entirely determined by the app developer. Depending on what the app sends, this can include in-app screen paths and titles, error messages, and stack traces.
Bundle version at the time of the event.
Timestamp, and the device identifier the event came from.

Update lifecycle events are additionally recorded in a structured table with the bundle and deployment identifiers, a failure reason, download duration and byte count, and any error message, so that developers can diagnose failed rollouts.

Analytics collection is enabled by default in our SDKs (analyticsEnabled defaults to true). App developers can turn it off by setting analyticsEnabled: false in the plugin or updater configuration. Developers using our SDKs are responsible for disclosing this collection in their own privacy policy and for obtaining any consent their jurisdiction requires. The full field-by-field breakdown is published in our SDK data collection documentation (docs/security/sdk-data-collection.md), and summarised in the README of each SDK package.

4. Why We Process It, and Our Legal Basis (Article 6 GDPR)

Purpose	Data used	Legal basis
Creating and running your account; authenticating you; providing the dashboard, API, CLI, storage, and update delivery	Account information (3.1), usage metrics (3.3)	Performance of a contract — Art. 6(1)(b)
Billing, invoicing, plan enforcement, and trial management	Payment information (3.4), usage metrics (3.3)	Performance of a contract — Art. 6(1)(b)
Retaining invoices and tax records	Billing records	Legal obligation — Art. 6(1)(c)
Transactional and administrative email (verification, password reset, invitations, plan-limit warnings, billing notices)	Name, email address	Performance of a contract — Art. 6(1)(b)
Security notification emails for password and 2FA changes, including the IP and user agent of the change	Email address, IP address, user agent	Legitimate interests — Art. 6(1)(f): letting you detect account compromise
Audit logging of organization activity	User ID, IP address, user agent, action metadata	Legitimate interests — Art. 6(1)(f): accountability, security, and giving our customers the audit trail their own compliance requires
Rate limiting, abuse detection, and platform security	IP address, request metadata	Legitimate interests — Art. 6(1)(f): keeping the Service available and secure
Preventing trial abuse (hashed-email trial ledger, and blocking a device install base from being recycled into a new trial organization)	SHA-256 email hash, device identifier and last-seen date	Legitimate interests — Art. 6(1)(f): preventing fraudulent use of paid services
Responding to support requests	Whatever you include in your request	Performance of a contract — Art. 6(1)(b), and legitimate interests — Art. 6(1)(f)
Delivering updates to your end users' devices and returning analytics to you	Device data (3.5), analytics events (3.6)	Processed on your documented instructions as your processor — Art. 28. You are responsible for identifying a legal basis for this processing in your own privacy notice

We do not currently send marketing email and we do not build marketing profiles. If we introduce marketing communications, they will be sent only with your consent under Art. 6(1)(a), and every message will carry an unsubscribe link.

We do not carry out automated decision-making that produces legal or similarly significant effects within the meaning of Article 22 GDPR. The trial and device-reuse checks described above are automated rules that can block a free trial; they never affect a paid subscription, and you can reach a human at info@deployyour.app to have any decision reviewed.

5. How Long We Keep It

These are the retention periods actually enforced by our systems. Where a period is enforced by an automated job we say so; where deletion happens only on your request or on account closure we say that instead.

Data	Retention
Account and organization data	For as long as your account is open.
Deleted account (personal data)	Removed within 30 days of a confirmed deletion request. See Section 8.
Deleted organizations	Marked deleted immediately and hidden from the Service, then permanently purged by an automated job approximately 6 months (183 days) later, together with all bundle objects in storage. During that window the organization's app identifiers stay reserved and deletion does not reset trial eligibility.
Deleted bundles	The stored bundle object is removed from object storage at the moment you delete the bundle, and the database record is deleted in the same operation.
Trial ledger (SHA-256 email hash)	Retained indefinitely, including after account deletion. This is the only record that survives account deletion, and it contains nothing but a one-way hash. Its sole purpose is enforcing one free trial per customer.
Audit logs	Retained for the life of the organization. We do not currently run an automatic expiry job for audit logs; they are deleted when the organization is purged.
Device records and analytics events	Retained for the life of the organization. We do not currently run an automatic expiry job for these. Deleting an app is a soft delete and does not erase them: they are erased when the organization is deleted and its 6-month purge runs. There is no self-serve way to delete an individual device record today; email info@deployyour.app with the device identifier and we will delete it manually. If you need a shorter retention period for your end users, contact us to arrange it.
Billing and invoice records	Retained for as long as applicable tax and accounting law requires, typically [retention period per governing jurisdiction — TO BE COMPLETED]. Stripe retains its own copy under its own policy.
Operational server logs	[Log retention period — TO BE COMPLETED once the hosting provider's log configuration is fixed]

6. Who We Share It With

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We use the following sub-processors:

Processor	Purpose	Data
Stripe	Payment processing, subscription billing, invoicing	Name, billing email, payment card details (collected directly by Stripe), subscription and invoice data
Resend	Transactional email delivery (verification, password reset, invitations, billing and security notices)	Recipient email address, name, and the message content — which for security notices includes the IP address and user agent described in Section 3.2
[Hosting provider — TO BE COMPLETED]	Hosting of the application servers, PostgreSQL database, Redis, and object storage	All data described in this policy, as it resides on the infrastructure

Bundle storage runs on MinIO, which we operate ourselves on the same infrastructure as the rest of the Service. It is not a separate third-party provider and no additional company receives your bundles through it.

A current list is maintained at deployyour.app/subprocessors. We will publish notice of any new or replacement sub-processor on that page before it begins processing customer data.

We may also disclose personal data:

to law enforcement or other authorities where we are compelled by valid legal process, and where we are legally permitted to do so we will notify the affected customer first;
to professional advisers (lawyers, accountants, auditors) bound by confidentiality;
to an acquirer in connection with a merger, acquisition, or sale of assets, in which case we will notify you before your data becomes subject to a different privacy policy.

7. International Transfers

Our infrastructure is hosted in [hosting region — TO BE COMPLETED]. Stripe and Resend are established in the United States and process data there and in other countries where they operate.

Where personal data is transferred out of the European Economic Area, the United Kingdom, or Switzerland to a country that has not received an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (Decision 2021/914), together with the UK International Data Transfer Addendum for UK transfers, as the transfer mechanism in our agreements with those processors. Where a processor is certified under the EU-US Data Privacy Framework, we rely on that certification as an alternative mechanism for transfers to that processor.

You can request a copy of the relevant transfer safeguards by emailing info@deployyour.app.

8. Your Rights Under the GDPR and UK GDPR

If you are in the EEA, the UK, or Switzerland you have the right to:

Access the personal data we hold about you and receive a copy (Art. 15).
Rectify inaccurate or incomplete data (Art. 16). Name and email can be corrected directly in Settings.
Erase your data (Art. 17), subject to the trial-ledger hash described in Section 5.
Restrict processing in the circumstances set out in Art. 18.
Data portability — receive your data in a structured, commonly used, machine-readable format (Art. 20).
Object to processing based on our legitimate interests, on grounds relating to your particular situation (Art. 21).
Withdraw consent at any time where we rely on consent, without affecting processing carried out before withdrawal (Art. 7(3)).

How to exercise them

You can delete your own account: go to Settings > Profile in the dashboard and request deletion. We send a confirmation link to your account email address; once you confirm, your personal data is removed within 30 days. The hashed trial record described in Section 5 is retained for fraud prevention.

For any other request, email info@deployyour.app. We respond within one month of receiving your request, and may extend that by two further months for complex requests, in which case we will tell you within the first month. We do not charge a fee unless a request is manifestly unfounded or excessive. We may ask you to verify your identity before acting.

Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU or EEA Member State of your habitual residence, place of work, or the place of the alleged infringement (Art. 77 GDPR). In the United Kingdom the supervisory authority is the Information Commissioner's Office (ico.org.uk). A list of EEA authorities is published by the European Data Protection Board (edpb.europa.eu). Our lead supervisory authority is [lead supervisory authority — TO BE COMPLETED once the EU representative is appointed]. We would appreciate the chance to address your concern first, but you are not required to contact us before complaining.

9. California Privacy Rights (CCPA / CPRA)

This section applies to California residents and uses the definitions of the California Consumer Privacy Act as amended by the CPRA.

Categories of personal information we collect

Statutory category	What we collect	Source	Purpose
Identifiers	Name, email address, account ID, IP address, SDK-generated device identifier	You; your end users' devices via our SDK; single sign-on providers	Providing the Service, security, billing
Commercial information	Plan, subscription and trial status, invoice and payment history	You and Stripe	Billing and plan enforcement
Internet or other electronic network activity information	User agent, audit log of actions taken in the dashboard and API, analytics events sent by apps using our SDK	Your use of the Service; your end users' devices via our SDK	Security, accountability, delivering analytics to our customers
Professional or employment-related information	Your role within an organization, if you tell us	You	Access control and support

We do not collect biometric information, precise geolocation, sensory data, education records, or protected classification characteristics. We do not collect or process "sensitive personal information" for the purpose of inferring characteristics about a consumer. We do not knowingly collect personal information from anyone under 16, and we therefore do not sell or share the personal information of minors.

Sale and sharing

We have not sold personal information, and we have not shared personal information for cross-context behavioural advertising, in the preceding 12 months, and we do not do so today. Because we do not sell or share, we do not offer a "Do Not Sell or Share My Personal Information" link; there is nothing for it to opt you out of. Disclosures to the service providers listed in Section 6 are made under written contracts that prohibit them from retaining, using, or disclosing the information for any purpose other than performing the service.

Your California rights

Right to know the categories and specific pieces of personal information we have collected, the sources, the business purpose, and the categories of third parties to whom we disclose it.
Right to delete personal information we have collected from you, subject to the statutory exceptions (including our need to retain the hashed trial record to detect and prevent fraudulent activity).
Right to correct inaccurate personal information.
Right to opt out of sale or sharing — not applicable, as we do neither.
Right to limit use of sensitive personal information — not applicable, as we do not use sensitive personal information for inferring characteristics.
Right to non-discrimination for exercising any of these rights. We do not deny service, charge different prices, or provide a different level of service because you exercised a privacy right.

To exercise these rights, email info@deployyour.app, or use the self-serve deletion flow in Settings > Profile. We will confirm receipt within 10 business days and respond within 45 days, extendable by a further 45 days where reasonably necessary. We verify requests against the email address on the account. An authorized agent may submit a request on your behalf with written permission signed by you, and we may still ask you to verify your own identity directly.

10. Security

The technical and organisational measures we actually have in place:

TLS encryption for all data in transit between clients, our API, and our storage.
AES-256-GCM encryption of sensitive stored fields, including two-factor secrets and backup codes.
Passwords stored only as salted hashes; API keys stored only as SHA-256 hashes.
Role-based access control within organizations, and permission checks on every API route.
Rate limiting on public endpoints, including the unauthenticated update and analytics endpoints.
Audit logging of privileged actions.
Optional two-factor authentication via TOTP.
Mandatory RSA-4096 signature verification of every update bundle on the end user's device, plus a per-file SHA-256 manifest checked during extraction. Bundles are not encrypted — they are plain, signed archives — and your signing private key never leaves your machine.

We do not hold a SOC 2, ISO 27001, PCI DSS, or HIPAA certification or attestation. We do not claim one, and you should not represent to your own customers that we hold one. Card data is handled entirely by Stripe, which maintains its own PCI compliance. No system is perfectly secure; we cannot guarantee that our security measures will prevent every unauthorised access.

Our breach handling process, including how we notify customers when we are acting as their processor, is documented in our incident response policy (docs/security/incident-response.md). A copy is available to customers on request from info@deployyour.app.

11. Cookies and Local Storage

We use only strictly necessary cookies and browser storage. There are no analytics cookies, no advertising cookies, and no third-party scripts or tags anywhere on the website or in the dashboard. That is why you do not see a cookie banner: strictly necessary storage is exempt from consent under Article 5(3) of the ePrivacy Directive.

Name	Type	Set by / on	Duration	Purpose
`dya.session_token`	HTTP cookie	Our authentication library, on the API origin	7 days, refreshed at most once every 24 hours of active use	Keeps you signed in. Without it you would have to re-enter your password on every request.
Two-factor verification cookie	HTTP cookie	Our authentication library, on the API origin	Short-lived; expires as soon as the 2FA challenge is completed or abandoned	Identifies you between entering your password and entering your 2FA code, when no session exists yet.
`dya_token`	localStorage	The dashboard, in your browser	Until you sign out or clear site data	Holds your session token so the dashboard can authenticate cross-origin API calls.
`dya_active_org`	localStorage	The dashboard, in your browser	Until you sign out or clear site data	Remembers which organization you last had selected.

Signing out removes the localStorage entries and invalidates the session. If we ever introduce non-essential cookies, we will ask for your consent first and update this policy before doing so.

Separately, our SDKs store a generated device identifier and channel preference in local storage on your end users' devices. That is first-party storage inside your app, not a cookie on our website; it is described in Section 3.5 and in the SDK documentation.

12. Children's Privacy

The Service is a developer tool and is not directed to children. You must be at least 16 to hold an account. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal data, contact info@deployyour.app and we will delete it promptly.

13. Changes to This Policy

We may update this policy. When we make a material change we will notify account holders by email and post a notice in the dashboard at least 30 days before it takes effect, except where a change must take effect sooner to comply with law. The "last updated" date at the top of this page always reflects the current version.

14. Contact

Privacy and data protection: info@deployyour.app
Security reports: info@deployyour.app
Legal: info@deployyour.app
General support: info@deployyour.app
Postal address: [Registered address — TO BE COMPLETED]

Related documents: Data Processing Agreement, Sub-processors, Terms of Service.