Draft document
Privacy policy
This is written from the schema, not from a template. Every row below exists because something in the code writes it. The short version: we store enough to run your boxes and bill you, and we do not store what you type into them.
- 01 · What we store
- 02 · The terminal
- 03 · What we do not do
- 04 · Why we hold it
- 05 · Third parties
- 06 · Retention
- 07 · Deletion and access
- 08 · Where it lives
- 09 · Age
- 10 · Changes and contact
01 What we store
| When | What is written |
|---|---|
| Registering | Email address, username, display name, and your password after hashing. The password itself is never stored and cannot be read back out. |
| Signing in | A session row: a hash of the session token, the IP address the request came from, the user agent string your browser or the iPad app sent, when it was last used, and when it expires. |
| Creating a box | Its name, hostname, region, size, provider droplet id, public IP address, and the manifest — the list of tools you picked, kept so the box can be rebuilt identically. |
| While a box builds | The setup log, line by line: package installs and their output. Kept so a build that fails can be explained rather than guessed at. |
| Administrative actions | An audit record — who did it, what it was (account created, box created, box destroyed, account suspended), and when. Provisioning spends money and destroying a box loses work, so both have to be answerable afterwards. |
| The waitlist | An email address and the date it arrived. Nothing else. |
| Invites | The code, a note describing who it was for, who created it, and who used it. |
| Resetting a password | A hash of the token in the reset link, when it expires, and whether it has been used. The link itself only ever exists in the email we sent you. |
| Any unauthenticated request | A rate-limit counter keyed on the IP address the request came from, and — on sign-in and password reset — on a hash of the email address in the request body. It holds a count and the start of the window, never the request itself. This is written whether or not the address belongs to an account. |
| Billing once billing ships |
A Stripe customer id, the state of your subscription and which box it covers, and the id of every Stripe event we have already processed so a redelivery is not applied twice. Card numbers go to Stripe directly and never reach our servers. |
02 The terminal
Devpipe does not store the contents of your terminal sessions. Keystrokes and output travel from your browser or iPad straight to your box over a websocket. They do not pass through devpipe.com, and there is no table in our database that could hold them. This is an architectural fact before it is a policy: proxying every keystroke through the control plane would make it a bottleneck and a single point of failure, so we never built that path.
Three things follow from that, and you should know all three.
- It exists on your box. Scrollback is held by the daemon on the machine you rent so you can reattach and find your session where you left it, and anything you or an agent wrote to disk is on that disk. It is not ours, but it is not nowhere.
- Root exists. We administer the machine and can read that disk. We do not, except for the reasons set out in the terms.
- The agent vendors see what you send them. Claude Code, Codex and Gemini send your prompts and files to Anthropic, OpenAI and Google under your own account and their privacy policies. We are not in that path and cannot see it, and we cannot answer for it either.
03 What we do not do
- No analytics, no third-party scripts, no advertising, no session recording. There is no tracker on this page or in the app.
- The app keeps two things in your browser's local storage: your session token, so you stay signed in, and a copy of your own account record — email, username, display name — so a reload can draw the page before the first request answers. Signing out removes both. Nothing else is kept there.
- The web server in front of the app is configured without an access log, so there is no separate record of every page you loaded. Confirm this is still true at launch — turning on request logging would change this sentence.
- We do not sell data. There is nobody to sell it to and nothing worth selling.
04 Why we hold it
- Account details — to sign you in, address email to you, and tell boxes apart. Your username also becomes your box's hostname.
- Session IP and user agent — so you can see the devices signed into your account and end one you do not recognise, and so a compromise can be investigated.
- Box metadata — to run the machine, to bill for it, and to rebuild it identically if you ask.
- Setup logs — to diagnose a build that failed, which is otherwise indistinguishable from one that is slow.
- Audit records — because provisioning costs money and destruction loses work.
- Rate-limit counters — so one machine cannot brute-force sign-in or empty the box budget by registering in a loop. It is the least we can count and still count anything.
Legal bases, if you are in a jurisdiction that asks for them: map each purpose to a lawful basis — contract, legitimate interest, legal obligation.
05 Third parties
- DigitalOcean hosts every box and the control plane. They hold the machine, its disk and its network traffic, and they see the addresses that connect to it. The region you pick decides which country it sits in. Their terms and privacy policy govern that layer.
- Stripe handles payment. They collect your card and billing details directly; we receive a customer id and the state of your subscription.
-
Let's Encrypt issues the certificate for your box's
hostname. Certificate issuance is published in public Certificate
Transparency logs, which means
yourname.devpipe.combecomes a matter of public record the moment the box is provisioned. If your username identifies you, treat it as published. Pick accordingly. - Email delivery — sending provider, once chosen — carries account email such as password and billing notices.
06 Retention
- Sessions expire 30 days after they are created. Signing out deletes that row immediately; changing your password deletes every other one.
- Destroyed boxes keep their metadata row, marked destroyed, for retention period so billing and abuse history stay answerable. The disk is gone the moment the machine is destroyed — not archived, not recoverable, by us or by you.
- Setup logs — proposed: 90 days.
- Password reset rows live an hour. A used one is kept for that hour so a second click on a dead link can be told apart from a link that never existed; expired rows are deleted the next time anyone asks for a reset. Changing your password deletes every outstanding link for your account at once.
- Rate-limit counters live for the length of their window, an hour at most, and a sweep every ten minutes deletes anything past it — so nothing here outlives about seventy minutes. The address is stored as it arrived; the email is stored only as a hash.
- Audit records — proposed: 12 months.
- Billing records — as long as tax law requires, which depends on the entity's jurisdiction.
- Waitlist emails — until you ask to come off, or until the list has been written to once and is deleted.
07 Deletion and access
There is no self-serve delete button yet, and saying otherwise would be a lie. Write to privacy@devpipe.com — mailbox to be created and we will destroy your boxes, delete your account and its sessions, and confirm when it is done.
What survives that, and why:
- Billing records we are required to keep for tax purposes.
- Audit rows needed for security history. The schema already sets the user id to null when an account goes, so what is left is the action and the time, not you.
Ask for a copy of what we hold and we will send it. Statutory response window and identity-verification steps to be set.
08 Where it lives
The control plane database sits on a single server in region. Your box sits in the region you chose when you created it, which may be a different country, and you can see which one on the box's page.
Cross-border transfers: standard contractual clauses or equivalent, if selling into the EU or UK.
09 Age
Devpipe is not intended for children. Set a minimum age — 16 or 18 — against the jurisdictions being sold into.
10 Changes and contact
If this policy changes materially we will email your account address before the change takes effect, and the date at the top will move.
Legal entity, registered address
privacy@devpipe.com — mailbox to be created