Privacy Policy

Account data: your email address, name (if provided), and authentication metadata managed by our identity provider (WorkOS).

Billing data: processed by Stripe under their own privacy policy. We never see or store your full payment card number.

Service usage data: deploy logs, application logs (from your tenants), audit log entries, and aggregated metrics (CPU, memory, bandwidth) needed to operate the Service.

We use the data we collect to (a) provide and operate the Service, (b) detect and prevent abuse or security incidents, (c) respond to support requests, and (d) send you essential service announcements. We do not sell your data to third parties.

We use the following subprocessors to deliver the Service:

• Supabase — managed PostgreSQL database
• WorkOS — authentication and identity
• Stripe — payment processing
• Cloudflare — DNS and edge caching
• Amazon EC2 — underlying compute (called "Pods" in our docs)

Application logs and audit log entries are retained for 90 days. Deploy logs are retained for 30 days. Account data is retained for the lifetime of your account plus 30 days after deletion, after which it is permanently deleted.

You can request a copy of all data we hold about you, or request deletion, by emailing privacy@hostkingpro.com. We respond to such requests within 30 days.

Tenant isolation is enforced at the kernel level via per-tenant Unix users, systemd units, cgroup v2 resource limits, and an nftables egress block that prevents tenants from reaching cloud metadata endpoints, RFC1918 ranges, and link-local addresses. All API traffic is served over TLS 1.3.

We use a single first-party session cookie (`workos-session`) for authentication. It is http-only, secure, and SameSite=Lax. We do not use third-party tracking or advertising cookies.

Our infrastructure is currently in the United States (AWS us-east-1). If you are accessing the Service from outside the United States, your data will be transferred to and processed in the United States.

The Service is not directed to children under 13. We do not knowingly collect data from children. If you believe a child has provided us data, please contact us and we will delete it.

Material changes to this policy will be announced via email and a dashboard banner at least 30 days in advance.