Privacy policy

Last updated 2026-10-15

ox Cloud (deploywithox.com) deploys your repositories onto servers that you own. This page says what ox keeps about you, what it does not keep, who else sees it, and how to use your rights. Questions about any of it: contact@deploywithox.com.

The short version

• ox keeps your GitHub identity, your servers, projects, settings, run records and an audit log, on its server in Germany, in the EU, with backups in the United States.
• Your apps, their databases, variables, backups and logs stay on your own server.
• No tracking: no analytics scripts, no ads, no selling data. Only cookies needed to sign you in and to keep the site safe, so no cookie banner.
• Download your data or delete your account yourself, in Settings.

1. Who is responsible

• For your account data, ox is the controller. That is what ox collects to run your account: who you are (from GitHub), your servers, your projects, your settings, and the audit log.
• For your applications' data, ox is at most a processor, and mostly not involved at all. Your app, its database, its uploads, its variables, its backups and its logs live on your own server. ox runs an agent there that carries out the actions you ask for. ox does not copy your application data to the plane, and does not read it for its own purposes. What passes through is what you ask to see or send: the logs you open or download, the rows, keys, or results you open in Explore, a backup you download or upload for a restore, and the variables you view or save. They are read or written on your server, pass through the plane between it and your browser, and are not stored. ox also carries a project's variables through the plane, without storing them, when it copies them to a new staging copy or preview (once you turn previews on, the poller or a GitHub push makes them), and reads them to check which keys a refused deploy still needs. You are the controller of the personal data your own users give your apps. Where ox does act as your processor, the data processing terms say how.
• ox Cloud is run by Saurav Sharma, one person in India, as an individual, not through a company. In this policy, "ox" means him. Under the GDPR he is the controller of your account data. Under India's Digital Personal Data Protection Act, 2023, ox is the Data Fiduciary for your account data. The contact for all privacy matters, grievances included, is contact@deploywithox.com (section 13).

2. What ox stores about you

Data	Why	Where and how long
Sign-in identity from GitHub: numeric GitHub user id, login, display name, avatar address, email address (your primary verified one on GitHub, which may be a private one: ox does not sign you in without one), and when the account was created	Your account is your GitHub user id. The login and name are shown in the dashboard. The email is shown, and used to reach you. The avatar address is kept but not shown.	The plane's database, refreshed at each sign-in, until your account is deleted (section 8).
GitHub tokens from sign-in (a user token and a refresh token)	To list and read the repositories you choose, on your behalf.	The plane's database, encrypted (AES-256-GCM) under a key kept in a separate root-only file.
Sessions: a one-way hash of a random token, when it was made and when it ends; during a GitHub sign-in, a record that ties it to your browser	To keep you signed in.	The plane's database. A session ends after 30 days or when you log out. Logging out deletes its record, and a session that ran out is deleted within ten minutes. The sign-in record works for 10 minutes and is deleted within ten minutes after that.
Personal tokens for the CLI and scripts, with their name (the CLI names one after your computer)	To let the CLI act as you.	Only a one-way hash, a name and when it was last used. A token works for 90 days. Its record is deleted when you revoke it in Settings, within ten minutes of the end of its 90 days, or when you delete your account. The audit log keeps the token's name in its own rows (below).
Sign-in codes for ox login, with the IP address that asked, the CLI's name (with your computer's name), and when	To approve the CLI on your screen.	The plane's database. A code works for 10 minutes. Its record is kept one more hour, so the page can say the code expired, and is then deleted within ten minutes.
Your servers: the name, hostname, IP addresses, memory, disk, system version, ox version and operator SSH public key the agent reports, when it was last seen, and a hash of the agent's credential; when its agent connected, went offline, rolled back or failed an update on a new ox version, and which ox version ran each action	To show and reach your servers, and to stop a new ox version that misbehaves before it reaches every server.	The plane's database, until you forget the server or delete your account. The agent's connections and updates are kept 30 days, and longer while their ox version is still ox's newest. After you forget a server, or delete your account, only the server's number, the credential's hash, the time, whether its agent can leave on its own, and when ox last checked on an agent that could not, until its agent leaves or for 12 months (section 8).
Usage history the agent reports: CPU, memory and disk use of your servers and projects, and of each process by name	To draw the charts and send usage alerts.	The plane's database. Minute points are kept 24 hours, 15-minute points 30 days.
Your projects: name, repository address, branch, domains, the settings you choose for it, and a record of each run (what was asked, the commit, the result, the times, and for a failed run its error, see below). Your GitHub App installations: their id and the GitHub account or organization name.	To deploy and to show your history.	The plane's database, until the project is deleted. Runs have no age limit. The record of a project's delete stays until your account is deleted.
Settings you save: your S3 backup target (endpoint, bucket, region, access key, and the secret key), a Hugging Face token, your preview domain, and which alerts you want; and which alerts are open now, and the last error from sending you an email	To copy your backups to your bucket, to download your models, to send only the alerts you chose, and to send a note when a problem is over.	The plane's database. Both S3 keys and the token are encrypted (AES-256-GCM).
Your plan: Free or ox Pro, and for ox Pro, Dodo Payments' customer id, your subscription id, its status, whether it is monthly or yearly, its next billing date and whether it ends then, and the charge ox last sent a renewal reminder for; never your card details	To know which plan you are on and how many projects deploy, and to send one reminder before each charge.	The plane's database, until you delete your account.
Audit log: your account, who acted (you, or the token's name), what was done (deploy, rollback, variables save, restore, delete, token create or revoke, server add or forget, showing values, a change made from Explore), what it was done to (for a statement run from Explore, its words with every value taken out, and how many rows it changed), the time, and the IP address the request came from. It also notes each alert ox sent you.	Security, and so you can see what happened on your account.	The plane's database. You see it in Settings. Each row is kept 12 months and then deleted. If you delete your account first, its rows keep only the action and the time until they reach 12 months (section 8).
Repository push notices from GitHub: a delivery id	To ignore a notice sent twice.	7 days.
Operational logs on the plane's server: the plane's own events and errors (such as a failed deploy, backup or webhook delivery), which can name your account number, GitHub login or email address, and your projects, servers and repositories; a line with the IP address for each request ox refuses as unsafe or too frequent; the web server's certificate messages; and the server's own sign-in and firewall logs, which record the IP addresses that connect to it. There is no log of each web request.	To run and secure the service.	On the plane's server. The system journal keeps them up to 30 days (at most 1 GB), and the system log files that copy them are kept up to 5 weeks (Ubuntu's default).

What ox does not keep

• Variables and secrets for your apps stay on your server. The plane carries them to the agent and keeps no copy.
• Your app's data, databases, uploads and its users' data are on your server only.
• Run logs are written on your server. The plane shows them live and holds the output in memory only, while a run is in progress and for a minute after. Logs you open or download pass through the plane and are not stored. One exception: when a run fails, its error, with up to its last 40 lines of output (secret values hidden), is saved with the run's record in the plane's database, and its first 500 characters go into the failure alert email. No other run output is written to the plane's disk.
• No account password. Sign-in is through GitHub. If you protect staging copies or previews with a site password, ox keeps only a one-way hash of it.
• A note to ox's owner. Once an hour, ox's owner gets one email listing the accounts and projects created in that hour, with the GitHub login and name, the account number, and the project, repository and server names. It goes to contact@deploywithox.com, so it reaches the operator's Gmail inbox like any mail to ox (section 4). The operator deletes each note 2 years after it was sent.
• ox does not sell your data, does not share it for advertising, and does not profile you.

3. Cookies and tracking

Every cookie on deploywithox.com is needed to sign you in or to keep the site safe, so no consent banner is shown. ox sets two:

• __Host-ox_plane_session: keeps you signed in, and the forms you send carry a code derived from it so another site cannot send them for you. Not readable by scripts. It is set only when you choose to sign in, and keeps you signed in on that browser for 30 days. Log out ends it at any time.
• __Host-ox_oauth: ties a GitHub sign-in to the browser that began it. Lasts 10 minutes.

Cloudflare, which sits in front of the site (section 4), adds its own security features to every page:

• A bot check. Cloudflare adds a small script, /cdn-cgi/challenge-platform/scripts/jsd/main.js, to each page. It is served from ox's own address, but Cloudflare writes and runs it, to tell people from bots. On most visits the script stores its result in the cookie cf_clearance, and Cloudflare may also set __cf_bm (its bot score, 30 minutes).
• Faster page loads. Cloudflare may tell your browser to load an ox page you are about to open, such as a link you start to click, so it shows sooner. It sets no cookie, and the page comes from ox's own site, so nothing is sent anywhere else.
• Hidden email addresses. On a page that shows an email address, Cloudflare hides the address from spam bots and adds a script, email-decode.min.js, that shows it again in your browser. It sends nothing anywhere.
• Error reports from your browser. The site's answers carry Network Error Logging headers. If a page fails to load, your browser may send Cloudflare a short report (the address, the error and your IP address) at a.nel.cloudflare.com. Pages that load fine send no report.

ox has no analytics and no advertising trackers, and loads no third-party scripts or fonts itself: every page, the signed-in dashboard included, gets its fonts and scripts from ox, and the only scripts ox did not write are Cloudflare's, above. There is no tracking of any kind: no analytics or session-replay tools, no error reporting from your browser to ox, no tracking pixels, no ad or marketing cookies, and no open or click tracking in ox's emails. ox counts site visits from Cloudflare's own records of the traffic it carries, which need no script and no cookie. One blog post shows a picture hosted on cdn.hashnode.com, so Hashnode sees your IP address when you open that post. The dashboard's theme and transparency choices are saved with your account. The public site's light or dark theme and a few dashboard display choices (how logs are shown, where you scrolled) stay in your browser's local storage and are not sent to ox.

4. Who else handles the data

Most of the companies below are ox's processors: they handle data only for ox, under a data processing agreement. Where one is in the United States, or may reach the data from there, the safeguard is named, and each link leads to the agreement, which is how you get a copy.

• GitHub: your identity provider, and where your repositories are. ox uses a GitHub App that can read the repositories you pick, and write their deployments, so a pull request links to its preview or staging copy. GitHub is its own controller for your sign-in and your repositories, not ox's processor, so GitHub's privacy statement applies to what it holds. It moves data out of the EU under the EU-US Data Privacy Framework and the EU's Standard Contractual Clauses.
• Cloudflare: deploywithox.com sits behind Cloudflare as proxy and CDN, so Cloudflare sees traffic to the site, including your IP address, and runs the security features in section 3. It is ox's processor under the data processing addendum that its self-serve terms include. Cloudflare is a US company and works worldwide; transfers rely on the EU-US Data Privacy Framework and the Standard Contractual Clauses.
• DigitalOcean: hosts the plane's server in its Frankfurt (fra1) region, in Germany. The plane's database, its hourly copies on that server, and its logs are kept there. DigitalOcean is ox's processor under the data processing agreement in its terms. DigitalOcean is a US company and may reach the data from the United States, under the EU-US Data Privacy Framework and the Standard Contractual Clauses in that agreement.
• Backups of the plane: the plane's database is copied every hour, and the newest 24 copies are kept on the plane's own server. Each copy is also sent to an S3-compatible storage bucket that ox owns, which keeps the newest 168 copies (7 days). That bucket is DigitalOcean Spaces in its San Francisco (sfo3) region, in the United States. This transfer relies on DigitalOcean's certification under the EU-US Data Privacy Framework, with the Standard Contractual Clauses in its agreement as the fallback. No copy is kept longer than 30 days.
• Resend: sends ox's emails. For the alerts you leave on in Settings, ox emails the address from your GitHub account through Resend: a deploy or backup fails, a process keeps crashing, a site or server stops answering, a project is close to its memory limit or uses too much CPU, a server's disk is almost full, and, if you turn it on, a deploy finishes. Most of them also send a note when things are back to normal. Resend receives your email address and the alert: what happened, the project and server names, a link, for a usage alert the percentage, for a finished deploy its commit, and for a failed run the start of its error. Your first sign-in also sends a welcome email through Resend, with your email address and your first name or GitHub login. Once an hour, ox emails its own owner through Resend one list of the accounts and projects created in that hour (section 2), with the GitHub login and name, the account number, and for a project its name, repository URL and server name. A few emails are not alerts, so turning alerts off does not stop them: one when your account is deleted, one when your ox Pro plan ends or a payment fails, one when you buy ox Pro (the amount, the renew date and Dodo's invoice for your first payment, a PDF with your name, email address and what you paid), one reminder 4 days before each ox Pro charge (the date, the amount and how to cancel), one when ox refunds an extra ox Pro charge (a second subscription bought by mistake: the amount refunded), one when a webhook endpoint of yours is switched off, and the test email when you press Send a test email. With the billing emails, ox sends Resend a key made of your subscription, payment or account id, and with the hourly note to ox's owner a key made of the account and project numbers it lists and a short fingerprint of its text, so the same email sent again within 24 hours after a lost answer is delivered once. ox sends no marketing email. Each alert email ends with a link that turns off that kind of email in one click, without signing in, and the email carries the standard unsubscribe header your mail program uses for its own Unsubscribe button. In Settings you choose which alerts you get, or turn them all off. Resend is ox's processor under the data processing addendum in its terms. It is a US company, and the transfer relies on the EU-US Data Privacy Framework and the Standard Contractual Clauses. How long Resend keeps sent emails and their logs is set by its privacy policy.
• Your webhooks: endpoints you add receive events as signed JSON with names and links only: no variable values, tokens, passwords, or log lines. The address, signing secrets, and any header value are stored encrypted. Each event, and its delivery log (time, event, status, latency, and at most 1 KB of a failed answer), is kept until 7 days after its delivery ends. The endpoint's description and its last error stay until you delete it.
• Your own services: your servers' hosting company, and the S3-compatible storage you pick for your backups (any provider), are chosen by you, are your processors, not ox's, and work under their own terms.
• Let's Encrypt and ZeroSSL: Caddy on your server, and on ox's, gets HTTPS certificates for your own domains from Let's Encrypt. For the free sslip.io address ox gives a project with no domain, Caddy on your server gets the certificate from ZeroSSL, with an account of its own for each server, registered with an address made from the server's IP (like ox-203-0-113-7@deploywithox.com). They see the names, and every certificate is published in public certificate logs, so those names are public: a domain you add, or a free address, whose name holds the project's name (for a branch preview, the branch name too) and your server's IP address.
• Email to ox: mail to contact@deploywithox.com goes through Cloudflare Email Routing to the operator's personal Gmail inbox, and is kept there until 2 years after the last message in the conversation, then deleted, unless ox needs it for a legal claim. Google (Google LLC, a US company) stores that inbox under its own privacy policy; there is no data processing agreement between Google and ox for it. Google LLC is certified under the EU-US Data Privacy Framework, and its policy says it also relies on the Standard Contractual Clauses where needed.
• Dodo Payments: the merchant of record, takes payments for ox Pro and holds your card details; ox never sees or stores them. ox sends Dodo your account email (to fill in the checkout), your GitHub login (as the customer name) and your ox account id, and keeps only your plan: Dodo's customer id, your subscription id, its status, its period and its next billing date. It also keeps the text of the "You're on ox Pro" email it sends you (the amount of your first payment and the dates), so a retry sends the same email. When ox cancels a second ox Pro subscription you paid for, it keeps that subscription id, your account number, the status it had, when ox decided to cancel it, whether it is cancelled yet, whether ox's owner was told about it and, at the end, why it was left to them, and for each payment of it the payment id, how far its refund has got, when ox first saw it and what ox's owner was told about it. The text of each email about such a refund, to you or to ox's owner, is kept until it is sent, and one to an account that is gone is deleted unsent. It keeps them until 30 days after ox decided to cancel the subscription and one last look then, which refunds every payment of it that succeeded by that time, and then deletes them; anything not settled by then ox's owner is told about by email and settles by hand, and ox does not see a payment that succeeds after that look (write to ox if one does; your data export lists these records under your plan). Dodo Payments, Inc. is a US company. For your payment, fraud checks and tax it is its own controller, under its privacy policy, which also says how long it keeps your payment records. Where it acts for ox, it is ox's processor under the data processing agreement in its merchant terms. Dodo is not certified under the EU-US Data Privacy Framework, so transfers to it rely on the Standard Contractual Clauses.
• Sentry (Functional Software, Inc.): when something breaks inside the plane (a crash, a server error, a failed background job), ox sends an error report to Sentry, ox's processor, which stores it in its EU region (Frankfurt, Germany). A report holds only: ox's own fixed message for the spot that broke (never the names or numbers it was written with), the kind of error (the Go type of the error, and for a database, payment or timeout error a fixed code such as "Dodo Payments answered 422"), where in ox's code it happened (the stack), the page's route pattern (such as /app/projects/{id}, never the full address), ox's version, and the plane's Go runtime, operating system and code libraries. It never holds your name, email, GitHub login, account id, project, server or repository names, payment ids, request bodies, cookies, query strings, headers (not even your browser's user agent), or any of your variables. Your servers never talk to Sentry, and your browser does not either: only the plane sends reports. Sentry keeps a report for 30 days. Sentry is a US company and may reach the reports from the United States, under the EU-US Data Privacy Framework and the Standard Contractual Clauses in its data processing addendum.
• ox does not rent or sell data to anyone else.

5. Where data goes

The plane is in Germany (DigitalOcean, Frankfurt), so your account data is stored in the EU. ox is run from India, and the person who runs ox reaches it from there. If you are in the EU, you give your data straight to ox, so under the GDPR this is not a transfer, but ox applies the GDPR to all of it. India has no EU adequacy decision, so ox protects the data itself: it reaches the plane only over encrypted connections, only the person who runs ox has access, and the secrets in it are encrypted (section 9).

Some copies leave the EU, each under the safeguard named in section 4: the plane's off-site backups go to the United States (DigitalOcean Spaces, San Francisco), and DigitalOcean, Cloudflare, Resend, Sentry, Dodo Payments and Google (the Gmail inbox that mail to ox reaches) are US companies that may handle what they receive outside the EU. GitHub handles your sign-in and repositories as its own controller.

6. Why ox may use it

India (DPDP Act, 2023): you give ox this data when you sign in, to run your account, and ox uses it only for that and to keep the service secure. You can withdraw by deleting your account (section 8).

EU, EEA and UK (GDPR, UK GDPR):

• Running your account and the service you asked for (contract): the identity, servers, projects, settings and tokens in section 2, the emails the service sends you, and your ox Pro plan.
• Security and preventing abuse (legitimate interest: keeping your account, other customers and ox safe): the audit log, IP addresses, rate limits, the plane's logs, and Cloudflare's security features (section 3).
• Keeping the service running (legitimate interest: finding and fixing what breaks, and not losing your data): backups of the plane's database, and error reports to Sentry.
• Knowing whether the product works (legitimate interest: seeing whether people can sign up, deploy and pay): ox counts sign-ups, first deploys, deploy results and ox Pro purchases from the records it already keeps in section 2, without collecting anything new, and its owner gets a note when an account or a project is created (section 2). Site visits are counted from Cloudflare's records (section 3).
• Meeting legal duties, where they apply to ox, such as tax records and answering lawful requests.

What you must give: to have an account, ox needs your GitHub identity with a verified email address. Without it, ox cannot create an account or sign you in. Everything else is optional or comes from what you choose to do in ox. To buy ox Pro, Dodo Payments needs your payment details.

ox does not use automated decisions that have legal effects on you.

Your right to object

Where ox relies on a legitimate interest (security, keeping the service running, and knowing whether the product works), you can object at any time, for reasons about your own situation. Email contact@deploywithox.com from the address on your account and say what you object to. ox then stops that use of your data, unless it has compelling reasons that outweigh your interests, or needs it for a legal claim, and tells you which within 30 days. Some of these uses keep the service safe for everyone, such as the audit log and the security check; if ox cannot stop one of them for you, deleting your account ends it.

7. Your rights, and how to use them

Two of them need no email. Get a copy: in the dashboard, Settings, Your data, Download my data, or ox account export. You get one JSON file with your profile, servers, projects, runs, audit log, token names and settings; it holds no secret, and your apps' variables and data are on your own servers, so they are not in it. Three downloads an hour. Delete your account: Settings, Delete account, or ox account delete --confirm <your GitHub login> (section 8). For anything else, such as a correction or an objection, email contact@deploywithox.com from the address on your account, or say which GitHub login is yours. ox answers within 30 days.

• Everyone: ask what ox holds about you, get a copy, have it corrected, or have it deleted.
• In India (DPDP Act, 2023): also get a summary of your data and of who it was shared with, have a grievance handled (section 13), and name someone to use your rights if you die or cannot. If ox's answer does not settle a grievance, you can complain to the Data Protection Board of India.
• In the EU, EEA and UK (GDPR, UK GDPR): also object to processing (above), restrict it, take your data in a portable form, withdraw consent where it is the basis, and complain to your data protection authority (the list of EU authorities; in the UK, the ICO). ox has no office in the EU, and you can complain to the authority where you live.
• In California (CCPA/CPRA) and other US states: know, access, delete and correct your personal information, and not be treated worse for using these rights. ox does not sell or share personal information for cross-context advertising, so there is nothing to opt out of, and it does not use sensitive personal information to infer traits about you.
• Elsewhere: ox applies the same rights to every customer, whatever local law adds.

For data in your applications, which is on your server, make the request to the app's owner (your customer, if you are their user). ox cannot see it.

8. What happens when you delete things

• Delete a project: once your server confirms the delete, the plane removes the project and its run records, but for the record of the delete itself. On your server, the app stops and its files, database and users are removed, and ox keeps a copy of its data and variables in a trash folder on your server for 7 days, so you can restore it, and then removes it. Backups you copied to your own S3 bucket stay there until you delete them. Audit rows about the project stay.
• Forget a server: allowed once it has no projects. The plane deletes the server record and its credential, and the ox agent then removes itself from the server, at once or when the server is next online; for an agent too old to do it, the answer gives a command to run instead. Whatever still runs there keeps running, and /etc/ox/LEFT.txt on it says what. sudo ox uninstall on the server removes everything else ox created.
• Revoke a token: it stops working at once.
• Delete your account: in Settings, Delete account (or ox account delete --confirm <your GitHub login>). You type your GitHub login to confirm. Your apps keep running: nothing on your servers is stopped or deleted. First ox cancels an ox Pro subscription at Dodo Payments, so you are never charged again; if Dodo cannot be reached, nothing is deleted and the page says why. Then, at once, ox removes your sessions and personal tokens (they stop working), your servers' records and credentials, your projects and their run records, your metrics, your settings (S3 target, Hugging Face token, webhook, notification choices), your alert records, your GitHub connections, your plan, and your account record with the GitHub tokens it held. The ox agent on each server then removes itself and leaves a note at /etc/ox/LEFT.txt that says where everything is; a server that is offline does it when it next connects, and an agent too old to do it gets a command to run instead (the page lists each server). After that, nothing on the server is managed by ox: no deploys, backups or alerts. ox then asks GitHub to revoke its authorization on your GitHub account; if GitHub does not answer, the page says so and you can remove ox at github.com/settings/applications. ox then sends a confirmation to your address through Resend. Kept: the audit rows stay for security, each with only its action and time: your login, the address and what was acted on are removed. Each is deleted when it is 12 months old. For each of your servers, ox keeps its number, a one-way hash of its credential, the time, whether its agent can leave on its own, and when ox last checked on an agent that could not, with no name or address, only so its agent can be told to leave; the record goes when the agent leaves, or after 12 months. ox also keeps a one-way keyed hash of your GitHub account number and the time you deleted, with no name or address, on the plane's server and in ox's bucket, only so that restoring an older backup of the plane deletes your account again; it goes after 30 days, when no backup that holds your account is left. A refund ox still owes you (a second subscription, or a payment after the deletion) keeps the same records as above (the subscription id, your account number and each payment's refund), until 30 days after ox decided to cancel it and its last look then, which refunds every payment of it that succeeded by that time; anything left is handed to ox's owner. The hourly notes ox's owner got that list your account and projects (section 2) stay in the operator's mailbox until 2 years after they were sent, then are deleted. Dodo Payments, the merchant of record, keeps its own records of your payments (section 4). Removing the ox GitHub App from your repositories is done on GitHub, and ends ox's access to them.
• Backups of the plane: deleted data can remain in the plane's backups for at most 30 days while ox Cloud runs. The plane keeps its newest 24 hourly copies on its server and the newest 168 in ox's own bucket (section 4). Each update of the plane, and a restore, also leaves a copy of the database on the plane's server, and the operator may copy it by hand to move or test the plane. Those copies are not edited, so a deleted account is gone from them only as they age out (if a copy is ever restored, the plane deletes the account again from a record of deletions it keeps apart from its backups, before it serves anyone, and nobody can sign in to the account meanwhile; only if that record were lost too could the account come back): the plane deletes each one once it is 30 days old, and the operator deletes a hand-made copy within 30 days. Only if the plane itself were stopped for weeks could a copy outlive that, until the plane runs again for a few days.

9. Security

What ox does, and nothing more: the plane's secrets (GitHub tokens, S3 keys, Hugging Face tokens, webhook secrets) are encrypted with a key kept outside the database; personal tokens, server credentials and site passwords are stored only as hashes; each account sees only its own data; the agent on your server connects out to the plane over HTTPS and the plane never connects in to it (it only checks that your sites answer); agent updates need ox's release key as well as the plane's; and every action on your account is audited. Security says more. No system is perfectly secure, and ox is run by one person.

10. If something goes wrong

If ox learns of a breach that affects your personal data, it will email the address on your account without undue delay, saying what happened, what data it touched, and what you should do. ox will also report it to the authorities where the law requires, such as the Data Protection Board of India and CERT-In.

11. Children

ox is for people 18 or older (or the age of majority where you live). ox does not check ages. If ox learns that an account belongs to a minor, it may close the account and delete its data.

12. Changes

If this policy changes in a way that matters, ox will email account holders at least 14 days before the change takes effect. The date at the top is the last change.

13. Contact and grievances

For questions, requests and grievances about your data, write to contact@deploywithox.com. Saurav Sharma, who runs ox, reads it and answers. ox acknowledges a grievance within 7 days and answers within 30 days.