The short version
- We collect the minimum needed to run a hosting service: who you are, what you published, and operational logs.
- We do not sell personal information, and we do not share it for advertising.
- There is no analytics and no third-party tracking anywhere on this site.
- Your files are stored on Amazon Web Services in the United States (
us-east-1). - You can delete any site, or your whole account, yourself from the dashboard.
What we collect
- Account information
- Your email address and the authentication profile held in Amazon Cognito, including whether two-factor authentication is enabled. If you sign in with an identity provider, we receive the basic profile it returns.
- Site information
- Subdomain, deployment status and history, release identifiers, file names and sizes, timestamps, and — if you connect one — the public GitHub repository a site deploys from.
- Content you publish
- The static files themselves, stored so they can be served to visitors. Anything you publish is public by design.
- Access tokens
- Personal access tokens for the command-line tool are stored only as a hash. We cannot recover a token once it is shown to you.
- Operational logs
- Request metadata such as IP address, timestamp, user agent, requested path and response status, plus application logs and security events. Used to keep the service running and to detect abuse.
Why we use it
- To authenticate you and keep your account secure.
- To publish, serve and manage your sites — the service you asked us for.
- To enforce the account limits that keep the service free.
- To detect, investigate and prevent abuse, fraud and attacks.
- To diagnose faults and improve reliability.
- To answer you when you contact us.
Where data-protection law requires a legal basis, ours is the performance of our agreement with you (running the service you signed up for) and our legitimate interest in keeping that service secure, reliable and affordable to operate.
How long we keep it
| Category | Kept for |
|---|---|
| Account information | While the account exists, then deleted on account deletion |
| Published files (active release) | Until you replace or delete the site |
| Previous releases | The last 3 per site, so rollback works; older ones are removed automatically |
| Access token records | Until you revoke the token, or it expires |
| Payment records | As long as the law requires us to keep accounting records |
| Domain registrant details | While you hold the domain with us, and as the registry rules require afterwards |
| Mailboxes and messages | Until you delete the mailbox, the mail domain or the account; copies can remain briefly in the provider's backups |
| Application and security logs | A rolling window, typically weeks, then deleted automatically |
| Administrative action records | A limited retention window, then deleted automatically |
Deletion is not always instantaneous: copies can survive for a short time in caches and backups before they expire on their own.
Who else sees it
We do not sell personal information. We share it only in these situations:
- Amazon Web Services, which provides all the underlying infrastructure — storage, delivery, authentication, compute and logging — acting as our processor.
- Payment providers, when you pay: the amount, the item and your payment details go to the provider you choose (for example QvaPay or a card processor), which handles them under its own terms. We do not store card numbers.
- Our domain registrar partner, when you buy or transfer a domain: the registrant contact details you give (name, address, email, phone) are sent to it and to the domain registry, as the rules for registering domains require, and may appear in public domain records unless privacy protection applies.
- Our email provider, when you use Mail: it hosts your mailboxes and processes the messages you send and receive on our behalf.
- When the law requires it, such as a valid legal request, or to protect the rights, safety or property of users, the public or us.
- If the service changes hands, in which case this policy travels with it.
If you connect a site to GitHub, requests are exchanged with GitHub to read your public repository. Their handling of your data is governed by their own policies.
Where it is stored
Data is stored in the AWS us-east-1 region in the United States, chosen because it gives our audience the lowest latency. Sites are served from AWS edge locations worldwide, so cached copies of your public content exist in many countries.
If you are located outside the United States, using the service involves transferring your information there.
Your choices and rights
You can do the most important things yourself, at any time, from the dashboard: delete a site, revoke a command-line token, enable two-factor authentication, or delete your entire account.
Depending on where you live, you may also have the right to request access to your data, correction, deletion, a portable copy, or to object to or restrict certain processing.
To exercise any of these, write to santanarobainaa@gmail.com from the email address registered to your account, so we can be sure it is you. We aim to respond within 30 days.
Children
Nautacloud is not directed at children under 13, and we do not knowingly collect their personal information. If you believe a child has created an account, write to us and we will remove it.
How it is protected
Traffic is encrypted in transit, data is encrypted at rest, access tokens are stored hashed, and each component runs with least-privilege permissions. The Security page explains how to report a vulnerability, and the Architecture page describes the design in detail.
No system is perfectly secure, and we cannot guarantee absolute security.
Cookies and local storage
Covered separately on the Cookies page, including a full inventory of what we store in your browser.
Changes to this policy
When this policy changes, the effective date at the top changes with it. Material changes will be announced to account holders where reasonably possible.