Privacy policy

Short version: we collect what we need to run your account, we don't sell it, and we don't train AI models on your data. Long version below.

What we collect

Account info. Email, handle, hashed password. That's it — we don't ask for your name or phone.
Billing info. Card details live with Stripe; we only see the last four digits, expiry, and billing country.
Usage data. Dispatch counts, error logs, what time your agents ran. Used to keep the lights on and to enforce quotas.
Conversation history. What you typed to the agents, what they wrote back, what commands they ran. Stored on your server, scoped to your account.
Server-side logs. IP addresses, user-agent strings, request paths. Rotated out within 30 days.

How we use it

To run your account — provision servers, route DNS, issue certs, render this page.
To bill you, if you're on a paid plan.
To diagnose problems and improve the product. We aggregate before we look — we don't read individual conversations unless you explicitly ask us to (e.g. a support ticket).
To prevent abuse. If an account starts hammering other servers or sending spam, we look at the logs for that account only.

What we don't do

We don't sell your data. Ever.
We don't train ML models on your conversations.
We don't share data with advertisers. We don't run ads.
We don't share data with anyone except sub-processors who help us run the service (Stripe for payments, Postmark for transactional email, Let's Encrypt for certs). Each is bound by their own privacy commitments.

Your rights

You can export your data from /account (coming soon — for now, just email us). You can delete your account anytime; we wipe everything within 30 days. If you're in the EU, UK, or California, you have the usual access/delete/portability rights — email us and we'll help.

Cookies

We use one cookie: sg_session, which is how we know you're logged in. It's httpOnly, sameSite=Lax, and goes away when you log out. We don't use third-party analytics cookies. We don't use tracking pixels.

Security

Passwords are bcrypt-hashed. Sessions are signed. SSH keys are stored encrypted at rest. We run on hardened Ubuntu LTS with automatic security updates. We don't claim to be unhackable — if you find a vulnerability, please email hello@sshgrid.com with "SECURITY" in the subject.

Contact