Privacy Policy

• Account info: username, email, and — if you sign up with GitHub — your GitHub identity and profile info covered by that OAuth grant. If you use a password instead, we store a salted, hashed version of it (scrypt), never the password itself.
• Deploy configuration: the SSH host/port/username and private key, or Docker Hub credentials, you enter to configure a deploy target. Private keys and tokens are encrypted at rest (AES) and only ever decrypted server-side to perform a deployment you triggered.
• AWS role ARN (Vision): the IAM role ARN you create and paste in. We never receive or store a raw AWS access key — only short-lived, temporary credentials obtained by assuming that role, which expire automatically.
• Billing info: handled directly by Stripe — we receive your subscription status and plan, never your full card number.
• Usage & audit data: generation runs, deployment history, and an append-only audit log of sensitive account/organization actions (invites, role changes, deploy-target changes, and similar).
• Content you create: anything you write directly in the product — blog posts, roadmap progress, collaboration messages, profile fields.

To operate the Service: authenticate you, run the generation and deployment features you ask for, process payments, send transactional email (verification links, password resets, invites), and maintain the audit log for account security. We don't sell your data, and we don't use your source code or generated files for anything beyond performing the action you requested.

Specific categories of data pass through specific third parties, each only for the purpose that requires it:

• GitHub — repository access, via the GitHub App you install and authorize.
• Stripe — subscription billing and payment processing.
• AWS (SES) — outbound transactional email delivery.
• AWS (your own account) — only when you use Vision, and only via the IAM role you explicitly grant us.
• Our infrastructure host — Amazon Web Services (AWS), which runs the servers the Service itself is deployed on.

We retain personal data for as long as needed to provide the Service and for applicable security, accounting, dispute-resolution, and legal obligations. Retention periods vary by data category; we do not treat account closure as permission to keep every record indefinitely. Security and audit records may be retained for a documented period where needed to investigate incidents or establish, exercise, or defend legal claims. Contact us to request information about a specific category or to exercise a right.

You can review and update profile fields and download an account-data snapshot from Profile & Account in the dashboard. The current snapshot includes identity-service profile and membership data, account-security metadata, access requests, temporary-access records, user-created role/API-key metadata, actor audit-event metadata, and roadmap progress. It is not a complete export of repository/installations, deployment history and artifacts, generated files, billing-provider records, infrastructure resources, backups, or operational logs. You can also request access to other personal data, correction, restriction, objection, portability where applicable, or erasure by contacting hello@smilekisan.com. We may ask for proportionate information to verify your identity. We aim to respond without undue delay and normally within one month. Erasure is assessed against applicable legal exceptions, and may not require deletion of records that must be retained by law or are needed for legal claims. The dashboard's Delete account control immediately blocks future sign-in and initiates subscription cancellation, but does not automatically delete connected repositories, deploy targets, remote servers, or every cross-service record. Contact us to coordinate those additional deletion requests. We assess each request and any applicable legal exceptions, and will explain material limitations rather than representing a request as complete when it is not. These rights depend on applicable law and circumstances; this policy is not a guarantee that every request can be granted.

We use browser storage for authentication and security flows, workspace selection, and interface preferences such as theme and accessibility settings. Some preferences use local storage rather than cookies. The workspace-selection cookie is a convenience only; authorization is independently checked server-side. The current website code does not intentionally load optional advertising trackers or behavioural analytics tags. Read our Cookie & local-storage notice for the current storage categories, purposes, and effects of clearing them.

SSH private keys, Docker Hub tokens, and 2FA secrets are encrypted at rest (AES) and only decrypted server-side, in the moment they're needed to do what you asked. Passwords are hashed with scrypt, never stored in plain text. All traffic to the Service is encrypted in transit (HTTPS/TLS). No system is perfectly secure, but this is the real, current implementation — not an aspiration.

AutoDeploy isn't directed at, and we don't knowingly collect data from, anyone under 16.

We'll post updates here with a new "Last updated" date, and notify active subscribers directly for material changes.

hello@smilekisan.com for anything in this policy, including exercising the rights in §5.