Deployka
Sign inStart now

Privacy Policy

Last updated: September 15, 2026

The data controller and service seller is the operator of the Deployka online service, trading as Deployka. For data and contract requests: support@deployka.dev. Current contact details are published on the Contact page. Contact.

This Policy describes data Deployka processes to operate the website, dashboard, deployments, and support. It does not replace the customer's own privacy notice for data collected by the customer's application.

1. What data we collect

At registration: name, email, optionally a company name. We also store your project, payment, and support ticket history.

Automatically: IP address at sign-in and API access, browser user-agent, dashboard usage data, and technical security events.

For deployment, we process an uploaded ZIP or GitHub URL, ENV variable names, build logs, and runtime metrics. Secret values, including BOT_TOKEN and API keys, are not published to analytics or support tickets.

2. How we use your data

  • Email — for account login and server status notifications
  • Payment data — for invoicing and accounting
  • Support tickets — to resolve issues and improve the service
  • Usage metrics — for infrastructure optimization

3. Lawful bases

  • Contract performance — account creation, deployment, billing, support, and paid-service delivery
  • Legitimate interests — security, abuse prevention, diagnostics, and reliability improvements
  • Legal obligation — retention of required payment and dispute records
  • Consent — only where separately requested and capable of being withdrawn

4. Sharing data with third parties

4.1. We don't sell your data. We share only the necessary minimum with the following recipients:

  • Infrastructure partners — to host servers
  • Payment providers available at checkout — to create an invoice, confirm payment, process a refund, and prevent fraud
  • Google or Telegram — when you select that sign-in or account-linking method
  • Sentry — for technical error diagnostics with known secrets redacted; ordinary diagnostic context does not include ENV values or project contents
  • OpenRouter and the selected AI model (for example, DeepSeek) — only for AI features requested by the user. If you submit a message or project files to such a tool, they are transmitted for processing; do not include BOT_TOKEN, API keys, passwords, or other secrets.
  • Resend — to deliver service emails when email notifications are enabled
  • Government authorities — upon lawful request

4.2. If you deploy an application that processes data belonging to your users, you determine the purposes of that processing and are responsible for notices, lawful basis, and access settings. For that data, Deployka acts as a technical processor within your instructions and these Terms.

5. Storage and international processing

5.1. Deployed customer projects, container builds, and related persistent volumes run on dedicated worker infrastructure provided by netcup GmbH in the European Economic Area. The specific facility may depend on the configuration and may change during a migration. The dashboard and separate system components may run on different infrastructure. Sign-in, support, diagnostics, email, or payment providers may process data in other countries under their policies and applicable transfer safeguards. See netcup's privacy policy for details. netcup.

5.2. Passwords are stored hashed with bcrypt. Project secrets are stored encrypted and are not included in product analytics.

5.3. All connections to the dashboard are encrypted with HTTPS.

5.4. Encrypted backups of configuration, database, and persistent data may also be transferred to Cloudflare R2 for disaster recovery. Encryption keys are not provided to the storage provider. A backup is not a promise of user-facing one-click restore unless that feature is expressly included in the selected plan.

5.5. Account data is retained while the account is active. Technical logs, backups, and payment records are kept only as long as needed for operations, security, recovery, dispute resolution, and legal compliance, then deleted or anonymized. Backups may remain for up to 30 days after deletion to protect against accidental loss.

6. Your rights

6.1. Depending on applicable law, you may:

  • Request an export of all your data
  • Edit or delete personal information in account settings
  • Request account deletion through support; deletion is subject to mandatory retention of payment and legal records
  • Withdraw consent to data processing (this may make it impossible to keep using the service)

7. Cookies and local storage

7.1. To operate the service we use essential cookies: a session cookie for authentication (__Host-deployka_session) and local storage for language and currency preferences.

7.2. We count first-party funnel events without file contents, ENV values, or secrets. We use Yandex Metrica for visit and action statistics, including ad measurement. It runs by default, sets Metrica cookies and sends pseudonymous visit data (browser Client ID, pages and actions) to Yandex; we also store that identifier in our own analytics to link a visit to a signup. You can switch it off with the toggle below; Do Not Track and Global Privacy Control signals are also honoured. Session Replay, form-content recording, and automatic link tracking are disabled. Secrets, email addresses and project names are not sent as event parameters.

8. Contact and requests

For privacy questions: support@deployka.dev.

Response time — within 48 hours.