This notice explains what personal data Stasho holds about you, why, who handles it for us, how long we keep it, and how to use your rights. It is part of using Stasho under the Terms of Service.

1. Who is responsible for your data

MAFF vof, Braziliestraat 23, 2000 Antwerpen, Belgium, enterprise number BE 0898.114.288, is responsible (the controller) for the personal data described here. Write to legal@stasho.xyz about anything in this notice.

2. What we hold about you

What we hold depends on how you sign in and what you use.

• Wallet address. Every account has one; it identifies you everywhere in Stasho.
• Sign-in method. Whether you signed in with your own wallet, or with email or a social login.
• Email address. If you sign in with email or a social login, and if you give one when you create an App VM (a trial needs one).
• GitHub account id and username. If you connect GitHub to deploy from a repository, and if you start an App VM trial.
• GitHub installation. Which installation of the Stasho GitHub App is linked to your wallet. We use it to get short-lived tokens that let us read and build the repositories you chose.
• App VM SSH keys. The public SSH keys you give when you create an App VM, so you can log in to it.
• Business or personal use, as you declared it at sign-in or later in Settings.
• Acceptance records. Which version of the terms you accepted, when, as a business or for personal use, and which clauses (the trial clause included). Each record is encrypted and holds no IP address. You can see your own list in Settings, under Data & Privacy.
• Project and deployment records. These are written to a public network under your wallet address. Some fields are public, such as the framework, the status, the timestamps and the content identifier of each deployment. The others, such as names, repositories, build settings and environment variables, are stored encrypted. We can access them: our service uses them to build and run your project and keeps an encrypted working copy, and we hold the key to that copy. The copy also holds deployment details such as the commit, its message, the branch, the build run’s address, which contains your repository’s name, and any build error. The full list is on Your data on-chain.
• Trial record. Your wallet, your GitHub account id, the email you gave and the dates of your trial. A copy without the email is written to the public network, encrypted.
• Log of writes. A record of what our service writes for your wallet: your wallet address, the time, content hashes, any domain name involved and, for a write made with an agent key, that key’s id. Anyone can read it for your wallet through our audit endpoint.
• Agent keys. The name you gave a key, its permissions, its recent use and an email for alerts. Revoking a key removes its name, email and list of recent uses.
• Service log. One line per request to our service, with your wallet when you are signed in, and our service’s status and error messages, which can name your wallet, a project or a domain. No IP address and no query string. Kept up to about two months.
• Analytics. Page views on stasho.xyz, the app and the docs, counted by our self-hosted Umami analytics, which records the country and a hash of the IP address made with a salt that changes regularly. In the app, rows keyed to your wallet: your sign-in method, your session, and the first referrer and campaign (UTM) tags that brought you to Stasho. The same rows record which projects you deployed and whether each deploy succeeded, your trial start and end, and the free credits granted to you, keyed to your wallet and your GitHub account id.
• Abuse reports. What the report form collects: the type of report, the URL or IP address reported, when it was seen, and why it is considered illegal. It also collects the reporter’s role, any order reference, the reporter’s name and email (optional for reports of child sexual abuse material), and a statement of good faith. The form and its answers are kept in Google Forms and Sheets. A report sent by email stays in our mailbox; once it opens a takedown case, we keep it with the case as described below and delete the message.
• Takedown cases. When we act on a report, an encrypted case record keeps the report’s identifiers, the reporter’s name and email, what we did and the statement of reasons we sent. A report that came by email is kept with the case as its headers and text. Its attachments are kept only as fingerprints, except an order or letter from an authority or a lawyer.

3. What we do not keep

• IP addresses. We keep no IP address in any log. Our service uses your IP address in memory to limit how many requests one visitor can make, and our analytics turns it into a country and a hash. The servers that serve your site or your VM see visitors’ IP addresses, as any web server does. If you drop a site without signing in, we keep a keyed hash of your IP address with the drop, to limit abuse of the drop, until the drop expires. Your browser loads our web fonts from Google, so Google sees your IP address when a page loads. Your App VM’s own SSH log, on your VM, records the addresses that connect to it and is kept about eight weeks.
• Your wallet’s private keys. We do not hold them.

4. Why we use your data

• To provide the service you signed up for (our contract with you): your account, sign-in, projects, deployments, agent keys, App VMs and the trial emails.
• To meet legal obligations: answering lawful orders from authorities.
• Our legitimate interest: handling abuse, keeping free credits and the trial to one per wallet and per GitHub account, keeping a record of what our service writes for your wallet so those writes can be checked, and understanding how people find and use Stasho. It also covers keeping the record of what you accepted, our takedown cases and the identifiers that tie them to you, to defend against legal claims. We do not use your data for advertising.

5. Who processes it for us

• Privy: sign-in with email or a social login, and the wallet it creates for you.
• Reown (WalletConnect): connecting your own wallet when you sign in with it. Its relay passes the connection messages between your wallet and our app.
• GitHub: access to the repositories you connect, and the builds that run in them. Your environment variables reach those builds.
• Resend: sending our emails.
• Google: web fonts for our pages, and Forms and Sheets for abuse reports.
• Proton (Proton AG, Switzerland): the mailboxes behind report@stasho.xyz and legal@stasho.xyz, which hold email reports, the kept originals and your requests to us.
• 1Password: our password manager, which holds the evidence kept with takedown cases.
• Telegram: alerts to our operators when something fails, which can name your wallet address.
• Umami: page-view analytics, self-hosted on a server we run.
• The public storage network that holds your sites and your project and deployment records. Anyone can read what is stored there; encrypted fields are stored as ciphertext.
• Independent node operators. Managed App VMs run on confidential compute nodes of the Aleph Cloud network, operated by independent third parties. We have no contract with them. We select nodes for availability, performance and hardware attestation. Each VM’s memory and disk are encrypted, which protects your VM from the node operator. An operator can stop your VM. We hold the keys that unlock your VM, so we can read it.

6. Who else may receive it

A competent authority, on a lawful request. We hand over what we hold that the request covers, which can include the contents of an App VM.

Some processors in section 5, including Privy, GitHub, Resend and Google, and nodes of the public network, process data outside the EU, including in the United States. We do not sell your data.

7. How long we keep it

What	How long
Acceptance records and takedown cases; your wallet address (in the acceptance records and in any takedown case); your email only where a takedown case names it	10 years after your account closes, to defend against legal claims
The marks that keep free credits and trials to one per wallet and per GitHub account	10 years after your account closes, so a trial or free credits are taken once
An abuse report that opens a takedown case	Kept with the case: 10 years, like the case itself
An abuse report that opens no case: form answers, spreadsheet rows and mailbox copies	Deleted within one year
The keyed hash of your IP address, for a drop made without signing in	Until the drop expires; our encrypted backups can hold it for up to 12 months
The service log	Up to about two months
The log of writes	Kept while we run the service
What remains of an agent key after it is revoked or expires, such as its id, wallet, permissions, dates and use count, and for an expired key its recent uses	Kept while we run the service, so a key named in the log of writes can still be looked up
Analytics rows keyed to your wallet, which can name your projects	No end date yet: they stay after you delete a project or close your account, until we add a way to delete them
Copies in our encrypted backups of our own service, stored on the public network	Up to 12 months, until those backups rotate out; other nodes may keep the ciphertext
Everything else: projects, deployments, environment variables, your App VM and its SSH keys, GitHub access, your account with our sign-in provider	Deleted when you delete the thing, or, for your sign-in account, when we close your account on your request. We keep a deleted deployment’s identifiers (its id, content identifier, message hash and date) when we could not confirm the network dropped its files; no step removes them later yet, and they are public on the network
Content removed in a takedown	Not kept; only the address and fingerprints that identify it

The public network is permanent. Nobody, including us, can erase a record from the network; we can stop serving it and mark it removed; copies stay in the network’s history. Encrypted fields become unreadable once the keys are gone, and the messages your own wallet signed stay public forever.

What closing your account cannot reach yet:

• Agent keys you did not revoke stay active, with their name and email.
• Your trial record, with the email you gave for it, stays in our encrypted service cache until we add a way to delete it.
• Projects you did not delete before closing: we stop serving them, but their records stay in our cache and on the network; so does the record of the wallet that pays for your VM.
• Deleting content removes it from what Stasho stores; other nodes of the network may still hold it in their history.

8. Your rights

Write to legal@stasho.xyz to use any of these rights.

• Access and correction. Ask for a copy of what we hold about you, or for a correction.
• Erasure. Closing your account is manual today: ask us at legal@stasho.xyz. If you still can, delete your projects and your App VM, and revoke your agent keys, in the app first. We then delete your App VM if it still exists, stop serving your sites, and delete your account with our sign-in provider if you have one. To end our access to your repositories, uninstall the Stasho GitHub App in your GitHub settings. What stays is listed in section 7; the 10 years start when we confirm the closure to you.
• Restriction. Ask us to stop using your data, other than keeping it, while we check a correction or an objection you made.
• Portability. Ask us for a copy. Your project and deployment records are also on a public network, where your own key opens the encrypted fields: see Recover your data.
• Objection. You can object to what we do on the basis of our legitimate interest, such as analytics.
• Complaint. You can complain to the Belgian data protection authority, the Gegevensbeschermingsautoriteit, Drukpersstraat 35, 1000 Brussel, contact@apd-gba.be.

9. Changes to this notice

This is version 2026-11-02. When we change this notice, we publish a new dated version on this page. The version on this page is the current one.