Privacy policy

Last updated 2026-10-11

ox Cloud (deploywithox.com) deploys your repositories onto servers that you own. This page says what ox keeps about you, what it does not keep, who else sees it, and how to use your rights. Questions about any of it: contact@deploywithox.com.

The short version

• ox keeps your GitHub identity, your servers, projects, settings, run records and an audit log, on its server in India, with backups in the United States.
• Your apps, their databases, variables, backups and logs stay on your own server.
• No analytics, no ads, no selling data.
• Download your data or delete your account yourself, in Settings.

1. Who is responsible

• For your account data, ox is the controller. That is what ox collects to run your account: who you are (from GitHub), your servers, your projects, your settings, and the audit log.
• For your applications' data, ox is at most a processor, and mostly not involved at all. Your app, its database, its uploads, its variables, its backups and its logs live on your own server. ox runs an agent there that carries out the actions you ask for. ox does not copy your application data to the plane, and does not read it for its own purposes. What passes through is what you ask to see or send: the logs you open or download, the rows, keys, or results you open in Explore, a backup you download or upload for a restore, and the variables you view or save. They are read or written on your server, pass through the plane between it and your browser, and are not stored. ox also carries a project's variables through the plane, without storing them, when it copies them to a new staging copy or preview (once you turn previews on, the poller or a GitHub push makes them), and reads them to check which keys a refused deploy still needs. You are the controller of the personal data your own users give your apps.
• ox Cloud is run by Saurav Sharma, one person in India, as an individual, not through a company. In this policy, "ox" means him. Under the GDPR he is the controller of your account data. Under India's Digital Personal Data Protection Act, 2023, ox is the Data Fiduciary for your account data. The contact for all privacy matters, grievances included, is contact@deploywithox.com (section 13).

2. What ox stores about you

Data	Why	Where and how long
Sign-in identity from GitHub: numeric GitHub user id, login, display name, avatar address, email address (your primary verified one on GitHub, which may be a private one: ox does not sign you in without one), and when the account was created	Your account is your GitHub user id. The login and name are shown in the dashboard. The email is shown, and used to reach you. The avatar address is kept but not shown.	The plane's database, refreshed at each sign-in, until your account is deleted (section 8).
GitHub tokens from sign-in (a user token and a refresh token)	To list and read the repositories you choose, on your behalf.	The plane's database, encrypted (AES-256-GCM) under a key kept in a separate root-only file.
Sessions: a one-way hash of a random token, when it was made and when it ends; during a GitHub sign-in, a record that ties it to your browser	To keep you signed in.	The plane's database. A session ends after 30 days or when you log out. Logging out deletes its record, and a session that ran out is deleted within ten minutes. The sign-in record works for 10 minutes and is deleted within ten minutes after that.
Personal tokens for the CLI and scripts, with their name (the CLI names one after your computer)	To let the CLI act as you.	Only a one-way hash, a name and when it was last used. A token works for 90 days. Its record is deleted when you revoke it in Settings, within ten minutes of the end of its 90 days, or when you delete your account. The audit log keeps the token's name in its own rows (below).
Sign-in codes for ox login, with the IP address that asked, the CLI's name (with your computer's name), and when	To approve the CLI on your screen.	The plane's database. A code works for 10 minutes. Its record is kept one more hour, so the page can say the code expired, and is then deleted within ten minutes.
Your servers: the name, hostname, IP addresses, memory, disk, system version, ox version and operator SSH public key the agent reports, when it was last seen, and a hash of the agent's credential	To show and reach your servers.	The plane's database, until you forget the server or delete your account. After you forget a server, or delete your account, only the server's number, the credential's hash, the time, whether its agent can leave on its own, and when ox last checked on an agent that could not, until its agent leaves or for 12 months (section 8).
Usage history the agent reports: CPU, memory and disk use of your servers and projects, and of each process by name	To draw the charts and send usage alerts.	The plane's database. Minute points are kept 24 hours, 15-minute points 30 days.
Your projects: name, repository address, branch, domains, the settings you choose for it, and a record of each run (what was asked, the commit, the result, the times, and for a failed run its error, see below). Your GitHub App installations: their id and the GitHub account or organization name.	To deploy and to show your history.	The plane's database, until the project is deleted. Runs have no age limit. The record of a project's delete stays until your account is deleted.
Settings you save: your S3 backup target (endpoint, bucket, region, access key, and the secret key), a Hugging Face token, your preview domain, and which alerts you want; and which alerts are open now, and the last error from sending you an email	To copy your backups to your bucket, to download your models, to send only the alerts you chose, and to send a note when a problem is over.	The plane's database. Both S3 keys and the token are encrypted (AES-256-GCM).
Audit log: your account, who acted (you, or the token's name), what was done (deploy, rollback, variables save, restore, delete, token create or revoke, server add or forget, showing values, a change made from Explore), what it was done to (for a statement run from Explore, its words with every value taken out, and how many rows it changed), the time, and the IP address the request came from. It also notes each alert ox sent you.	Security, and so you can see what happened on your account.	The plane's database. You see it in Settings. Each row is kept 12 months and then deleted. If you delete your account first, its rows keep only the action and the time until they reach 12 months (section 8).
Repository push notices from GitHub: a delivery id	To ignore a notice sent twice.	7 days.
Operational logs on the plane's server: the plane's own events and errors (such as a failed deploy, backup or webhook delivery), which can name your account number, GitHub login or email address, and your projects, servers and repositories; a line with the IP address for each request ox refuses as unsafe or too frequent; the web server's certificate messages; and the server's own sign-in and firewall logs, which record the IP addresses that connect to it. There is no log of each web request.	To run and secure the service.	On the plane's server. The system journal keeps them up to 30 days (at most 1 GB), and the system log files that copy them are kept up to 5 weeks (Ubuntu's default).

What ox does not keep

• Variables and secrets for your apps stay on your server. The plane carries them to the agent and keeps no copy.
• Your app's data, databases, uploads and its users' data are on your server only.
• Run logs are written on your server. The plane shows them live and holds the output in memory only, while a run is in progress and for a minute after. Logs you open or download pass through the plane and are not stored. One exception: when a run fails, its error, with up to its last 40 lines of output (secret values hidden), is saved with the run's record in the plane's database, and its first 500 characters go into the failure alert email. No other run output is written to the plane's disk.
• No account password. Sign-in is through GitHub. If you protect staging copies or previews with a site password, ox keeps only a one-way hash of it.
• ox does not sell your data, does not share it for advertising, and does not profile you.

3. Cookies and tracking

ox sets only the cookies it needs to work, so no consent banner is shown:

• __Host-ox_plane_session: keeps you signed in, and the forms you send carry a code derived from it so another site cannot send them for you. Not readable by scripts. 30 days.
• __Host-ox_oauth: ties a GitHub sign-in to the browser that began it. Lasts 10 minutes.

ox has no analytics and no advertising trackers, and loads no third-party scripts or fonts: every page, the signed-in dashboard included, gets its fonts and scripts from ox itself. One blog post shows a picture hosted on cdn.hashnode.com, so Hashnode sees your IP address when you open that post. The dashboard's theme and transparency choices are saved with your account. The public site's light or dark theme and a few dashboard display choices (how logs are shown, where you scrolled) stay in your browser's local storage and are not sent to ox.

4. Who else handles the data

• GitHub: your identity provider, and where your repositories are. ox uses a GitHub App that can read the repositories you pick, and write their deployments, so a pull request links to its preview or staging copy. GitHub's own policy applies to what it holds.
• Cloudflare: deploywithox.com sits behind Cloudflare as proxy and CDN, so Cloudflare sees traffic to the site, including your IP address.
• DigitalOcean: hosts the plane's server in its Bangalore (blr1) region, in India. The plane's database, its hourly copies on that server, and its logs are kept there.
• Backups of the plane: the plane's database is copied every hour, and the newest 24 copies are kept on the plane's own server. Each copy is also sent to an S3-compatible storage bucket that ox owns, which keeps the newest 168 copies (7 days). That bucket is DigitalOcean Spaces in its San Francisco (sfo3) region, in the United States. No copy is kept longer than 30 days.
• Resend: sends ox's emails. For the alerts you leave on in Settings, ox emails the address from your GitHub account through Resend: a deploy or backup fails, a process keeps crashing, a site or server stops answering, a project is close to its memory limit or uses too much CPU, a server's disk is almost full, and, if you turn it on, a deploy finishes. Most of them also send a note when things are back to normal. Resend receives your email address and the alert: what happened, the project and server names, a link, for a usage alert the percentage, for a finished deploy its commit, and for a failed run the start of its error. Your first sign-in also sends a welcome email through Resend, with your email address and your first name or GitHub login. A few emails are not alerts, so turning alerts off does not stop them: one when your account is deleted, one when your Pro plan ends or a payment fails, one when a webhook endpoint of yours is switched off, and the test email when you press Send a test email. ox sends no marketing email. Each alert email ends with a link that turns off that kind of email in one click, without signing in, and the email carries the standard unsubscribe header your mail program uses for its own Unsubscribe button. In Settings you choose which alerts you get, or turn them all off.
• Your webhooks: endpoints you add receive events as signed JSON with names and links only: no variable values, tokens, passwords, or log lines. The address, signing secrets, and any header value are stored encrypted. Each event, and its delivery log (time, event, status, latency, and at most 1 KB of a failed answer), is kept until 7 days after its delivery ends. The endpoint's description and its last error stay until you delete it.
• Your own services: your servers' hosting company, and the S3-compatible storage you pick for your backups (any provider), are chosen by you, are your processors, not ox's, and work under their own terms.
• Let's Encrypt: Caddy on your server, and on ox's, gets HTTPS certificates from Let's Encrypt (or ZeroSSL, Caddy's fallback). They see the domain names, and every certificate is published in public certificate logs, so those names are public.
• Email to ox: mail to contact@deploywithox.com goes through Cloudflare Email Routing to the operator's own mailbox, and is kept there as long as needed to answer and follow up.
• Payments: ox Cloud is free during the beta and takes no payments yet. When paid plans start, Dodo Payments, the merchant of record, will take payments and hold your card details; ox will never see or store them. ox will send Dodo your account email (to fill in the checkout) and your ox account id, and will keep only Dodo's customer id, your subscription id and its status. This page will be updated, with the date, before paid plans start.
• ox does not rent or sell data to anyone else.

5. Where data goes

ox runs from India, and the plane is in India (DigitalOcean, Bangalore), so your account data is sent to India and stored there. The plane's off-site backups are stored in the United States (DigitalOcean Spaces, San Francisco), so a copy of your account data is also sent there. ox uses GitHub, Cloudflare, DigitalOcean and Resend under their standard public terms and has no special agreements with them. Each of them handles what it receives in its own locations, which can be outside India.

6. Why ox may use it

India (DPDP Act, 2023): you give ox this data when you sign in, to run your account, and ox uses it only for that and to keep the service secure. You can withdraw by deleting your account (section 8).

EU, EEA and UK (GDPR, UK GDPR):

• Running your account and the service you asked for (contract): the identity, servers, projects, settings and tokens in section 2.
• Security and preventing abuse (legitimate interests): the audit log, IP addresses, rate limits and logs.
• Keeping the service running (legitimate interests): backups of the plane's database.
• Meeting legal duties, where they apply to ox.

ox does not use automated decisions that have legal effects on you.

7. Your rights, and how to use them

Two of them need no email. Get a copy: in the dashboard, Settings, Your data, Download my data, or ox account export. You get one JSON file with your profile, servers, projects, runs, audit log, token names and settings; it holds no secret, and your apps' variables and data are on your own servers, so they are not in it. Three downloads an hour. Delete your account: Settings, Delete account, or ox account delete --confirm <your GitHub login> (section 8). For anything else, such as a correction or an objection, email contact@deploywithox.com from the address on your account, or say which GitHub login is yours. ox answers within 30 days.

• Everyone: ask what ox holds about you, get a copy, have it corrected, or have it deleted.
• In India (DPDP Act, 2023): also get a summary of your data and of who it was shared with, have a grievance handled (section 13), and name someone to use your rights if you die or cannot. If ox's answer does not settle a grievance, you can complain to the Data Protection Board of India.
• In the EU, EEA and UK (GDPR, UK GDPR): also object to or restrict processing, take your data in a portable form, withdraw consent where it is the basis, and complain to your data protection authority (in the UK, the ICO).
• In California (CCPA/CPRA) and other US states: know, access, delete and correct your personal information, and not be treated worse for using these rights. ox does not sell or share personal information for cross-context advertising, so there is nothing to opt out of, and it does not use sensitive personal information to infer traits about you.
• Elsewhere: ox applies the same rights to every customer, whatever local law adds.

For data in your applications, which is on your server, make the request to the app's owner (your customer, if you are their user). ox cannot see it.

8. What happens when you delete things

• Delete a project: once your server confirms the delete, the plane removes the project and its run records, but for the record of the delete itself. On your server, the app stops and its files, database and users are removed, and ox keeps a copy of its data and variables in a trash folder on your server for 7 days, so you can restore it, and then removes it. Backups you copied to your own S3 bucket stay there until you delete them. Audit rows about the project stay.
• Forget a server: allowed once it has no projects. The plane deletes the server record and its credential, and the ox agent then removes itself from the server, at once or when the server is next online; for an agent too old to do it, the answer gives a command to run instead. Whatever still runs there keeps running, and /etc/ox/LEFT.txt on it says what. sudo ox uninstall on the server removes everything else ox created.
• Revoke a token: it stops working at once.
• Delete your account: in Settings, Delete account (or ox account delete --confirm <your GitHub login>). You type your GitHub login to confirm. Your apps keep running: nothing on your servers is stopped or deleted. First ox cancels a Pro subscription at Dodo Payments, so you are never charged again; if Dodo cannot be reached, nothing is deleted and the page says why. Then, at once, ox removes your sessions and personal tokens (they stop working), your servers' records and credentials, your projects and their run records, your metrics, your settings (S3 target, Hugging Face token, webhook, notification choices), your alert records, your GitHub connections, your plan, and your account record with the GitHub tokens it held. The ox agent on each server then removes itself and leaves a note at /etc/ox/LEFT.txt that says where everything is; a server that is offline does it when it next connects, and an agent too old to do it gets a command to run instead (the page lists each server). After that, nothing on the server is managed by ox: no deploys, backups or alerts. ox then asks GitHub to revoke its authorization on your GitHub account; if GitHub does not answer, the page says so and you can remove ox at github.com/settings/applications. ox then sends a confirmation to your address through Resend. Kept: the audit rows stay for security, each with only its action and time: your login, the address and what was acted on are removed. Each is deleted when it is 12 months old. For each of your servers, ox keeps its number, a one-way hash of its credential, the time, whether its agent can leave on its own, and when ox last checked on an agent that could not, with no name or address, only so its agent can be told to leave; the record goes when the agent leaves, or after 12 months. ox also keeps a one-way keyed hash of your GitHub account number and the time you deleted, with no name or address, on the plane's server and in ox's bucket, only so that restoring an older backup of the plane deletes your account again; it goes after 30 days, when no backup that holds your account is left. Dodo Payments, the merchant of record, keeps its own records of your payments (section 4). Removing the ox GitHub App from your repositories is done on GitHub, and ends ox's access to them.
• Backups of the plane: deleted data can remain in the plane's backups for at most 30 days while ox Cloud runs. The plane keeps its newest 24 hourly copies on its server and the newest 168 in ox's own bucket (section 4). Each update of the plane, and a restore, also leaves a copy of the database on the plane's server, and the operator may copy it by hand to move or test the plane. Those copies are not edited, so a deleted account is gone from them only as they age out (if a copy is ever restored, the plane deletes the account again from a record of deletions it keeps apart from its backups, before it serves anyone, and nobody can sign in to the account meanwhile; only if that record were lost too could the account come back): the plane deletes each one once it is 30 days old, and the operator deletes a hand-made copy within 30 days. Only if the plane itself were stopped for weeks could a copy outlive that, until the plane runs again for a few days.

9. Security

What ox does, and nothing more: the plane's secrets (GitHub tokens, S3 keys, Hugging Face tokens, webhook secrets) are encrypted with a key kept outside the database; personal tokens, server credentials and site passwords are stored only as hashes; each account sees only its own data; the agent on your server connects out to the plane over HTTPS and the plane never connects in to it (it only checks that your sites answer); agent updates need ox's release key as well as the plane's; and every action on your account is audited. Security says more. No system is perfectly secure, and ox is run by one person.

10. If something goes wrong

If ox learns of a breach that affects your personal data, it will email the address on your account without undue delay, saying what happened, what data it touched, and what you should do. ox will also report it to the authorities where the law requires, such as the Data Protection Board of India and CERT-In.

11. Children

ox is for people 18 or older (or the age of majority where you live). ox does not check ages. If ox learns that an account belongs to a minor, it may close the account and delete its data.

12. Changes

If this policy changes in a way that matters, ox will email account holders at least 14 days before the change takes effect. The date at the top is the last change.

13. Contact and grievances

For questions, requests and grievances about your data, write to contact@deploywithox.com. Saurav Sharma, who runs ox, reads it and answers. ox acknowledges a grievance within 7 days and answers within 30 days.