Privacy Policy

• Account info: username, email, and — if you sign up with GitHub — your GitHub identity and profile info covered by that OAuth grant. If you use a password instead, we store a salted, hashed version of it (scrypt), never the password itself.
• Deploy configuration: the SSH host/port/username and private key, or Docker Hub credentials, you enter to configure a deploy target. Private keys and tokens are encrypted at rest (AES) and only ever decrypted server-side to perform a deployment you triggered.
• AWS role ARN (Vision): the IAM role ARN you create and paste in. We never receive or store a raw AWS access key — only short-lived, temporary credentials obtained by assuming that role, which expire automatically.
• Billing info: handled directly by Stripe — we receive your subscription status and plan, never your full card number.
• Usage & audit data: generation runs, deployment history, and an append-only audit log of sensitive account/organization actions (invites, role changes, deploy-target changes, and similar).
• Content you create: anything you write directly in the product — blog posts, roadmap progress, collaboration messages, profile fields.

To operate the Service: authenticate you, run the generation and deployment features you ask for, process payments, send transactional email (verification links, password resets, invites), and maintain the audit log for account security. We don't sell your data, and we don't use your source code or generated files for anything beyond performing the action you requested.

Specific categories of data pass through specific third parties, each only for the purpose that requires it:

• GitHub — repository access, via the GitHub App you install and authorize.
• Stripe — subscription billing and payment processing.
• AWS (SES) — outbound transactional email delivery.
• AWS (your own account) — only when you use Vision, and only via the IAM role you explicitly grant us.
• Our infrastructure host — [hosting provider name, e.g. "DigitalOcean"], which runs the servers the Service itself is deployed on.

We keep account and deployment data for as long as your account is active, plus a reasonable period after cancellation in case you resubscribe. Audit log entries are kept longer, since their purpose is a historical record. Contact us (below) to request earlier deletion.

You can review and update most of your own account data directly from the dashboard. For anything not yet self-service — exporting a full copy of your data, or deleting your account and everything tied to it — email hello@smilekisan.comand we'll handle it directly. If you're in the EU/UK, this covers your GDPR access, correction, and erasure rights; if you're in a state with its own privacy law (e.g. California), it covers those rights too.

We use a single session cookie to keep you signed in and a local preference for light/dark theme — no third-party tracking or advertising cookies.

SSH private keys, Docker Hub tokens, and 2FA secrets are encrypted at rest (AES) and only decrypted server-side, in the moment they're needed to do what you asked. Passwords are hashed with scrypt, never stored in plain text. All traffic to the Service is encrypted in transit (HTTPS/TLS). No system is perfectly secure, but this is the real, current implementation — not an aspiration.

AutoDeploy isn't directed at, and we don't knowingly collect data from, anyone under 16.

We'll post updates here with a new "Last updated" date, and notify active subscribers directly for material changes.

hello@smilekisan.com for anything in this policy, including exercising the rights in §5.