Sthora is operated by AsyncCoders (“we”, “us”). This policy explains what we collect when you visit sthora.com or use the Sthora control plane at app.sthora.com, why we collect it, and what you can do about it. We have tried to write it the way the product is built: collecting as little as the service needs, and saying exactly what that is.
01Our role
For your account, your organization, and how you use the control plane, we decide what is collected and why, and we are responsible for it.
Sthora also records data about the visitors to the applications you deploy — the request analytics described below — and holds the configuration and logs of those applications. We process that data on your behalf and on your instructions, to provide the service to you. If your applications serve your own users, you are responsible for telling them how their data is handled.
02What we collect
Account and organization data:
- Your name, email address, and username, and — only if you add them — a phone number and an avatar URL.
- Your password, stored as a one-way hash; two-factor secrets, stored encrypted; and the public keys of any passkeys you register.
- The organizations you belong to, your role in each, and invitations you send or receive, including the invitee’s email address.
- A billing profile — company name, address, and tax identifier — if you fill one in, and the plan your organization is on.
03Security and usage records
- For each signed-in session: when it started, the IP address, and the browser’s user agent, so you can review and revoke sessions.
- An audit log of significant actions in your organization — who did what, to what, when, and from which address.
04Your servers and applications
- Facts and metrics about the servers you connect: operating system, CPU, memory, disk, network, and per-container usage.
- Projects, applications, domains, deployment records, the commits that triggered them, and build logs.
- Repository addresses, deploy keys, access tokens, and webhook secrets — the secret parts stored encrypted and never returned by any endpoint.
- Environment variables and managed-service credentials, stored encrypted under a key kept outside the database.
Your source code is cloned onto, and your applications and their data run on, your own server. Backups of managed services are written where you send them — your server’s disk or your own S3-compatible storage.
05Request analytics
Requests that reach a connected server through its reverse proxy are recorded for the analytics pages. Each stored request holds its time, method, host, path, status, size, duration, referrer, user agent, country, and the application it reached.
- Client IP addresses are truncated before storage — to /24 for IPv4 and /48 for IPv6. The full address is held only in memory, briefly, to look up the country and verify crawlers, and is never stored.
- Unique visitors are counted with a hash salted daily, which cannot be reversed and cannot be joined across days.
- Sensitive headers are dropped at the proxy, and query string values are dropped by default.
- Countries are looked up in a local copy of the DB-IP Lite database; no address is sent to anyone for the lookup.
06This website
sthora.com sets no cookies and loads no analytics, advertising, or third-party scripts. Requests to it pass through our own reverse proxy and are recorded in our request analytics exactly as described above — truncated address included.
If you email [email protected], we keep the correspondence so we can help you.
07How we use it
- To provide the service: build and run your deployments, show your metrics and analytics, and deliver your alerts.
- To sign you in and keep your account secure, including detecting and investigating abuse.
- To send the email the service depends on — invitations, password resets, and the alerts you subscribe to.
- To apply the limits of your plan.
- To meet legal obligations.
We do not sell personal data, and we do not use it for advertising.
08Cookies
The control plane uses one strictly necessary cookie: the session cookie that keeps you signed in. It expires after at most thirty days. We use no tracking or advertising cookies, on the control plane or on this website.
09Who we share it with
We share data only with the providers the service runs on, and only what each needs:
- Amazon Web Services, which hosts the control plane and its database.
- A transactional email provider, which delivers the email the service sends.
- Let’s Encrypt, which receives the hostnames you add in order to issue certificates. Like every publicly trusted certificate, they are published in Certificate Transparency logs.
- GitHub, if you connect the GitHub App, to list your repositories and report deployment status.
- Telegram, or the webhook endpoints you configure, which receive the alerts you route to them.
We may also disclose data where the law requires it, or to protect the security of the service and its users. If the service is transferred to another operator, this policy continues to apply to the data transferred with it.
10Where it is stored
The control plane and its database run on Amazon Web Services in the Asia Pacific (Mumbai) region, in India. Data held on your own servers stays wherever those servers are.
11How long we keep it
- Account and organization data: for as long as the account or organization exists.
- Sessions: until they expire, at most thirty days, or until you revoke them.
- Stored requests: seven days.
- Analytics charts: minute detail for seven days, hourly for ninety days, and daily for up to 400 days.
- Server metrics: ninety days.
- Audit log entries: for as long as the organization exists, so the record stays complete.
You can delete your account yourself from the portal. Deleting it removes your personal data from the control plane, except where we must keep something to meet a legal obligation. The last owner of an organization must hand it over or delete it first.
12How we protect it
Connections are encrypted in transit. Passwords are hashed; secrets, keys, and environment variables are encrypted at rest under a key held outside the database. Access within an organization is governed by roles, and sensitive reads are written to the audit log. No system is perfectly secure, and if a breach affects your data we will tell you and the authorities as the law requires.
13Your rights
You can see and correct most of your data directly in the portal, and delete your account there. You may also ask us to give you a copy of your personal data, correct or erase it, or stop processing it, and you may withdraw any consent you have given. Under India’s Digital Personal Data Protection Act, 2023 you may also nominate someone to exercise these rights on your behalf, and raise a grievance with us.
Write to [email protected] for any of these, including grievances. We will answer within thirty days.
14Children
Sthora is a tool for running software and is not meant for anyone under eighteen. We do not knowingly collect data from children.
15Changes to this policy
When we change this policy we update the date at the top. If a change is material, we will tell account holders by email or in the portal before it takes effect.
16Contact
AsyncCoders — [email protected]