Hal9 Inc ("we", "us") operates Cloudish, a platform where people and their AI agents build and run containers. This policy explains what information we handle when you use Cloudish, why, how long we keep it, and what choices you have. Terms used here have the meanings given in our Terms and Conditions.
Cloudish is built by a team with years of experience running infrastructure at scale. We take privacy and security seriously, follow established security practices, and test the Service regularly, including through penetration testing. Even so, the Service is provided "as is" and "as available": we do not promise that it is free of defects, vulnerabilities, data loss, or unauthorized access, and we make no security, availability, or durability commitment beyond what this policy states. Nothing in this policy expands our liability beyond what the Terms and Conditions allow.
Designing for your requirements
As with any infrastructure, an individual container can restart and an individual disk can fail; on its own, the Service does not protect against data loss or downtime. What we offer instead is transparency: we document how the Service works, including which data center each workload runs in, so that you can design for the durability, availability, and security your workload needs — for example, by deploying to more than one data center, or by keeping your own backups with a storage provider of your choice. Designed with these tradeoffs in mind, highly reliable and secure systems can be built on Cloudish.
If your workload is subject to regulatory requirements, such as HIPAA, please contact us before using Cloudish for it. Some of our data centers can support such workloads, subject to a conversation with our team about your needs and any agreement those regulations require (such as a Business Associate Agreement). Until we have agreed to this in writing, please do not use the Service to store or process regulated data.
Two kinds of information
- Account information — information about you as a user of Cloudish (your sign-in identity, keys, credits, purchases, support requests). We decide how this is used, as described below.
- Your content — whatever you or your agent put on the platform: source code, build contexts, images, environment variables and secrets, files on volumes, logs, and the data your applications process. We handle your content only to run the Service for you. You are responsible for it, including any personal information about other people it contains and any notice or consent the law requires you to give them.
What we collect
Accounts, keys and sign-in
An API key can be created without an account. For each key we store its alias, the key itself, any email address you choose to attach, its settings, and timestamps. If you sign in on cloudish.ai, sign-in is handled by our third-party identity provider, which gives us your account identifier, email address, whether that email is verified, and your name if you have set one. We link that identity to the keys you claim or create.
Uploaded source code and build contexts
When you deploy, the files you upload (your "build context") are stored on our infrastructure and used to build a container image. The build runs in a temporary, per-build environment that is removed shortly after it finishes. The uploaded archive itself, the build's logs, and the resulting image may be kept after the build completes, until you delete them (where the Service lets you), we delete them, or the account is removed. Image builds share a build cache, and cached layers are removed on a rolling basis. Do not include secrets in the files you upload — use the Service's secrets feature instead.
Secrets and environment variables
Secrets and environment variables you configure are stored so that we can provide them to your containers at runtime. We take reasonable steps to limit who and what can read them, but anything you configure is necessarily available to the platform that runs your container. Give your applications credentials scoped to what they need, and rotate any credential you believe may have been exposed.
Persistent data
If you attach a volume to an application, the files written to it are stored on disks operated by us or our infrastructure providers. Volumes are kept while the application exists — including while it is stopped for being idle or out of credits — and are deleted when you delete the application or project. We do not back up volumes for you; if the data matters, keep your own backups (see Designing for your requirements above).
Logs and usage
We record build logs, a recent portion of your containers' output, and the compute your applications use (time, CPU, memory) so that we can bill credits and help you debug. Our servers and networking components may also record operational logs, which can include IP addresses and requested URLs, used to operate, secure, and troubleshoot the Service.
Credits and billing
We keep a ledger of credits granted, purchased, transferred, donated, and spent for each key, including the other key's alias for transfers and, for some grants and donations, the email of the signed-in person involved. Card payments are processed by third-party payment providers; we do not receive or store your full card details. We store a record of each completed purchase (amount, time, and the key it funded).
Support requests
When you contact us through Help, we store your messages, our replies, and your email and name, and our support staff can read them.
Visitors to applications hosted on Cloudish
Applications hosted on Cloudish are run by their owners, not by us. When you visit one, we pass your request, including your IP address, to that application, and we may set a cookie needed to route you to it. If you sign in to a hosted application with "Sign in with Cloudish", we share your account identifier, email address, and name with that application. Each application's owner is responsible for how it handles your information.
Cookies and local storage
We do not use advertising or analytics cookies. cloudish.ai stores sign-in tokens and your theme choice in your browser so you stay signed in, and loads fonts and some page assets from third-party content networks, which receive your IP address when they do.
How we use information
We use the information above to provide, operate, bill for, secure, and improve the Service; to respond to support requests; to prevent abuse; and to comply with law. We do not sell your information, and we do not use your content to train AI models.
Who we share it with
- Infrastructure providers that host the Service (cloud providers, and hardware we operate ourselves), and providers of DNS and TLS certificates.
- Identity and payment providers, for sign-in and for processing payments.
- Applications you choose to sign in to with Cloudish, as described above.
- Authorities or others when we believe in good faith that the law requires it, or that it is necessary to protect the Service, our users, or the public.
- A successor, if Hal9 Inc or Cloudish is involved in a merger, acquisition, or sale of assets.
Members of our team can access account information and your content when needed to run the Service, investigate abuse, or help you. We limit this to what the task requires.
Retention and deletion
We keep information for as long as the related key, project, or account exists and as long as we reasonably need it afterwards for billing, security, abuse prevention, and legal obligations. Stopped applications are not automatically deleted. You can delete projects, applications, secrets, builds, and image tags yourself through the API; deleting a project removes its running containers, configuration, and volumes. Some items — such as uploaded build archives, credit history, and support conversations — cannot yet be deleted by you directly. To ask us to delete your account, a key, or specific data, write to us (see Contact Us); we will do so within a reasonable time, except where we need to keep something as described above. Deleted data may persist for a period in internal backups or logs before it is overwritten.
Security
We follow commonly accepted practices for the platform we run on, including TLS for traffic to the Service and access restricted to the team members who operate it. Applications from different customers run on shared infrastructure, and we do not guarantee isolation between them. No method of transmission or storage is completely secure, and we cannot guarantee the security of any information. You are responsible for securing your own applications, keys, and credentials. If we learn of a security incident affecting your information, we will notify you where the law requires.
Where information is processed
Cloudish runs in data centers in the United States and may run in other locations where we or our providers operate. By using the Service you understand that your information may be processed in those locations.
Your choices and rights
You can stop using the Service at any time, delete what the Service lets you delete, and ask us to access, correct, or delete information about you. Depending on where you live, you may have additional rights under local law; we will respond to requests as that law requires.
Children's Privacy
Cloudish is not directed to anyone under 13, and we do not knowingly collect personal information from children under 13. If we learn that we have, we will take steps to delete it. If you believe a child has provided us with personal information, please contact us.
Changes to This Privacy Policy
We may update this policy from time to time, for example as the Service changes. We will post the updated policy on this page and change the "Last updated" date above. Continuing to use the Service after an update means you accept it.
Contact Us
For questions about this policy, or to request access to or deletion of your information, use Help or write to info@hal9.ai.