Privacy Policy
Effective 21 October 2026
AutoDeploy (app.autodeploy.fyi and sites under autodeploy.fyi) is run by Krishna Shravan, an individual based in Karnataka, India (“I”, “me”). This policy explains what personal data the service handles, why, who else processes it, and the rights you have under India’s Digital Personal Data Protection Act, 2023.
1. What I collect
- Your account. When you sign in with GitHub: your GitHub user ID, login, display name and avatar address. Your email address only if you enter one for notifications.
- Sign-in sessions. The IP address and browser type each session was created from, kept until the session expires (14 days after you last use it).
- Your projects. Repository addresses, build settings, environment variables (encrypted with AES-256-GCM and decrypted only inside your build), deployment history, build logs, the built files of your site, screenshots taken while checking a deployment, and an audit log of changes (including the IP address each change came from).
- Your source code. Fetched from GitHub for each build into an isolated sandbox and discarded when the build ends. Only the built output is kept, to serve your site.
- Errors and performance. When the dashboard or the server hits an error, a report (the error, the page address and your browser type) is sent to Sentry. Operational metrics and traces go to Grafana Cloud. These never include environment variable values or your source code.
- Visitors to sites you deploy. Requests pass through Cloudflare and AutoDeploy’s edge. For server-rendered apps, the visitor’s IP address is passed on to your app. I don’t profile visitors or add analytics to your site; you are responsible for your own site’s privacy notice.
- Cookies. One sign-in cookie and a token that protects forms against cross-site requests. No advertising or analytics cookies.
2. How it is used
Only to run the service: signing you in, building and hosting your sites, sending the notifications you asked for, keeping the service secure (rate limits, abuse prevention, per-account limits) and fixing problems. Your data is not sold, not used for advertising, and not used by me to train AI models.
3. AI repair
When a build fails and AI repair is on for the project, an excerpt of the build log and the source files it points to are sent to AI providers to suggest a fix: NVIDIA (build.nvidia.com) first, OpenRouter as a fallback, and Cloudflare Workers AI to classify the error. Known secrets and environment variable values are masked in logs before anything is stored or sent. These are free tiers, and the providers may keep inputs under their own terms. AI repair is on by default; switch it off per project in its Build settings if you don’t want its code shared. A suggested fix is never applied to your repository without your approval.
4. Who processes data for me
- Oracle Cloud: servers and database (Mumbai, India)
- Cloudflare: network, edge serving of sites, Workers AI (worldwide)
- Vercel: hosting for this dashboard (worldwide)
- Backblaze B2: built sites, logs, screenshots and encrypted backups (USA)
- GitHub: sign-in and fetching your repositories (USA)
- Resend: notification emails (USA)
- Sentry: error reports (USA)
- Grafana Cloud: metrics and traces (Mumbai, India)
- NVIDIA and OpenRouter: AI repair, as described above (USA)
Some of these store data outside India; the Act permits this except to countries the Government of India restricts.
5. How long it is kept
- Account and project data: until you delete the project or your account.
- Sessions: 14 days after last use.
- Older deployments: each project keeps its latest deployments and the live one; files of older ones are deleted automatically.
- After you delete your account (Settings → Account): database records at once, stored builds and logs within a day, encrypted backups within 4 weeks.
6. Your rights
Under the Digital Personal Data Protection Act, 2023 you can:
- ask for a summary of the personal data held about you and how it is processed;
- correct or update it (your notification email is editable in Settings);
- erase it: delete your account in Settings → Account, or ask me to;
- withdraw consent, by deleting your account;
- nominate someone to exercise these rights if you die or become unable to;
- raise a grievance with me, and then with the Data Protection Board of India.
Write to hello@autodeploy.fyi. I aim to reply within 7 days and resolve requests within 30 days.
7. Security
Traffic is encrypted with HTTPS, environment variables are encrypted at rest, builds run in a gVisor sandbox with limited network access, and backups are encrypted. No system is perfectly secure; if a breach affects your data I will tell you and the Data Protection Board as the law requires. To report a vulnerability, see Security.
8. Children
AutoDeploy is for people aged 18 and over. Please don’t use it if you are younger.
9. Changes
Changes are posted on this page with a new effective date. For significant changes I will also email you if you have set a notification email.
10. Contact and grievance officer
Krishna Shravan, Karnataka, India. Email: hello@autodeploy.fyi.