Log inStart free
Aloof

Privacy policy

Effective: 14 October 2026

This policy explains what personal data Aloof collects, why, who we share it with, how long we keep it and what rights you have. It applies to www.aloof.si, the dashboard, the docs, the API, the CLI and the MCP server (together, the "Service"). If something here is unclear, email sachin@aloof.si.

1. Who we are

Aloof is operated by Enigmatic IT Solutions FZE, a company registered in the United Arab Emirates ("Aloof", "we", "us").

For personal data about you as an Aloof user or website visitor (your account, billing, support requests and how you use the Service), we are the controller. For data that you or your end users put into the apps, databases, volumes and backups you run on Aloof, we are the processor: we handle it only on your instructions, and you are the controller (see section 4 and our Terms of Service).

2. What we collect

Data you give us

  • Account data: your email address and, if you choose one, a password. Passwords are stored only as a salted scrypt hash.
  • Billing data: billing name, country, billing address details and any VAT, GST or other tax ID you add to your billing profile. Card and other payment details are entered on Stripe's pages and never reach our servers; we receive a Stripe customer ID, payment and subscription status and invoice references.
  • Support and communications: what you write to us by email or through support, and our replies.
  • Waitlists: if you join a waitlist (for example for GPUs or a new region), your email, what you signed up for, any company name or note you add, the page you came from, the time you agreed and the IP address of the request.

Data generated when you use the Service

  • Operational data: apps, releases, instances, domains, volumes and databases you create; usage and metering records (compute seconds, storage, backups, egress) used to bill you; platform events and logs.
  • Security and audit data: session records, API key and deploy token metadata (prefix, label, created and last-used times), and an audit log of sensitive actions (for example console exec commands) that may include the IP address the request came from.
  • Sign-in data: single-use magic links (valid 15 minutes) and session cookies (valid up to 14 days). Session tokens, API keys and magic-link tokens are stored only as SHA-256 hashes.
  • AI agent and MCP data: when you connect an AI assistant through our MCP server or API, we record the OAuth client name and host, the scopes granted, and the actions the agent takes on your account, just as if you had taken them yourself.
  • Sign-up attribution: the campaign (UTM parameters) and referring site that brought you to Aloof, stored on your account when you sign up.
  • Integrations you connect: if you install our GitHub App or add registry or git credentials, the installation ID, account login, linked repositories and branches, and the credentials you provide (encrypted at rest).

Customer data

Your application code and images, environment variables, application logs (stdout/stderr), databases, volumes, snapshots and backups, and anything your end users send to your apps ("Customer Data"). We process Customer Data only to provide the Service to you. We don't look at it, analyse it, or use it for our own purposes, except where needed to keep the Service running, to fix a problem you ask us to help with, to enforce our Terms, or where the law requires it.

3. Analytics

On this website, the docs and the dashboard we use PostHog Cloud US (PostHog Inc., data stored in the United States) to count page views and clicks on sign-up buttons, and to see which campaign or referring site brought you here (UTM parameters and referrer). It runs without cookies: no identifier is stored on your device beyond the current browser tab, so no consent banner is shown. When you're logged in, events are linked to your account id so we can understand how the product is used. We don't send your email, app data or logs to PostHog.

Our servers also send a small number of product events to PostHog US under the same account id (for example sign-up completed, first deploy, MCP client connected, plan upgraded, waitlist joined), with only the fields needed to count them, such as the plan, amount or MCP client name.

4. Why we use your data and our legal bases

We rely on the legal bases in the EU and UK General Data Protection Regulation (GDPR) and, where it applies, the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL). Under the PDPL, the purposes below fall within the exceptions to consent for performing a contract, complying with legal obligations, and protecting our and others' legitimate interests, or rely on your consent where we ask for it.

  • Creating and running your account and the Service (sign-in, deploying and running your apps, backups, support): performance of our contract with you.
  • Billing, invoicing and tax (metering usage, charging cards through Stripe, issuing invoices, applying VAT/GST): performance of the contract and compliance with legal obligations (tax and accounting law).
  • Security, fraud and abuse prevention (audit logs, rate limits, investigating breaches of our acceptable use rules): our legitimate interest in keeping the Service and its users safe, and legal obligations where they apply.
  • Service emails (sign-in links, billing notices, security and service announcements): performance of the contract.
  • Product analytics and attribution (section 3): our legitimate interest in understanding how the Service is found and used so we can improve it. You can object at any time (section 9).
  • Waitlist emails: your consent, given when you join. We email you once when the item is available and for nothing else, and you can unsubscribe with the link in the email.
  • Legal claims and requests from authorities: legal obligations and our legitimate interest in establishing, exercising or defending legal claims.
  • Customer Data: processed on your instructions as your processor; your own legal basis applies.

We don't sell personal data, we don't share it for advertising, and we don't use Customer Data to train AI models. We don't make decisions about you based solely on automated processing that have legal or similarly significant effects. The automatic pausing of apps when credit or the Free plan allowance runs out is a mechanical result of your plan and balance, and you can contact support about it.

5. Who we share data with (subprocessors)

We use the following service providers to run Aloof. Each one processes data only on our instructions and under a data processing agreement.

  • Hetzner Online GmbH (Germany). What: hosting of compute, the control plane, databases and volumes in Nuremberg, Germany, and encrypted off-site backups in Hetzner Object Storage in Helsinki, Finland. Data: all account, operational and Customer Data. Location: EU.
  • Stripe (Stripe Payments Europe Ltd., Ireland, and its affiliates including Stripe, Inc., USA). What: payments, subscriptions, invoices, the customer billing portal and tax calculation. Data: email, billing name, address, country, tax ID, payment details and transaction history. Location: EU and USA. Stripe also acts as an independent controller for some data, for example for fraud prevention and its own legal obligations; see Stripe's privacy policy.
  • PostHog Inc. (PostHog Cloud US). What: cookieless product analytics (section 3). Data: page views, clicks, referrer and UTM parameters, browser and device information, account id and product events. No email, app data or logs. Location: United States.
  • Our transactional email delivery provider. What: delivering sign-in links, billing and service emails, and waitlist emails over SMTP. Data: your email address and the content of those emails.

We also share data, only as far as needed, with: Let's Encrypt (Internet Security Research Group, USA), which issues TLS certificates for your app and custom domain names (certificates are published in public Certificate Transparency logs, so these domain names become public); integrations you choose to connect, such as GitHub, container registries, log drain destinations or AI assistants; our professional advisers (lawyers, accountants, auditors); a buyer or successor if Aloof is sold or reorganised, who must keep this policy's protections; and courts, regulators or law enforcement where the law requires it.

We'll update this list before adding a new subprocessor that handles Customer Data. Customers who need notice of changes can ask to be notified at sachin@aloof.si.

6. International transfers

Our infrastructure and the data it holds (your account, operational data and Customer Data) are hosted in the European Union, in Germany and Finland, and analytics data is stored in the EU (Frankfurt).

Aloof is operated from the United Arab Emirates, so personal data is accessed from the UAE by the people who run and support the Service. Some providers, such as Stripe, may also process data in the United States. The European Commission has not issued an adequacy decision for the UAE. Where personal data protected by the GDPR is transferred outside the EEA or UK, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum where relevant) or another lawful transfer mechanism, together with the safeguards in section 8. Transfers out of the UAE are made in line with the PDPL. You can ask for a copy of the safeguards we use at sachin@aloof.si.

7. How long we keep data

  • Account and billing records: while your account is open and for 7 years after it closes.
  • Apps, databases, volumes and other Customer Data: while your account is open. When it's deleted, its apps, databases, volumes, backups, API keys and sessions are removed.
  • Application logs: 1 day on Free, 7 days on Hobby and 30 days on Pro, then deleted automatically.
  • Off-site backups: encrypted copies are rotated on a 7 daily, 4 weekly and 3 monthly schedule, so deleted data can remain in backups for up to about 3 months before it is overwritten.
  • Sign-in data: magic links expire after 15 minutes and sessions after 14 days.
  • Invoices, payment and tax records: as long as tax and accounting law requires, even after the account is deleted.
  • Audit and security logs: 12 months.
  • Waitlist entries: until the item launches and we've emailed you, or until you unsubscribe, whichever is first.
  • Analytics events in PostHog: 12 months.
  • Support emails: 24 months.

We may keep data longer where we need it to resolve a dispute, enforce our Terms or meet a legal obligation, and only for as long as that need lasts.

8. Security

We use technical and organisational measures to protect personal data, including: HTTPS on every public endpoint; environment variables and stored credentials encrypted at rest; passwords stored as scrypt hashes and API keys and session tokens as SHA-256 hashes; HttpOnly, SameSite session cookies with CSRF protection; single-use, expiring magic links; scoped, revocable OAuth tokens for MCP clients; each app instance isolated in its own container; nodes connected over WireGuard; and client-side AES-256-GCM encryption of off-site backups. See our Security page for details. No system is perfectly secure. If a personal data breach is likely to put your rights at risk, we'll notify you and the relevant authorities as the law requires. For Customer Data we'll notify you without undue delay so you can meet your own obligations.

9. Your rights

Depending on where you live, you have the right to:

  • access the personal data we hold about you and get a copy;
  • correct inaccurate or incomplete data;
  • delete your data ("right to be forgotten");
  • restrict or object to processing, including processing based on our legitimate interests such as analytics;
  • data portability: receive data you gave us in a structured, machine-readable format;
  • withdraw consent at any time where we rely on it, without affecting what we did before;
  • complain to a data protection authority. In the EU, that's the authority where you live or work, or where you think the problem happened. In the UAE, it's the UAE Data Office.

How to exercise them: email sachin@aloof.si from the email address on your account, so we can confirm it's you. You can see and export most of your data yourself through the dashboard, API and CLI, and update your billing details in Dashboard → Billing & usage. To delete your account, follow Deleting your account. We'll reply within one month (extendable by two months for complex requests, in which case we'll tell you why), and we don't charge for reasonable requests.

If your request is about Customer Data in an app run by one of our customers, please contact that customer, who is the controller. We'll help them respond.

10. Children

Aloof is a service for developers and businesses. It isn't directed at children, and you must be at least 18 (or the age of majority where you live) to create an account. We don't knowingly collect personal data from children. If you think a child has given us personal data, contact sachin@aloof.si and we'll delete it.

11. Cookies

We use one cookie, and it's strictly necessary: an HttpOnly, SameSite session cookie that keeps you signed in after you log in with a password or magic link, which we protect against cross-site request forgery by requiring an extra header on requests that change anything. It isn't used for tracking or advertising and doesn't need consent. Our analytics are cookieless (section 3). The analytics script keeps campaign and referrer information in your browser's session storage for the current tab only, and it is cleared when you close the tab. We don't use advertising or third-party tracking cookies. Stripe sets its own cookies on its checkout and billing portal pages, under its own policy.

12. Changes to this policy

We may update this policy as the Service or the law changes. We'll change the effective date at the top, and for material changes we'll tell you by email or in the dashboard before they take effect.

13. Contact

Privacy questions and requests: sachin@aloof.si. Legal notices: sachin@aloof.si.