Privacy Policy

deplo.ai deploys applications from your GitHub repositories into cloud accounts you own. That design keeps our data footprint small: we orchestrate, we don't host. This policy explains exactly what we store, why, and how to get rid of it.

What we collect

• GitHub account basics — your name, email address, avatar, and GitHub username, received when you sign in with GitHub OAuth. This is how your account exists.
• Repository data — repository metadata (names, branches, visibility) and, during stack analysis, the file tree plus a bounded set of small configuration and source files read through the GitHub API. We do not clone or retain full copies of your repositories.
• Provider credentials — your Vercel OAuth token and Render API key, stored encrypted with AES-256-GCM. They are validated before storage, never logged, never displayed again, and used only to run deployments in your accounts.
• Deployment records — status, logs, detected stack, environment variable keys and values you provide, timestamps, and resulting URLs. This is the product's core data.
• CLI tokens — stored as SHA-256 hashes only; the raw token exists once, on your screen.
• Uptime and monitoring samples — HTTP status and latency of your deployed URLs, retained for 7 days.

Cookies

The deplo.ai site sets no tracking cookies. Authentication uses a token in your browser's localStorage; your theme preference is stored the same way. That's it.

Analytics on your deployed sites

If you add the optional insights snippet to a site you deploy, we collect page path, referrer, and a visitor hash that rotates daily and honors Do Not Track — no cookies, no personal data, no cross-site tracking. That analytics data belongs to you as the project owner, and only you can see it.

AI processing

When stack detection needs help or a deployment fails, we send a bounded excerpt of your repository (file tree, small config files, dependency lists) or the failure log to Groq for analysis. Environment variable values and provider credentials are never included. AI output is used to improve detection and explain failures — nothing else.

Who else touches the data

Infrastructure we run on, each processing data only to provide the service:

• Vercel — hosts the deplo.ai frontend.
• Render — hosts the deplo.ai API, workers, and Redis.
• Neon — managed PostgreSQL database.
• GitHub — repository access via the permissions you grant.
• Groq — bounded AI analysis as described above.
• Google (Gmail SMTP) — sends deployment lifecycle emails to you.

We do not sell data, run ads, or share data with anyone beyond the list above.

Emails

We send transactional deployment emails — failure diagnoses, success confirmations, waiting-for-env notices. No marketing lists, no newsletters without your explicit opt-in.

Deleting your data

Deleting your account (Settings → Danger Zone) removes your account, provider credentials, deployment records, and monitoring data. Because your apps run in your own Vercel and Render accounts, deletion never touches your deployed sites. You can also revoke individual pieces at any time: the GitHub App from GitHub settings, the Vercel integration from your Vercel dashboard, the Render key from Render, and CLI tokens from Settings.

Contact

Questions or requests: deploai201@gmail.com. We'll answer within a few business days.