Privacy policy

Last updated: 2026-10-30.

xhostd ("we", "us") runs a hosting platform and is responsible for the personal data this policy describes. This policy explains what we do with that data.

In this policy, our Sites means the websites and console we operate at randomimity.com. The Services means the hosting platform itself. Your Content means the projects, code, databases and files you deploy and store on the Services.

Who this covers

Visitors to our Sites.
Account holders who use the Services, or whose agent uses them on their behalf.
End users who sign in to an app an account holder runs on the Services.

An account holder decides what their app collects and what it does with it. Once data reaches their app, their privacy notice applies rather than ours.

Your Content

Your Content is yours. We store and run it to provide the Services, and back it up so you can recover from a mistake or a failure.

Our staff do not read Your Content in the ordinary course of running the platform. We access it to repair a fault, restore a backup, or help you with something you have raised with us.

Running the Services creates operational records, and those can contain your data. Logs, diagnostics, performance traces and error reports are a normal part of keeping a platform healthy, and they can include fragments of Your Content or of an end user's data — the text of a slow database query, for example, or an error quoting the value that caused it. We create and read these to run, secure, maintain and repair the Services. They are covered by everything else in this section, and they expire as described under How we retain information.

We do not use Your Content for any other purpose. We do not train models on it, analyse it, advertise from it, sell it, or share it, except with the service providers listed below who store or process it for us under contract. You can also direct us to disclose it: to the members of a project you share, as described under Shared projects; to the members of another account's project that you send feedback on, as described under Feedback on another account's project; and to an AI client you connect, as described under Agents and connected clients.

Deleting a project removes it from the Services. Copies can remain for the periods described under How we retain information.

Information we collect

From visitors to our Sites. With your consent, a third-party analytics service records page views and clicks. With your consent, when you arrive through a partner's link, our partner-programme provider records the visit. We also set the cookies described under Cookies.

From account holders. We hold your email address and username; credentials such as sessions, API tokens and SSH public keys, with secrets stored only as one-way digests; metadata about your projects, including names, settings, deployment history and activity; diagnostic records such as build output and notable platform events; and billing records. When you sign up, we also record where you came from: referrer, affiliate, and other relevant information. Where we need to limit abuse, we store a salted, one-way hash of the data rather than the data itself. The one exception is the link that adds an email address to an account: we record each address we send that link to, so that we can limit how many of these links one address receives. When your agent works with the Services, we count each operation it performs. Each count records your account, the day, the operation, the retired name or form of the operation if the agent used one, the version of the operation list that the client reports, the name of the client software, the number of calls, and the time of the latest call. A count records nothing from the content of the request. We use these counts to see which operations agents rely on and to retire old ones safely, and we delete them after 90 days.

Feedback you send. When you or your agent sends us feedback, we store the report, its subject, the project it names, if any, and the replies on its thread, so that we can answer you and improve the Services. When you or your agent sends feedback on another account's project, we store the text, its category, and the label of the token that sent it, so that the members of that project can read it. See Feedback on another account's project.

We also count traffic to your apps so you can see how they are used. We measure this ourselves and set no cookie on your visitors. To estimate unique visitors we store a salted one-way hash of the visitor's address. Country is derived from a lookup database we hold locally. This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

From end users signing in to an app. When you sign in to an app through our managed Google sign-in, we receive your basic Google profile and pass it to that app in a signed cookie only it can read. We keep no user database for this, but we record that the sign-in happened.

Agents and connected clients

You can connect an AI client, such as ChatGPT, Claude, Codex, Cursor, or another client that uses the Model Context Protocol (MCP), to the Services. The client sends us the operations that its agent performs for you, and we return the result of each operation to the client. A result can include Your Content, such as your source files; your project settings; deploy and runtime logs; and the usernames, notes, and activity of the members of a shared project. The client's provider receives these results at your direction, and handles them under its own privacy policy, not this one.

Connected git hosts

You can connect a repository on GitHub, through a deploy key or the xhostd GitHub app, or on Cursor Origin, through the xhostd Cursor Origin app. We use what we collect from these hosts to fetch your repository and deploy it.

What we store. We store the repository's address, which names its owner and the repository, and a copy of its contents. That copy is Your Content, and its commit history records the name and email address of the author of each commit. For a deploy key, we store the key, with its private half encrypted. When you connect through our app, we also store the name and ID of the account or organization that our app is installed on, whether the installation covers all of its repositories or a selection, the permissions the host granted our app, and whether the installation is active, suspended, or removed. We also store the account ID, on that host, of the person who connected it, which links the installation to their xhostd account.

What we read and do not store. When you connect through our app, we check that you are allowed to connect the installation. From Cursor Origin, we read who approved the installation, including their name and email address. A cookie in your browser holds these for up to 10 minutes while the connection completes, and a page that asks you to confirm the connection shows them. From GitHub, we read your username and, for an organization, your role in it. GitHub issues a temporary access token for this check, and we discard the token once the check is done. We do not store the name, email address, or role that we read, or the token. We store a username only when it is also the name of the account that our app is installed on. Each host also sends us a notice when someone pushes to a repository or changes an installation, and that notice carries data about the person who acted. From a notice, we read only the installation and the repository it names, and from Cursor Origin also the repository's owner and name. We do not log or store the rest of the notice.

Permissions for planned features. Our app on these hosts also asks for permissions that cover features we plan to add, such as reporting deploy results and responding to pull requests. These permissions can let our app see the email addresses of the people who take part in pull requests and reviews, and the roles that people hold in a repository or an organization. Apart from the role check that confirms you may connect an installation, we do not currently read or store this data.

You can disconnect a git host account on your account page in the console.

Shared projects

When you share a project, its members see each other's usernames and roles, the notes they write, and the project's activity record. The activity record names the member who made each change. For an invitation, it records the username or email address that the inviter typed. The owner and the admins of a project also see that username or email address while the invitation is pending. When an invitation names an address or username that belongs to no xhostd account, we record nothing and send nothing.

Feedback on another account's project

You or your agent can send feedback on a project that another account owns. The members of that project read the text, its category, and the label of the token that sent it. The project's activity record names your username as the sender, and the project's owner receives a notification that carries the text.

How we use information

To provide, secure and improve the Services; to authenticate you; to bill your plan; to answer you when you contact us; to meet legal obligations; to improve our marketing; and, with your consent, to measure how our Sites are used.

We do not sell personal data, and we do not use it for advertising without your consent.

Cookies and your choices

Our Sites set cookies that are strictly necessary, such as allowing you to sign in, taking a payment when you check out, and remembering the cookie choice you made. These carry no toggle, because the Sites cannot work without them.

Other categories need your consent. A panel asks for it on your first visit and names each category it covers. Accepting and rejecting carry equal weight, and nothing in a category loads or is stored until you allow it. Today those categories are:

Analytics — cookies set by our analytics provider.
Marketing — cookies set by us and by our partner-programme provider that remember how you reached us, kept for up to 90 days after they were last updated, so a referring partner is credited and we can improve our marketing.

On those pages, the footer carries a control that allows you to withdraw consent. Withdrawing removes what that category stored on your device. It doesn't recall data already sent to a provider or recorded with your account.

How we retain information

We keep personal data for as long as we need it for the purpose we collected it, and then delete it. A project's notes and activity record last while the project exists. Other records have these periods:

Build and deploy output: 30 days.
Records of notable platform events: 180 days.
Records of operational failures: 14 days.
Your apps' runtime logs, which we collect centrally: the retention period your plan sets. We delete them sooner when you delete the app or channel that wrote them.
Our own services' logs, which we collect centrally: 14 days.
Other logs on our servers, including the recent output of your running apps: no fixed period. Each log drops its oldest entries when it reaches its size limit.
Snapshots of your apps' databases and files: the period, or the number of snapshots, that your plan sets.
Data exports you request: 24 hours.
Links we email to confirm an address or reset access: a link works for 60 minutes, or 24 hours for a sign-up link. We keep the record of each link, with the address it went to, for up to 30 days after it expires.
Counts of your agent's operations: 90 days.
Traffic to your apps: salted hashes of visitors' addresses for 30 days, hourly detail for 7 days, and daily detail for 90 days. We keep daily traffic totals, which identify no visitor, until you delete the app or channel they belong to.
The link between your xhostd account and your account on a git host: until you disconnect that account or close your xhostd account.
Records we keep to run and protect the Services, such as git host installations, the emails we send you, the feedback you send us, and our limits on emailed links: until you ask us to erase them.
Feedback you send on another account's project: while that project exists. The notification that carries its text remains until the owner's account is erased.

When you close your account, we cancel your subscription, delete your apps, and revoke your access at once. Your account record and its history, including billing records, remain until you ask us to erase them, as described under Your rights.

Deleted data can remain in our backups and storage after you delete it. Most backups last about two weeks. Some copies, such as older backups and files your apps stored, can remain longer.

We use third-party service providers to run our infrastructure, host and back up data, deliver email, provide sign-in, take payment, measure our Sites, and run our partner programme. They act for us under contract and may use what they receive only to provide their service to us.

Our providers are Amazon Web Services, Backblaze, Cloudflare, Contabo, FirstPromoter, Google, Hetzner, MaxMind, Microsoft Azure, netcup, Paddle, PlanetScale, and Postmark.

You also direct some disclosures yourself. The members of a project you share receive the data described under Shared projects. The members of another account's project that you send feedback on receive the data described under Feedback on another account's project. The provider of an AI client you connect receives the data described under Agents and connected clients.

We also disclose personal data where the law requires it, and to a successor in the event of a merger or acquisition.

Card details go to our payment provider and never to us.

International transfers

Some of our providers process data outside the European Economic Area, relying on the transfer safeguards available to them.

How we secure information

We hold secrets only as one-way digests, restrict staff access to what an operational task requires, and encrypt data in transit. No system is perfectly secure, and we cannot guarantee absolute security.

Your rights

Depending on where you live, you may ask us for a copy of your personal data, ask us to correct or erase it, object to or restrict how we use it, withdraw a consent you gave, or complain to your data protection authority.

Write to support@randomimity.com from the address on the account or sign-in. For data an account holder's app stored about you, contact that account holder directly.

Children

The Services are not directed to children under 16, and we do not knowingly collect their personal data.

Changes

We update this policy when our practices change, and revise the date above when we do.

Contact

support@randomimity.com