Privacy Policy

Account data. Your name, email address, and password (stored only as a hash). If you sign in with Google or your organization’s SSO, we receive your name, email address, and profile image from that provider. SCIM provisioning may send your name, email, and group membership.

Organization data. Organization names, members, roles, invitations, and settings.

Customer content. What you or your team put in the Service: OpenTofu configuration, plans, state files, run logs, variables, policies, modules, and repository metadata from GitHub. Sensitive variables and secrets are encrypted and cannot be read back.

Usage and device data. IP address, browser user agent, sign-in times, and the actions recorded in your organization’s audit log. We keep operational metrics, such as request counts and errors, to run the Service.

Analytics. If you accept analytics cookies, we record which product features are used, such as creating a project or starting a run. We do not record page views, clicks, or session replays. When you are signed in, these events are linked to your user ID and organization ID, never to your name or email address. See the Cookie Policy.

Support. What you send when you email us.

• Provide, secure, and maintain the Service, including running your plans and applies.
• Authenticate you, protect accounts, and prevent abuse and fraud.
• Send service email such as verification, password reset, and invitations.
• Answer support requests.
• Understand usage and improve the Service, using analytics only with your consent.
• Comply with law and enforce our Terms of Service.

Where the GDPR or similar laws apply, we rely on: performance of our contract with you (running the Service); our legitimate interests (security, abuse prevention, and improving the Service); your consent (analytics cookies, which you can withdraw at any time); and legal obligations.

For customer content, your organization is the controller and we act as its processor, following its instructions.

We share personal data only with the subprocessors that help us run the Service, with services you choose to connect (such as GitHub or Google), when required by law, or as part of a merger or acquisition with notice to you. We do not sell or rent personal data, and we do not share it for advertising.

Members of your organization can see your name, email, role, and the actions you take in that organization.

We are based in the United States and process data there and in other countries where our subprocessors operate. When we transfer personal data from the EEA, UK, or Switzerland, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

We keep account and organization data while your account is active. Customer content stays until you or your organization deletes it, or until the organization is deleted. After deletion, data is removed from live systems promptly and from backups as they expire.

We may keep limited records longer when needed for security, to resolve disputes, or to meet legal obligations.

We protect data with encryption in transit and at rest, isolated run environments, short-lived cloud credentials, role-based access, and audit logging. Read more on our security page. No system is perfectly secure; if we learn of a breach that affects your personal data, we will notify you as required by law.

Depending on where you live, you may have the right to access, correct, delete, or export your personal data, to object to or restrict its processing, and to withdraw consent. California residents have the rights described in the CCPA, including the right to know and to delete; we do not sell or share personal information as those terms are defined there.

To exercise a right, email compliance@ezgamehost.com. We will verify your request and respond within the time the law requires. If your data belongs to an organization’s workspace, we may refer you to that organization. You may also complain to your local data protection authority.

The Service is not directed to children under 16, and we do not knowingly collect their personal data.

We may update this policy. We will change the date at the top and, for material changes, notify account owners by email or in the Service before the change takes effect.

EZ Game Host, LLC is the controller of personal data described in this policy, except customer content. Privacy and compliance questions: compliance@ezgamehost.com. General support: support@stackship.run.