Privacy Policy

1. Controller

The controller for personal data processed through homemade.dev is Tunç Türkmen, Tendlergasse 14/4/12, 1090 Wien, Austria. Contact for all privacy questions: [email protected].

2. What we collect, where it comes from, and why

• Account data: name, email address, profile picture and account ID, which we receive from GitHub or Google when you sign in. Needed to provide your account (Art. 6(1)(b) GDPR).
• Repository access: if you install our GitHub App, we access the repositories you choose, to build and run them in VMs (Art. 6(1)(b) GDPR).
• Usage and billing data: VM lifecycle events, CPU, memory, storage and network usage, to run and bill the Service (Art. 6(1)(b) and (c) GDPR).
• Security and operational logs: IP address, user agent, audit events and error logs, to keep the Service secure and working (Art. 6(1)(f) GDPR, legitimate interest). This includes outbound connection metadata from your VMs: which destination IP and port a VM connected to, when, and from which source port, never the contents, so we can handle abuse reports about the shared host IP. The exact list, and what we never record, is on What we log.
• Connected integrations: if you connect Slack, Linear or an AI subscription, the tokens and data needed for that integration (Art. 6(1)(b) GDPR).
• Abuse reports and emails you send us: kept as long as needed to handle them (Art. 6(1)(c) and (f) GDPR).

Account data is required to use the Service; everything else is optional or created by your use of it. We do not read your code, terminal sessions or AI conversations, we do not sell personal data, we do not use it to train machine-learning models, and we do not use advertising or tracking tools. We make no decisions about you based solely on automated processing.

3. Payments

Payments are processed by Sold through Link, LLC, a Stripe company acting as merchant of record. It collects your payment details and processes them as an independent controller under Stripe's privacy policy. We receive only what we need to manage your subscription, such as plan, payment status and country. We never see your full card details.

4. Service providers

We use these processors, bound by data processing agreements:

Transfers to the US rely on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

Some services act under their own terms rather than for us, and only when you use them: GitHub and Google (sign-in), Slack and Linear (if you connect them), and AI providers such as Anthropic and OpenAI. Agents in your VMs send prompts directly to those providers under your own account; that traffic does not pass through us.

5. Cookies and browser storage

We only use what is strictly necessary: a session cookie that keeps you signed in, and your colour-theme choice, stored in your browser. We use no analytics, advertising or tracking cookies, so we do not ask for cookie consent.

6. How long we keep data

• Account data: until you delete your account, then deleted within 30 days and removed from backups within 90 days.
• VMs and their disks: until you delete them or your account; a deleted VM's disk is destroyed immediately.
• Operational logs: 30 days.
• Outbound connection metadata from VMs: 7 days.
• Database backups: 30 days.
• Billing records: 7 years, as required by Austrian tax law (§132 BAO).

7. Your rights

You can object at any time to processing based on our legitimate interest (Art. 21 GDPR). You also have the right to access, rectify, erase and port your data, to restrict processing, and to withdraw any consent you gave, with effect for the future. Write to [email protected]. You can also complain to the Austrian data protection authority, Datenschutzbehörde, Barichgasse 40-42, 1030 Wien, dsb.gv.at.

8. Changes

We update this policy when our processing changes. The date at the top shows the latest version.