runlot
Start free

Privacy policy

Effective from Sep 29, 2026

runlot collects only the minimal information needed to operate the service. This document explains what information we collect, how we use it, and how long we keep it.

What we collect

  • Account: your email address and name, plus the user id given by the provider you signed in with (GitHub or Google).
  • If signing up with a password: an argon2id hash, not your password. The original value is not stored.
  • Organizations and projects: names, settings, and deployment history.
  • Usage: request counts, execution time, and stored bytes. These compute your plan limits and your bill.
  • Mail records: headers and bodies of emails sent and received by your projects.
  • Inquiries: name, email, company, team size, and message sent via the contact form. Used solely for responding to your inquiry.
  • Product analytics: which pages you open on the site, the dashboard, and the docs, plus a random device id kept in your browser. Dashboard addresses have project names and tokens removed before they leave the page. What you do in the dashboard is grouped by your organization, so we can see how teams use runlot rather than individuals.
  • You directly control whether we collect data. In the EU, EEA, and UK, we collect no data without explicit consent. In other regions, a banner notifies you of collection status and allows one-click deactivation. You can change this setting anytime at the bottom of this page.

Security and Infrastructure

  • All data is securely protected via encryption in transit (TLS), and backups are encrypted at rest.
  • Your code, database content, and files are NEVER used to train AI models.

What we use it for

  • Recognising your account and keeping you signed in.
  • Computing your plan limits and your bill.
  • Detecting and preventing outages and abuse.
  • Identifying key usage patterns and bottlenecks to guide product improvements.
  • Sending you notices about the service. We do not send marketing mail.

Who we share it with

  • Amazon Web Services: email sending and AI model execution, in the Seoul region.
  • Google Cloud: Google sign-in and AI model execution.
  • Cloudflare: domains and traffic ingress.
  • Polar: payments. runlot never receives or stores your card number.
  • PostHog: product analytics. We do not record your screen, and we do not send the contents of your projects.
  • Sentry: error reporting on this site and the docs — the message, page address, and browser information. Like the analytics above, nothing is sent until you agree.
  • We do not pass your data beyond this list, and we do not sell it.

How long it is kept

  • Account data: until you delete the account.
  • Mail records: 30 days on Free, 365 days on Pro. Older ones are swept hourly.
  • Database backups: 7 days on Free, 30 days on Pro.
  • Email verification links: 24 hours. Password reset links: 1 hour.

When you sign in with Google

  • We request three scopes only: openid, your email address, and your basic profile.
  • Those values are used solely to create your account and recognise you on return.
  • We do not use data received from Google for advertising, and we do not sell it.

What you can ask for

  • You can ask us to show you the data we hold about you.
  • You can ask us to delete your account and the data attached to it.
  • Write to the address below and we will act on it once we have confirmed the request.

Product analytics

We count which pages get opened so we know what to fix next.

You have not chosen yet on this browser.

Contact: hello@runlot.io