Legal
Privacy Policy
1. Who is responsible
OceanLaunch is operated by Arulraj, an individual based in Chennai, Tamil Nadu, India, who decides how and why the personal data described here is used (the “Data Fiduciary” under India's Digital Personal Data Protection Act, 2023, and the “controller” under the EU GDPR where it applies). Contact: support@oceanlaunch.cloud.
2. What we collect
When you create and use an account
- Name and email address.
- Your password, stored only as a one-way Argon2 hash; we can never see it.
- Two-factor sign-in: the secret for your authenticator app, stored encrypted, and your recovery codes, stored only as hashes.
What you put into your workspace
- Workspace and app names, settings, and the domains you connect.
- Files you upload (JAR, WAR, site files) and the code we fetch from repositories you connect.
- Environment variables. Values you mark as secret, access tokens and deploy keys are stored encrypted.
- If you connect GitHub: the GitHub account or organisation name and the installation you chose. The one-time GitHub sign-in token used to confirm the connection is not stored.
- Build and deployment logs. Your apps' runtime logs are read live from the server when you open them.
Security and usage records
- A log of important events in your account and workspaces, such as sign-ins, failed sign-in attempts, deployments and setting changes, with the time and the IP address they came from.
- Standard server logs of requests to the portal and to apps, which include IP addresses.
On our website (oceanlaunch.cloud)
The public website uses no cookies, analytics or third-party scripts. Like any web server, it briefly logs requests (including IP addresses) to keep it running and secure.
3. Why we use it
- To provide the Service: creating your account, signing you in, building, running and serving your apps, and connecting your domains and repositories.
- To keep the Service and your account secure: two-factor sign-in, detecting misuse, investigating problems, and enforcing our Terms of Service.
- To contact you about your account: confirming your email, password resets, security notices, and important changes to the Service or these policies. We don't send marketing emails without asking.
- To meet legal obligations, such as responding to lawful requests from authorities.
We use your data on the basis of the consent you give when you sign up and for the legitimate uses the law allows, such as providing a service you asked for and keeping it secure. Where the GDPR applies, the legal bases are performing our contract with you, our legitimate interest in a secure service, and legal obligations.
5. Where it is stored
Our servers are provided by Contabo GmbH and located in the European Union. If you use OceanLaunch from India or elsewhere, your data is transferred to and stored there. We only transfer data in ways the law allows.
7. Data of your apps' users
Your apps may collect personal data from their visitors and users. For that data, you decide what is collected and why, and you are responsible for telling your users and following the law. We only store and process it to run your app, and we don't use it for anything else.
8. How long we keep it
- Account and workspace data: for as long as your account exists.
- Apps: until you delete them. Deleting an app removes its container, uploaded files, settings and deployment history. For Git apps we keep only the newest three fetched versions of the code.
- Security records (the account event log): for as long as your account exists, so that misuse can be investigated.
- Backups: the platform database is backed up every night and each backup is kept for up to 14 days, so deleted data disappears from backups within about two weeks.
You can delete your account yourself, under Account → Security in the portal (or ask us at support@oceanlaunch.cloud). This deletes the workspaces only you own, with their apps, and removes you from shared workspaces. Your name, email address, sign-in details and security records are erased; what remains is an anonymous placeholder, so that records of shared workspaces stay consistent, which no longer identifies you. We keep only what the law requires us to keep.
9. How we protect it
Two-factor sign-in on every account, encrypted secrets and keys, passwords stored only as hashes, HTTPS for every connection, apps isolated from each other, and administrative access to the servers only over a private network. No system is perfectly secure, but we work to protect your data and will tell you without undue delay if a breach affects it, as the law requires.
10. Your rights
You can ask us to:
- tell you what personal data we hold about you and how we use it;
- correct or complete it;
- delete it, by deleting your account (you can do this yourself under Account → Security);
- withdraw your consent (this means closing your account, since we can't provide the Service without this data);
- nominate someone to exercise these rights for you if you die or become unable to;
- and, where the GDPR applies, receive a copy of your data or object to how we use it.
Write to support@oceanlaunch.cloud from your account's email address. We'll reply within 30 days. If you're not satisfied, you can complain to the Data Protection Board of India or, in the EU, to your data protection authority.
11. Age
OceanLaunch is for people aged 18 and over. We don't knowingly collect data from anyone younger. If you believe a child has created an account, please tell us and we'll delete it.
12. Changes to this policy
We'll update this policy when what we collect or how we use it changes. For significant changes we'll email account holders before they take effect, and the date at the top of this page shows the latest version.
13. Contact and grievances
For any privacy question, request or complaint, contact our Grievance Officer:
Arulraj, Grievance Officer, OceanLaunch
Chennai, Tamil Nadu, India
support@oceanlaunch.cloud