Privacy policy

Information processed

The service processes account email, name, role, hashed passwords, passkey public keys and metadata, session credentials and security audit events to provide access. Infrastructure records may include host metrics, logs, request paths, status codes, IP addresses and approximate locations. Environment secrets are encrypted at rest in the control-plane shared store and agent vault. Access is limited by organization and role.

Installation and assistant access

A temporary installer can contain the machine credential needed to pair your server. Treat its link and downloaded script as private. Installer access secrets are hashed in control-plane state and expire with the pairing request; the agent credential is stored encrypted by the control plane and in the protected server configuration after enrollment. Expiry of a pairing request does not revoke an already enrolled machine.

Approved source snapshots, uploaded source archives and bounded build logs are stored in the selected server’s configured workspace. Owners can inspect or discard eligible artifacts. When you authorize an MCP client, requested operational information, source files or build logs are returned to that client within its granted scope. Review the chosen client’s own processing terms and avoid including personal data or application secrets in source uploads. Hostwatch does not supply the client with agent credentials or a private installation’s license signing key.

Native app

The iPhone/iPad app stores session credentials in the device keychain. Short sessions are renewed using a revocable device credential, valid for up to 90 days since renewal. Sign-out removes the local credential and revokes it on the server; password changes revoke existing credentials. Face ID and device passcodes are checked by iOS: Hostwatch never receives biometric data. Camera access is only used for QR scanning; frames are not uploaded. No device GPS access or advertising tracking is used.

Subscriptions

Apple processes in-app payments. Hostwatch does not receive your card number. For entitlement verification we process the product identifier, original and current transaction identifiers, workspace binding, subscription expiry and applicable refund or revocation status. These records prevent a purchase from being reused by another workspace. Purchase verification uses signed Apple data and, when configured, App Store Server notifications and status checks.

Retention and requests

Operational exports are created only when you choose export. Copies you save or share remain in the selected destination. Temporary export files are removed when the sharing screen closes. In the reference managed deployment, detailed HTTP request evidence expires after three days and five-minute site summaries after 30 days. Behaviorally classified public IPs have a separate no-expiry case history containing bounded path counts, response outcomes, reasons and recorded protection actions; it does not contain every visitor or raw query values. Retention and backups can differ in an enterprise deployment and are controlled by the organization agreement. Contact your administrator or serhii.ziborov@gmail.com for access, correction, deletion or retention requests. We do not sell personal data. Changes to this policy are published here.