Privacy policy

• We collect what is needed to run your workspace: your account, your servers' metrics and logs, and the apps you deploy.
• We do not sell your data, show ads, or use it to train models.
• The public site uses Google Analytics to count visits. The panel uses only the cookies it needs to keep you signed in, and loads no analytics.
• You can delete your workspace at any time from the panel. Write to [email protected] for anything else.

This policy covers the hosted service at yourpanel.host. If you run YourPanel yourself, your installation sends nothing to us, and you are responsible for the data it holds.

Account

Name, email address, password hash, two-factor secret and recovery code hashes, role, workspace membership.

Sign-in and audit

IP address, browser user agent, time of sign-in, failed attempts, and the actions you take in the panel.

Servers

Hostname, operating system, CPU, memory, disk and network metrics, service status, and logs you open in the panel.

Apps and sites

Repository URLs, build and deploy logs, domains, environment variables (encrypted), database settings.

Connected accounts

If you connect GitHub: your GitHub login and an access token, stored encrypted.

Messages

Emails you send us and notification channels you configure (email addresses, webhook URLs).

Site analytics

Page views, referrer, approximate location and device type, collected by Google Analytics with its cookies.

• To provide the service: run your workspace, relay commands to your agents, deploy your apps and send the alerts you ask for.
• To keep it secure: detect abuse, stop brute-force sign-ins and keep an audit trail you can verify.
• To send account emails: confirmation links, password resets, security notices and alerts. We send no marketing email without your consent.
• To improve the public site, using aggregate page counts only.

Where the GDPR applies, we rely on performing our contract with you for running the service, and on our legitimate interest in keeping it secure and understanding aggregate site use.

The agent you install reports metrics and runs only the actions you trigger from the panel. Files, databases and application data stay on your servers. We read them only when you open them in the panel (for example the file manager or a log view), and only to show them to you.

We use a small number of providers to run the service. Each gets only what it needs:

• Hosting provider: runs the control plane and its database.
• Email delivery provider: sends account emails and alerts.
• Google Analytics: receives page views from the public site only, never from the panel.
• GitHub: only if you connect it, to read your repositories and post deploy status.

We share data with authorities only when the law requires it, and we will tell you unless we are legally prevented from doing so.

• Server metrics: 7 days by default. Deploy history: as long as the app exists.
• Audit log: as long as the workspace exists, so its integrity can be verified.
• Account and workspace data: until you delete them.

The panel sets only cookies that are strictly necessary, so it does not ask for consent:

Session cookie

Keeps you signed in. httpOnly, rotated on use, expires after 7 days.

GitHub sign-in state

Protects the GitHub connection flow. Lasts 10 minutes.

Browser storage

Remembers your theme and your signed-in profile for the next visit. Never leaves your browser.

The public site sets Google Analytics cookies (_ga, _ga_*) to count visits. You can block them in your browser or with a content blocker without losing anything on the site.

You can see, correct, get a copy of or delete your data. Most of this is in the panel: account settings, team management and workspace deletion. For a copy of your data, anything else, or to object to how we process your data, email [email protected]. We answer within 30 days. You can also complain to your local data protection authority.

Secrets are encrypted at rest, sessions are short-lived and revocable, and agents connect out to us so your servers need no open ports. The security page describes every layer.

If we change this policy in a way that matters, we will email workspace owners before it takes effect. Questions about privacy: [email protected].