Privacy Policy

Version 7

Your data is yours. This policy says what we collect, why, how long we keep it, who else handles it and what your rights are. We never sell your data.

It covers Zydra: the zydra.sh website, the desktops you reach with ssh zydra.sh, the phone page and the timeline player. It covers site visitors, people trying a demo and customers. It does not cover other services you sign in to from your desktop. Their own policies apply.

What we collect and why

We collect only what we need.

Your account

There is no sign-up form. When you connect with ssh zydra.sh, we create an account tied to your SSH key's fingerprint, so that key gets the same desktop back. We don't ask for your name, email address or a password.

If you link a GitHub account, we store its ID, login, name, avatar URL and access token. That lets you sign in from another computer and use GitHub from your desktop. You can unlink it from the desktop's menu.

If you pair a phone, we store a session for it, signed in for up to 90 days. If you allow notifications, we store the push address its browser gives us. We also store the colors your terminal reports, so your desktop matches it.

We won't use your name or GitHub login in marketing without your permission.

Payments

If you buy the $40 plan, Paddle asks for your payment details, email address and billing address. Paddle is the merchant of record, so these go to Paddle and never reach our servers. We store Paddle's transaction and subscription IDs and the dates you paid, for account history, refunds and billing support.

When you take the money-back refund, we store a one-way hash of your email address and of your card or PayPal account, with the refund's status. That is how the guarantee works only once per customer. We hash the mailbox: lower case, without a +tag, and for Gmail without dots. For a card, we hash its brand, last 4 digits and expiry. For PayPal, its email address. We can't turn a hash back into an address or a card.

Your desktop and timeline

We store your desktop on our servers: its disks, your files and whatever your apps and agents create, including credentials such as an agent's login. We don't index, scan or train anything on it. At the end of a demo, we save your desktop so the paid plan can continue it.

The timeline records your desktop so you can rewind it. It stores terminal text as text, windows as video of their visible part, and layout as events.

• Recording is on by default. The status bar shows it, a pause key stops it, and you can delete a time range.
• About once a minute while you are active, it snapshots the whole virtual machine, memory included. On the paid plan, it also snapshots each point you pin.
• A demo keeps only the last hour of recording and can't pin points.

Network data

We log the IP address of each connection and when it started and ended, for security, fraud prevention and capacity planning. For demos, we also store the network each demo came from: the IPv4 address, or the IPv6 /64.

We use no CAPTCHA. To keep demos for people, we count demos per SSH key, per network and per wider network block, and we cap how many new accounts can start at once.

The website

The site has no third-party analytics, ads or tracking pixels. Our web server writes no request log. The site's programs log errors and security events, which can include your IP address, in the same log as connections.

The site sets cookies only when you pair a phone or a browser: a short-lived one while pairing, then one that keeps that device signed in until you revoke it. The phone page and the timeline player need that cookie. Your light or dark choice stays in your browser's local storage. The checkout loads Paddle's script, which falls under Paddle's privacy policy.

We have no app. The phone page asks your browser for permission to show notifications and works without it. On an iPhone, notifications work only after you add the page to your Home Screen.

Email

When you email us, we keep the email and your address as support history.

Who else handles your data

• The hosting company that runs our servers in the New York metro region.
• Backblaze B2, which stores demo saves and pinned timeline points. We encrypt them with a key that stays on our server, so Backblaze can't read them.
• Paddle, the merchant of record, for payments, taxes and refunds.
• GitHub, if you link it. Your desktop uses your token to reach GitHub for you.
• Your phone browser's push service, for notifications to a paired phone. They are end-to-end encrypted, so the push service can't read them.

When we look at or share your data

No one at Zydra looks at your desktop, except:

• To help with a support case. We ask for your consent first.
• When an error stops an automated process and a person must fix it. This is rare, and we then fix the root cause.
• To investigate a use our Terms of Service forbid, as a last resort. If we find one, we act on it and may tell the authorities.
• When the law requires it.

We answer government requests for data only when legal process, such as a U.S. warrant, criminal subpoena or court order, compels us, or in some emergencies. We tell you before we disclose your data, unless the law forbids it or in some emergencies. We preserve data only under legal process, and destroy the copies when the preservation period ends without one. In a tax audit, we disclose only the billing information the audit needs.

We may count de-identified data, such as how many demos run at once, only to plan capacity and never for marketing.

If another company acquires or merges with Zydra, we will say so on this page well before your data moves or falls under a different policy.

Your rights

You have these rights wherever you live:

• To know what we collect and how we use and share it. This policy lists it.
• To access your data and learn how we store, secure and process it.
• To correct your data.
• To erase it, within the limits of the law. We delete your account, desktop, timeline and archives, except billing records we must keep.
• To restrict or object to how we process it. We never sell it.
• To take it with you. Copy your files out of your desktop at any time. The timeline player exports a time range as a video.
• To not face a decision with legal or similar effects made only by a machine, unless our contract needs it, the law allows it or you consent.
• To get the same price, discounts and support after using these rights. Some requests, such as erasure, may stop you from using Zydra.
• To complain to a supervisory authority, such as your data protection authority in the EU or UK.

In your desktop, you can unlink GitHub, revoke a paired phone and delete a range of your timeline. For anything else, write to privacy@zydra.sh with the fingerprint of an SSH key on your account. We know you only by that key, so without it we can't find your data or confirm the request is yours. Someone writing for you needs your written consent. The law may exempt some data, such as what we need to run your desktop. If we deny a request, we tell you how to appeal where the law allows it.

How we secure your data

Each desktop runs in its own virtual machine, isolated from the others and from the host. SSH and TLS encrypt your connections, and we encrypt archives before they leave our server. Only we can access our servers. Your desktop's disks and snapshots are not encrypted at rest, so they are ready when you connect. The Terms of Service say how to report a security issue.

Deleting data

Files you delete in your desktop leave it at once, but stay in older timeline snapshots until those age out. The timeline thins older snapshots over time. Pinned points stay until you delete them. When you delete a time range of the recording, we delete it.

How long we keep it

• Your account, SSH key fingerprints, linked GitHub account, paired phones and demo networks: while the account exists, or until you unlink or revoke them. A demo account with no save, payment or link may go after a week unused.
• Connection and site logs, meaning IP addresses and times: 30 days at most, often less, since the log drops its oldest entries when full.
• Hourly backups of account data: 7 days on our server and 30 days encrypted on Backblaze B2, then deleted.
• Your desktop and timeline on the paid plan: as long as you pay. The timeline thins older snapshots to fit your plan's space.
• Demo saves of an account that never paid: up to 24 hours on our server, then 30 days in an encrypted archive on Backblaze B2, then deleted. A save moves to B2 sooner when our server runs short of disk or memory. If demo saves fill the B2 space we set aside, the network using the most loses its oldest save first.
• The workspace of a plan that ended, whether you canceled, a payment failed or you took the refund: the account goes back to a demo, and we keep the workspace on our server with no deletion timer, so it is there when you pay again. Write to privacy@zydra.sh to delete it. If we add a timer, we will change this page at least 30 days before.
• Billing records: as long as tax and accounting law requires, typically several years.
• Money-back guarantee hashes: as long as we offer the guarantee.
• Email you send us: while it is useful as support history.

We may also keep data to meet legal obligations, resolve disputes and enforce our agreements.

Where your data is

Our servers are in the New York metro region of the United States. If you are outside the United States, the data you give us moves there, and by using Zydra you consent to that. We run Zydra from Jordan, so we also access connection logs and billing records from there.

Changes and questions

When we make a significant change, we raise the version number at the top of this page. We don't have your email address, so this page is the notice. Questions? Write to privacy@zydra.sh.

Adapted from the 37signals open-source policies / CC BY 4.0.