Privacy Policy

HostIn ("we", "us") provides managed container hosting through the website and dashboard at hostin.store and runs customer applications under apphostin.cloud and customer-provided domains.

This policy covers personal data we process about people who visit our website, create an account or use the dashboard. It is written with Indonesia's Personal Data Protection Law (Law No. 27 of 2022) in mind.

Applications you deploy may collect data from their own visitors. For that data you are the controller and we process it only to host your application on your behalf (see section 4).

• Account data: your name, email address, and a password. We store only a one-way hash of the password (scrypt), never the password itself.
• Google sign-in: if you choose "Continue with Google", Google shares your name, email address, whether that email is verified, your profile picture and a Google account identifier. We never receive your Google password.
• Sign-in sessions: sign-in method, a shortened browser description (user agent), an approximate IP address with the last part removed, and session timestamps. You can see and revoke these sessions in your account settings.
• Billing data: orders, invoices, the plan you bought, and payment confirmations. We do not store card numbers or bank account credentials.
• Service data: organizations and team members, repository addresses, build and deployment logs, application settings and environment variables, domain names, resource usage and an audit log of actions taken in your account.
• Web terminal: when you open a terminal into your application we record who opened it, when, and from which IP address. What you type and the output are not stored.
• Request logs: our reverse proxy logs each HTTP request it handles (IP address, time, requested host and path, status code, referrer and user agent), including requests to applications we host. These logs are size-limited and rotated.
• Messages: anything you send us by email, for example payment confirmations or support requests.

We do not use advertising or third-party analytics trackers.

• To provide the service you signed up for (performance of a contract): creating your account, building and running your applications, issuing TLS certificates, activating subscriptions and answering support requests.
• To keep the platform secure (legitimate interest): detecting abuse, limiting sign-in attempts, investigating incidents and enforcing our Terms of Service.
• To send service email such as password resets, email-change confirmations and security notices. We do not send marketing email without your consent.
• To meet legal obligations, such as keeping billing records required by tax law or responding to lawful requests from authorities.

Source code, files, databases and visitor data of the applications you deploy belong to you. We access them only to provide the service (for example to build, run, back up or move an application), when you ask us to, or when needed to investigate abuse or comply with the law.

You are responsible for having a lawful basis and an appropriate privacy notice for any personal data your applications collect.

We do not sell personal data. We share it only with:

• Infrastructure providers that rent us servers and network capacity, which store data on our behalf.
• Google, when you use Google sign-in.
• Let's Encrypt, which issues TLS certificates for application hostnames and custom domains. Certificates are published in public Certificate Transparency logs, so those hostnames become publicly visible.
• An email delivery provider, to send service email.
• Git hosting services such as GitHub, which we contact to fetch the repositories you connect.
• Authorities, when we are legally required to disclose data.

Some of these providers are located outside Indonesia. Where data is transferred abroad we rely on the safeguards required by applicable law.

We use only cookies that are needed for the dashboard to work: your sign-in session, protection against cross-site request forgery, and short-lived values used during Google sign-in. We do not use advertising or analytics cookies, so there is nothing to opt out of.

• Account and service data: for as long as your account exists.
• Sign-in sessions: until they expire or are revoked, after which they no longer grant access.
• Request logs: rotated automatically once they reach a size limit, usually within days.
• Application data: deleted with the application, except persistent volumes, which may be kept until they are removed so that an accidental deletion can be recovered. Ask us if you want them removed immediately.
• Billing records: for as long as tax and accounting law requires, even after your account is closed.

We use encrypted connections (HTTPS), hashed passwords, session revocation, sign-in rate limits, and isolated containers with resource limits. No system is completely secure; if a breach affects your personal data we will notify you and the authorities as the law requires.

Subject to applicable law, you can ask us to:

• tell you what personal data we hold about you and give you a copy;
• correct inaccurate data (most of it you can change yourself in account settings);
• delete your account and personal data;
• restrict or object to certain processing, or withdraw consent you gave.

Send requests to billing@hostin.store from the email address of your account. We may need to verify your identity and will reply within the time limits set by law.

HostIn is not intended for anyone under 18, and we do not knowingly collect their data.

We will update the date at the top of this page when the policy changes and notify account holders of significant changes by email or in the dashboard. Questions about this policy: billing@hostin.store.