Privacy Policy

1. Information We Collect

1.1 Account Information

When you create a Kyper account we collect your email address and a password. Your password is hashed with bcrypt before storage and is never stored in plain text. We also record your account role (consumer, developer, or admin) to determine which features you may access.

1.2 Payment Information

All payment processing is handled by Stripe. Kyper never receives, processes, or stores your credit card number, CVV, or full card details. We store only the following Stripe identifiers on our servers:

• Your Stripe Customer ID (for consumers making purchases or subscribing to apps)
• Your Stripe Connect Account ID and connect-charges-enabled status (for developers receiving payouts)

Stripe's collection and use of your payment information is governed by the Stripe Privacy Policy.

1.3 Deployment Data

If you subscribe to a hosted application, you may provide environment variables to configure your deployment. These variables are encrypted at rest using AES-256-GCM via Rails Active Record Encryption and are only decrypted at the time of deployment provisioning.

We generate SSH key pairs (RSA-3072) for each deployment to manage infrastructure securely. These keys are zeroed (cryptographically erased) when a deployment is destroyed.

1.4 Usage Data

We collect limited usage data to improve the Service, including:

• App view counts — aggregated page-view counters on public application listings
• Search queries — the text you enter in the marketplace search bar

We do not track individual browsing behavior across the site and do not build behavioral profiles of users.

1.5 Developer Application Data

If you apply for a developer account, we collect the information you submit in the application form, including your name, email, motivation statement, portfolio URL, and GitHub URL. This information is used solely to evaluate your application and is retained with your account if approved.

1.6 Error and Performance Data

In production, we use Sentry for error tracking. Sentry may collect technical information such as your IP address, browser type, operating system, and the specific error or exception encountered. This data is used exclusively for diagnosing and fixing bugs. Sentry is not enabled in development or testing environments.

2. How We Use Your Information

We use the information we collect to:

• Create and manage your account
• Process purchases and subscriptions
• Provision, manage, and monitor hosted deployments on your behalf
• Calculate and distribute developer payouts
• Send transactional emails (purchase confirmations, deployment status notifications, payout summaries, etc.)
• Review and approve developer applications and app submissions
• Detect, prevent, and address fraud, abuse, and security issues
• Improve the Service, fix bugs, and develop new features
• Comply with legal obligations

We do not currently send marketing emails. All emails from Kyper are transactional in nature. If we introduce marketing communications in the future, you will be given the opportunity to opt in, and you may opt out at any time.

3. Cookies and Tracking

Kyper uses session cookies for authentication (powered by Devise). These cookies are strictly necessary for the Service to function and keep you signed in during your browsing session.

We do not use third-party tracking cookies, advertising pixels, analytics beacons, or similar technologies. There are no Google Analytics, Facebook Pixel, or comparable tracking scripts on the Service.

4. Third-Party Services

We share personal information with the following third-party service providers, each of which processes data only as necessary to deliver their respective services:

We do not sell, rent, or trade your personal information to any third party for marketing or advertising purposes.

5. Data Security

We implement industry-standard security measures to protect your data:

• Passwords are hashed using bcrypt and never stored in plain text
• Environment variables are encrypted at rest using AES-256-GCM (Rails Active Record Encryption)
• SSH keys are generated per-deployment and cryptographically zeroed upon destruction
• All connections to the Service are encrypted in transit via TLS/HTTPS
• Rate limiting is enforced on authentication endpoints, API requests, and downloads to mitigate abuse
• Infrastructure is hosted within a private VPC with firewall rules restricting access to necessary ports only

While we take reasonable precautions, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security of your data.

6. Data Retention

We retain your data according to the following schedule:

• Account data (email, hashed password, role) — retained for as long as your account is active. Upon account deletion, personal data is removed within 30 days except as required by law.
• Deployment data (environment variables, SSH keys, logs, volumes) — destroyed within 7 days after subscription cancellation. Data exports are made available to you before destruction.
• Purchase records (transaction amounts, dates, Stripe references) — retained indefinitely for tax, accounting, and legal compliance purposes, even after account deletion.
• Developer application data — retained with your account if approved; deleted within 90 days if rejected or withdrawn.
• Error logs (Sentry) — automatically purged according to Sentry's retention policy (typically 90 days).

7. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

7.1 Rights Under the GDPR (European Economic Area, United Kingdom, and Switzerland)

• Access — request a copy of the personal data we hold about you
• Rectification — request correction of inaccurate or incomplete data
• Erasure — request deletion of your personal data ("right to be forgotten"), subject to legal retention requirements
• Restriction — request that we limit processing of your data in certain circumstances
• Portability — receive your data in a structured, commonly used, machine-readable format
• Objection — object to processing based on legitimate interests
• Withdraw consent — where processing is based on consent, withdraw that consent at any time

Our legal basis for processing your data under the GDPR is: (a) performance of a contract (providing the Service to you), (b) legitimate interests (improving the Service, preventing fraud), and (c) compliance with legal obligations (tax and financial record-keeping).

7.2 Rights Under the CCPA (California, United States)

If you are a California resident, you have the right to:

• Know — request disclosure of the categories and specific pieces of personal information we have collected about you
• Delete — request deletion of your personal information, subject to certain exceptions
• Opt-out of sale — we do not sell your personal information, so this right does not apply in practice
• Non-discrimination — exercise your privacy rights without receiving discriminatory treatment

In the preceding 12 months, we have not sold any personal information and have not shared personal information for cross-context behavioral advertising.

7.3 Exercising Your Rights

To exercise any of the above rights, contact us at [email protected]. We will respond to verifiable requests within 30 days (or 45 days if an extension is necessary, with notice). We may ask you to verify your identity before processing a request.

8. International Data Transfers

Kyper's infrastructure is hosted in the United States (DigitalOcean NYC3 region). If you access the Service from outside the United States, your data will be transferred to and processed in the United States. By using the Service, you consent to this transfer.

For users in the EEA, UK, or Switzerland, we rely on Standard Contractual Clauses (SCCs) and/or other legally approved transfer mechanisms to ensure adequate protection of your personal data when transferred internationally.

9. Children's Privacy

The Service is not intended for use by individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected personal data from a child under 16, we will take steps to delete that information promptly. If you believe a child under 16 has provided us with personal data, please contact us at [email protected].

10. Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify affected users via email within 72 hours of becoming aware of the breach, as required by applicable law. We will also notify relevant supervisory authorities where required.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. When we make material changes, we will update the "Last updated" date at the top of this page and, where required by law, notify you by email or through a prominent notice on the Service. Your continued use of the Service after changes take effect constitutes acceptance of the revised policy.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

If you are in the EEA and believe we have not adequately addressed your data protection concerns, you have the right to lodge a complaint with your local data protection supervisory authority.