Privacy Policy_

Who we are

fresh.dev, a company registered in England and Wales under company number 16748746, registered office 20 Wenlock Road, London N1 7GU, is the controller of the personal data described here. For anything about your data, email help@fresh.dev with the subject “Privacy request”.

What we collect

• Account details: your name, email address and organisation name; your password (stored only as a one-way hash); your two-factor secret (encrypted) and recovery codes (hashed); the SSH public keys you add; and API tokens (hashed).
• Billing details: your invoices, usage and credit, and the identifiers Stripe gives us for you and your card, including a card fingerprint so the signup credit is given once per card. Stripe holds your card, billing address and any tax ID. We never see your full card number.
• Service data: the machines, apps, databases and DNS zones you create, their names, addresses, domains and settings, usage counters such as CPU time and network bytes, and an audit log of actions taken in your account.
• Signup details: your answer to “How did you hear about us?” and any campaign tags in the link that brought you to us.
• Support email: what you send us and our replies.
• Technical data: our web server logs record each request’s IP address, time and page, with passwords, cookies and tokens removed. Our sign-in rate limits use a keyed hash of your IP address, not the address itself.

Your content

The files, websites, databases and other data you store on Fresh are yours. We process them only to provide the service to you, and we do not look at them except to run a managed app or database, when you ask us to, or when the law or our Acceptable Use Policy requires it. For personal data inside your content, you are the controller and we are your processor.

Why we use it, and our lawful basis

• To provide the service you signed up for (contract): your account, your resources, billing, support and service emails.
• To meet legal obligations: keeping tax and accounting records, and responding to lawful requests from authorities.
• For our legitimate interests: keeping the service secure, preventing fraud and abuse (including the once-per-card signup credit), and understanding how people find us so we can improve the service.

We only email you about your account and the service. If we ever want to send marketing email, we will ask first.

Cookies and browser storage

We set only the cookies the console needs to work, plus two small browser-storage entries. There are no advertising or third-party tracking cookies.

• __Host-fresh_session keeps you signed in. It lasts until you close your browser, and a sign-in ends after 12 hours regardless.
• __Host-fresh_csrf protects your actions in the console from forged requests. It lasts as long as your session.
• __Host-fresh_login_csrf protects the sign-in and signup forms. It lasts 15 minutes.
• fresh-theme, in your browser’s local storage, remembers whether you chose light or dark mode. It is never sent to us.
• fresh-utm, in your browser’s session storage, carries campaign tags from our homepage to the signup form. It is cleared when you close the tab.

We may count visits to our public pages (not the console) with Umami, an analytics tool we host ourselves. It sets no cookies, does not track you across sites, and respects your browser’s Do Not Track setting.

Who we share it with

We don’t sell personal data. We share it only with the providers below, who act on our instructions, and with authorities when the law requires it.

Provider	What for	Where
Stripe	Card storage, payments, invoices and VAT calculation	UK, EU and USA
Mailgun (Sinch), EU region	Sending account email, with open and link tracking turned off	European Union
Our data centre in Kent	Space, power and network for our own servers	United Kingdom

Where your data lives

Your account, your service data and your content are stored on our servers in Kent, United Kingdom. Stripe and Mailgun process some data outside the UK. Where they do, the transfer is protected by UK adequacy regulations or by the standard contractual clauses with the UK addendum.

How long we keep it

• Your content is deleted when you delete the machine, app or database that holds it.
• Account and service data is kept while your account is open. When you ask us to close your account, we delete or anonymise it, apart from the records below.
• Invoices and billing records are kept for 6 years after the end of the financial year they relate to, as UK tax law requires.
• The audit log of account actions is kept to protect the service and investigate abuse; it records who did what and when, not your content.
• Payment event details from Stripe are removed from our systems 30 days after we have processed them.
• Email content is deleted from our systems once the email is sent; we keep a record that it was sent.
• Links for email verification last 24 hours, password reset 60 minutes, and invitations 7 days.
• Backups of our own account database are encrypted and deleted after 35 days.
• Support email and web server logs are kept only as long as we need them to help you and keep the service secure.

Security

The console uses HTTPS only, two-factor sign-in is required for account owners, passwords and tokens are stored hashed, and secrets such as two-factor keys and queued emails are encrypted. No system is perfectly secure: please protect your own account and keep your machines up to date.

Data protection (GDPR)

Under UK data protection law (the UK GDPR and the Data Protection Act 2018) you have the right to:

• get a copy of your personal data;
• have inaccurate data corrected;
• have your data deleted, or its use restricted;
• object to our use of it based on legitimate interests;
• receive data you gave us in a portable format.

Email help@fresh.dev with the subject “Privacy request”. We may need to confirm it is you, and we reply within one month. It is free. Some rights have legal limits; for example, we must keep invoices for tax purposes.

If you are unhappy with how we handle your data, please tell us first. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

Data processing agreement: business customers who need a DPA for data they host with us can request one at help@fresh.dev. Fresh acts as processor for customer content.

Children

Fresh is not for children. You must be 18 or over to open an account.

Changes

We will update this page when our practices change, and email you about material changes. See also our Terms of Service, Acceptable Use Policy and beta SLA.