Privacy Policy

What Outer stores, who processes it, how long it is kept, and your rights under the GDPR.

Outer is run by [OWNER: legal entity name], based in [OWNER: operator location, e.g. Poland (EU)] (“we”). Contact us at [OWNER: legal contact email]. As data controller, we decide what account and app data Outer stores and why.

This policy covers the platform at outer.now and the apps it serves at <slug>.outer.now. It does not cover what other people’s apps do with their visitors: each app owner is responsible for their own app’s data collection.

What we store and why

Data	Why	Legal basis
Email address, plan, Stripe customer id, terms version and acceptance time, usage against quota	Run your account, bill you, enforce quotas, and prove you accepted the terms	contract (Art. 6(1)(b)); billing and tax records: legal obligation (Art. 6(1)(c))
Invite codes you created or redeemed	Run the closed beta	contract (Art. 6(1)(b))
OAuth grants and API key metadata (names, prefixes, last use — never secrets)	Let your agent connect and let you revoke access	contract (Art. 6(1)(b))
Your apps’ code and deploy history	Build, serve, and roll back your apps	contract (Art. 6(1)(b))
Your apps’ data: databases, files, and secrets	Run your apps; secrets apply on the next deploy and are never shown again	contract (Art. 6(1)(b))
Logs, errors, deploys, and request metrics	Debug deploys, show the Console views, and count quota	contract (Art. 6(1)(b)); security monitoring: legitimate interests (Art. 6(1)(f))
Emails we sent you (sign-in codes, quota and billing notices, inactivity reminders)	Necessary for the service; each carries a one-click unsubscribe where it is not security-critical	contract (Art. 6(1)(b))
Abuse reports and moderation findings	Keep the shared domain safe	legitimate interests (Art. 6(1)(f))

We store secrets and codes as hashes or encrypted values, never in readable form. API keys, OAuth tokens, and sign-in codes are stored as hashes; app secret values are encrypted and write-only.

[OWNER: confirm the legal bases above with counsel; they are the usual choices for a hosting service, not legal advice.]

Processors

We do not sell your data. Three processors handle it on our behalf:

Cloudflare — edge network, DNS, DDoS protection, and TLS for outer.now and every app host; R2 object storage in the EU for code bundles, app data, snapshots, and exports; and the Email Service that delivers sign-in codes and notifications from Outer <[email protected]>.
Stripe — payments, subscription management, and tax calculation at checkout. Your email and billing details go to Stripe when you upgrade or manage billing.
Jev, through Cloudflare — content classification for the pre-live gate and after-live checks. Extracted app text (page copy, content files, seed strings, the slug and app name) is classified by Typesafe Jev on Workers AI through the AI Gateway, with log collection off. No file contents beyond the extracted text go to the classifier. The legal basis for this classification is our legitimate interest in keeping a shared domain free of abuse, profanity and phishing (Art. 6(1)(f) GDPR); it is limited to text that apps publish. You can object by writing to us, but the check is a condition of deploying on Outer.

How long we keep it

Data	Kept
Logs and errors history	24 hours on Free, 30 days on Pro
Deploys and their log tails	Last 50 per app
Database backups	Daily dumps, keep 3 on Free and 30 on Pro with any-day restore
Code exports	Auto-deleted 24 hours after creation
Inactive Free apps	Deleted after 90 days without owner activity, with reminders at 30, 7, and 1 day before; 7-day restore window after the stop, then purged
Stopped apps after a downgrade	Purged 30 days later, with a warning email around day 23
Accounts you delete	Removed with every owned app; collaborations stay with their owners

Platform state snapshots and bucket mirrors are also kept on the operator’s disk for disaster recovery. When retention ends, the data is deleted or irreversibly anonymized.

Cookies

Outer sets one strictly necessary cookie: __Host-outer_sid, a 30-day sign-in session. It cannot be set or overwritten by any app, and it carries no tracking. The docs site runs no analytics and sets no marketing cookies. Your apps may set their own cookies; those belong to the app owner, not to us.

You are in the EU/EEA or use the service from there, so the GDPR applies. You may:

Access — see your email, plan, usage, and reset dates in Console → Account, or ask your agent for whoami. See your connections and API keys under Connections & keys.
Portability — download any owned app as a zip at any commit (Console → Settings → Export code, or export_code). See Own your code and data.
Correction — update what you can in the Console, or write to [OWNER: legal contact email] for the rest.
Deletion — delete your account in Console → Account → delete-account. Apps you own go with it.
Withdraw consent and object — revoke any OAuth grant or API key any time; unsubscribe from non-critical emails with the one-click link in each message.
Complain — to us first at [OWNER: legal contact email], or to your supervisory authority ([OWNER: lead authority, e.g. the Polish UODO]).

We answer requests within one month. Security-critical notices (failed sign-ins, taken-down apps, purge warnings) have no unsubscribe because they protect your account.

Security

One app cannot reach another app’s data: each app runs under its own user id with its own limits, its storage credentials are scoped to its own prefix and expire on their own, and network egress blocks private ranges and SMTP. The netcup host sits behind Cloudflare’s edge with origin lock, and the platform database is snapshotted to the bucket. No measure is perfect, and a prototype carries residual risk — that is part of what the beta is validating.

Changes to this policy

We may update this policy. Material changes will be announced by email before they take effect, and the Terms version bump re-asks your acceptance at sign-in. The current version always lives at this address.