Privacy policy

What Button (Bitgate, Inc.) stores, why, and for how long. The short version: your programs run on your own computer, the form values and files sent to them pass through our servers, and we keep what we need to run that handoff and bill for it.

What we store

• Your account. Your email address, a sign-in ID, and when you signed up. If you sign in with Google, Google shares your email address with us through Firebase Authentication.
• Sign-in codes and sessions. One-time email codes and sessions are stored only as hashes, and they expire. To limit abuse we count recent sign-in attempts per email address and per network address.
• Your workspace. Your tools (name, description, form fields and the approved command), the computer you paired (its label, runner version and when it was last online), invites (the email address and expiry) and who has access to what.
• Runs. Who started each run, when, how it ended, and the values typed into the form. Uploaded files, result files and the run log, when a tool keeps one, are stored only for a limited time; see Retention.
• Billing. Your plan, its status and billing period. Stripe handles the payment itself; we never see or store your card details.
• Website and app analytics. We use Clicktag, without cookies, to count page views and product events such as sign-ups, published tools and started runs.

What we never do

We don't sell your data, use it for advertising, or build profiles. Form values, files and results pass through and are stored on our systems, so they aren't hidden from us; we only access them to keep the service running, to investigate abuse, or when the law requires it.

Who processes the data

• Cloudflare: hosting, file storage and the connection between browsers and your computer (Cloudflare keeps its own standard edge logs);
• OVH: database hosting, located in the EU;
• Google (Firebase Authentication): sign-in with Google;
• Postmark: sign-in codes and invite emails;
• Stripe: payments, as merchant of record (Stripe Managed Payments);
• Clicktag: website and app analytics, without cookies.

Retention

Uploaded input files are deleted 24 hours after a run ends. Result files and run logs are deleted 7 days after the run. Uploads that never finish are deleted after 1 hour, and finished uploads that never become part of a run after 24 hours. Sign-in codes expire after 10 minutes and are then deleted. Records of sign-in attempts (email address and network address) are deleted after 1 day. Email sign-in sessions last 30 days and are deleted 7 days after they expire or you sign out. The access audit log is kept for 30 days. Account data, tools, invites and run history, including typed form values, are kept until you ask us to delete your account.

Your rights

You can request access to, correction of, export of, or deletion of your personal data at any time: email bart@bitgate.com from the address on your account. Deleting your account removes your workspace, tools, invites and run history. If you were invited to someone else's tool, you can ask us the same about your data, and the tool's owner can revoke your access.

Security

Sign-in codes, sessions and runner credentials are stored as hashes, the site is served over HTTPS, and the runner connects out over an encrypted connection. The security page explains what a tool can do on its creator's computer. Report security issues to abuse@bitgate.com.

Changes

We may update this policy. The date at the top shows the current version.