Privacy Policy

1. Who is responsible

Odd Theory, Sweden, is the controller for the personal data described here. Contact us at privacy@nitrous.sh.

For personal data inside your workloads, you are the controller and we are your processor. See section 9 of the Terms of Service.

2. What we collect

• Account data: your email address and your password (stored only as a salted hash). If you sign in with GitHub, your GitHub user ID, username and primary verified email address. Your display time zone, if you set one. If you turn on two-factor authentication, its secret (stored encrypted) and your backup code (stored only as a keyed hash).
• Access data: your API keys (the full key is shown to you once and not kept in readable form) and your sign-in sessions.
• Security log: sign-ins, sign-outs, failed sign-ins and changes to your account (password, GitHub, two-factor authentication, API keys, data exports, billing settings), shown to you under Activity. For each of these that you or someone signing in as you makes, the IP address and the browser and operating system; none for changes Nitrous or the payment provider makes. Kept for 12 months, then deleted.
• Usage and billing data: the machines you create, their size, image, running time and exit code, your subscription, balance and payments.
• Exec history: the commands you run in a machine through exec, when they ran, how they ended and how long they took, shown on the machine's page. Not their environment or input. Kept for 7 days after the machine ends, with its output, then deleted. Copies in our backups are deleted as the backups expire, within 35 days.
• Technical logs: our servers log requests, including IP addresses, for security and troubleshooting.
• Access requests: the email address you submit to request access, used only to reply and invite you, and deleted on request or when no longer needed.
• Correspondence: what you send us when you email us.
• Feedback and bug reports: your message and any screenshot, with the page, dashboard build, browser, screen size, time and time zone, and references to recent errors. Used to fix problems; deleted with your account.
• Contact form messages: your email address, your name if you give it, the topic and your message. Used to answer you; kept for up to 24 months, then deleted.

3. Why we use it

• To provide the Service and bill for it: to perform our contract with you (GDPR Art. 6(1)(b)).
• To keep accounting records: to meet our legal obligations (Art. 6(1)(c)).
• To keep the Service secure and prevent abuse, and to improve it: our legitimate interests (Art. 6(1)(f)).
• To answer you when you contact us: our legitimate interest in replying.

4. Where it is kept

Machines, their disks, output and logs, images, and the account data Nitrous stores are stored and processed in the European Union, in data centers in the Netherlands and France. Nitrous does not run on US cloud providers. If you sign in with GitHub or pay through Polar, those providers handle the data they receive under their own policies (section 5).

5. Who we share it with

• Our hosting provider (France): servers, databases and backups, in the EU.
• GitHub, Inc. (USA): only if you choose to sign in with GitHub, to confirm your identity. GitHub is certified under the EU–US Data Privacy Framework.
• Polar Software, Inc. (polar.sh): merchant of record for subscriptions and usage charges. Polar processes payments and card details under its own privacy policy. Nitrous does not store full card numbers.
• Authorities, where the law requires us to.

We do not sell personal data or share it for advertising.

6. How long we keep it

• Account and usage data: for as long as you have an account.
• When you delete your account, your email address, GitHub identity, password and two-factor authentication are removed immediately and your sessions and API keys end. Copies in our backups are deleted as the backups expire, within 35 days.
• Billing and payment records: 7 years, as Swedish bookkeeping law requires.
• Machine output and logs: 7 days after the machine ends. The machine's record (image, size, times, exit code) is usage data, kept as above.
• Contact form messages: up to 24 months, then deleted.
• Security log: 12 months, then deleted; with your account, when you delete it.
• Technical logs: for a limited period, after which they are overwritten.

7. Cookies

We use only cookies that are strictly necessary, so we do not ask for consent. The website sets none; the dashboard sets these:

• nx_session: keeps you signed in; 30 days.
• nx_oauth_state and nx_oauth_invite: protect GitHub sign-in and carry an invitation through it; 10 minutes.
• nx_2fa: carries a sign-in to its two-factor step; 5 minutes.

No analytics, advertising or third-party cookies.

8. Security

How we protect the Service and your data is described on our Security page.

9. Your rights

You can ask for access to your personal data, and for it to be corrected, deleted, restricted or given to you in a portable form. You can object to processing based on our legitimate interests. Many of these you can do yourself in the dashboard: Settings downloads your data as JSON and deletes your account. For anything else, email privacy@nitrous.sh.

You can also complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, imy.se) or the supervisory authority where you live.

10. Changes

We will post changes here and, if they are significant, tell you by email or in the dashboard.