Privacy Policy
I'm Víctor Busqué, and I run Host An App as a personal project. Where this Policy says "I", "me" or "my", that's me, Víctor, and I'm the data controller for the Service. This Policy explains how information may be processed when you visit or use Host An App and services at hostan.app.
1. Information I collect
I've designed Host An App to collect as little information as reasonably possible. It doesn't build user profiles or track what individual visitors do across websites.
Aggregate service statistics
I maintain basic aggregate statistics, including the total number of deployments and visit counts for individual deployments. These counters are aggregate: they don't record who visited, when, or from where, and I don't use them to identify anyone.
Hosted content
When you deploy content, the content you submit is processed and stored to make it available through the Service until it expires or is otherwise removed. You are responsible for the information you include in deployed content. Please don't deploy sensitive or confidential information unless you understand and accept the risks.
Communications
If you contact me by email, I may process the information you provide to respond to your request or address an issue you report. I don't add such information to any analytics or profiling system.
2. Technical and infrastructure data
Like most internet services, the Service necessarily processes certain technical information to operate, secure and troubleshoot itself. This section describes what I and my infrastructure providers actually collect and retain.
Server logs (Host An App)
My servers keep technical logs of requests. These logs may include the visitor's IP address, the date and time of the request, the page or resource requested, the HTTP status returned, the referring page, and the browser's user-agent string. I use them for security, troubleshooting, rate limiting and abuse prevention, not to build advertising or user profiles. Some paths (for example, private database runtime files) are intentionally not logged.
Metrics
I maintain an internal metrics endpoint (Prometheus /metrics) that reports aggregate counters and technical runtime information about the Service itself. It is only reachable from my own private infrastructure, is not exposed to the public, and contains no personal or user-level data.
Infrastructure providers
Host An App runs on infrastructure and services provided by third parties, including Cloudflare for internet-facing infrastructure, CDN and domain-related services, and Hetzner for hosting infrastructure. These providers may process technical information, such as IP addresses, connection information, request metadata and security or analytics events, to deliver, secure and operate the Service, in accordance with their own policies and applicable law. Cloudflare and Hetzner may retain logs and security analytics as part of their normal operation.
Future analytics
I don't currently operate web analytics on visitors to the Service. If I add analytics or any new form of data collection, I'll update this Privacy Policy before doing so and explain what is collected.
3. Password-protected deployments and cookies
Some deployments may be protected by a password. When you successfully authenticate to a password-protected deployment, the Service may set a technical HTTP cookie associated with that deployment. This cookie is used solely to provide access to the protected content and is not intended for advertising or cross-site tracking. Because it is necessary to provide the password-protection functionality you requested, it is used as a strictly necessary technical cookie.
4. How I use information
Information may be processed to:
- provide and operate the Service;
- host and display deployed content;
- maintain aggregate service statistics;
- secure, monitor and troubleshoot the Service;
- prevent, detect and investigate abuse and unlawful activity;
- respond to communications, reports and requests, including through the notice-and-action mechanism; and
- comply with legal obligations.
5. Legal basis
Where the GDPR applies, I rely on legitimate interests in operating and securing the Service, on taking the steps you request to provide you with the Service, on compliance with legal obligations, or on other applicable legal bases depending on the circumstances.
6. Sharing and service providers
I use infrastructure providers and other service providers where reasonably necessary to operate the Service. I don't sell personal data, and I don't provide personal data to advertisers for advertising purposes. I may disclose information where required by law or where reasonably necessary to protect the Service, users or others from unlawful activity, abuse or security threats.
7. Data retention
Hosted content is intended to be temporary and may be automatically deleted after its applicable expiration period. I don't maintain a separate user-facing backup or recovery service; expired or deleted content may not be recoverable.
Technical logs and related information may be retained for a limited period where reasonably necessary for security, abuse prevention, troubleshooting, or the handling of reports and disputes, and may be preserved for longer where I'm legally required to do so. Email communications may be retained for as long as reasonably necessary to respond to and manage the relevant matter.
8. International transfers
The infrastructure providers I use may process information in locations outside your country or the European Economic Area. Where applicable, such processing is subject to the safeguards and mechanisms provided by applicable data protection law and the relevant provider.
9. Abuse investigations
When I investigate reports of illegal or abusive content, including through the notice-and-action mechanism described on my Report Content page, I may review hosted content, technical logs and related information to establish what happened and to respond to the report. Where I'm legally required to do so, I may preserve relevant information and cooperate with competent authorities.
10. Your rights
Depending on applicable law, you may have rights relating to your personal data, including the right to request access, correction, deletion or restriction of processing, and the right to object to certain processing.
To exercise applicable rights, contact me at [email protected]. You may also have the right to lodge a complaint with the relevant data protection authority.
11. Changes to this Privacy Policy
I may update this Privacy Policy as the Service evolves. I'll publish the updated version on this page with a revised "Last updated" date.
12. Contact
For privacy questions or requests, contact me: