This page adds to the Koru Privacy Policy for Koru hosting. In short: we keep what we need to run your apps and to bill you: your account, your billing, what your apps used, and the names of your apps and variables. We never see the values of your variables, what your databases and buckets hold, your logs, or what your apps send to their visitors. If you turn on a watcher for an environment, Koru reads that environment’s logs, with the values of your variables that are 8 characters or longer and identifiers taken out, so that an AI model can tell you when something looks wrong (section 5).
1. Who is responsible
Fly by wire AB, company registration number 559316-3313, Flädervägen 1 b Lgh 1401, 611 46 Nyköping, Sweden, is the controller of the data this page describes. Contact us about privacy at support@flybywire.se.
2. Two roles
- For your hosting account (who you are, your billing and your usage), we are the controller. This page covers that data.
- For the personal data inside your apps, you are the controller and we are your processor. The Data Processing Agreement covers that data.
3. What we keep, why, and on what legal basis
| Data | What it is for | Legal basis (GDPR) |
|---|---|---|
| Account: your Koru account’s email address; and, kept for us by Stripe, the billing name and address you enter when you add a card or buy credit, with a VAT or tax number if you enter one | Running your account, and invoicing you | Contract (Art. 6(1)(b)); legal obligation for invoices (Art. 6(1)(c)) |
| Card: your customer reference at Stripe, and your card’s brand, last four digits and expiry date | Charging your invoices, and showing you which card is saved | Contract (Art. 6(1)(b)) |
| Who you buy as: the country of your billing address, and whether you gave a VAT or tax number, as Stripe has them; and when you asked that credit you bought starts at once | Knowing whether you may buy as an individual where you are, the tax your prices are shown with, and whether you may withdraw from a purchase | Contract (Art. 6(1)(b)); legal obligation for consumer and tax rules (Art. 6(1)(c)) |
| Usage and invoices: what each app used, by hour and by price line; your spending limit; your invoices and payments | Billing you, and keeping our accounts | Contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) |
| Your apps’ settings: the names of your apps, environments, databases and buckets; their sizes, modes and ports; the names of your variables; the Koru project each app belongs to, by its id only; the public halves of your tunnel keys | Running your apps as you set them up | Contract (Art. 6(1)(b)) |
| Sealed values: your variables and database logins as ciphertext we cannot open, and a bucket’s key sealed to your device until your device has taken it | Giving the cluster what your apps need, without us seeing it | Contract (Art. 6(1)(b)) |
| Builds: when each build ran, how large its upload was, the name of the image it made, and whether it succeeded; for a build from GitHub, its repository, branch and commit, the first line of the commit message, and its author’s GitHub name or git name | Deploying your apps and showing you their history | Contract (Art. 6(1)(b)) |
| Watcher: for each environment where you turned on a watcher, the patterns of its log lines and how often each appears, what its requests answered and how long they took, its instances’ states, the alerts it sent you, and which version of section 5 you accepted when you turned it on (section 5) | Telling you when something looks wrong with your app, and showing what you agreed to | Contract (Art. 6(1)(b)). Personal data about your own users in your logs is processed on your instructions, under the Data Processing Agreement |
| Notices and decisions: notices about your apps, our statements of reasons, orders from authorities, and the copy of an app and its data we must keep after a removal order | Handling illegal content and abuse, and following the law | Legal obligation (Art. 6(1)(c)); our legitimate interest in a safe service (Art. 6(1)(f)) |
4. What we never keep
- the values of your variables and secrets;
- your database passwords, and what your databases hold;
- your bucket keys, once your device has taken them, and your files;
- your apps’ logs as your apps wrote them, and the contents of requests to your apps.
Two things pass through Koru’s servers without being kept. When you deploy from your Mac, your project folder is kept only until its build has finished, and then deleted. Your logs stream from the cluster through Koru’s servers to you, and are never stored there. A watcher, where you turn one on, reads an environment’s logs in the cluster and keeps only their patterns and counts (section 5).
The servers that run your apps, databases, disks and buckets do hold your data, because they have to. Our operators have access to those servers, and use it only to keep Koru hosting running, to fix problems, or when the law requires it. The Data Processing Agreement covers that.
5. If you turn on a watcher
A watcher is an add-on for one environment of an app. It reads that environment’s logs and the state of its instances as they happen, and emails you when something looks wrong. It is off until you turn it on, and you can turn it off at any time. It only alerts: it takes no action on your app, and nobody talks to it.
- What it reads. What the environment’s instances print, the line the platform writes for each request to them (its method, its path, its answer and how long it took), and the instances’ states, such as a restart or running out of memory.
- What it takes out first. Before anything is kept or leaves the cluster, the values of the environment’s variables that are 8 characters or longer are taken out of every line, secrets included. Numbers, identifiers, network addresses, email addresses, tokens, secrets a line names and quoted text are replaced by placeholders, and the queries of web addresses are dropped. Like lines are then folded into patterns. What is left is those patterns, how often each appears, and the instances’ states. A word your app writes into a line that is none of these, such as a name, or a variable’s value shorter than 8 characters, can remain in a pattern.
- Who reads it. The patterns, the counts and the instances’ states, with the names of the app and the environment and when it was last deployed, go to Anthropic Ireland, Limited, which runs the AI model that judges whether something is wrong. Anthropic is our sub-processor for this, and only for the environments where you turned on a watcher. Its model may run in the United States and other countries outside the European Economic Area; the transfer is covered by the EU’s standard contractual clauses in Anthropic’s data processing addendum. Anthropic may not train its models on this data. It does not keep it after answering, unless the law requires it to, or its safety systems flag it, in which case it may keep it for up to two years.
- What we keep. While the watcher is on, the cluster in Frankfurt, Germany, keeps the patterns it has found, each with when it was first and last seen and how often it appears, the counts of the last hour, the usual counts of the last week, and the instances’ states. They are deleted from the cluster when you turn the watcher off. The cluster’s backups hold copies of them, which go when those backups are deleted (section 7). Each alert the watcher sends you is kept with your account’s other hosting alerts. We never keep the lines themselves.
- Your own users. Your logs may hold personal data about the people who use your app. Turning on a watcher is your instruction to us to process it this way, under the Data Processing Agreement. If your logs hold such data, mention this processing in your app’s own privacy policy.
6. Who else handles it
- Hostup runs Koru’s own servers in Sweden, where the data in section 3 is kept.
- Stripe (Stripe Payments Europe, Limited, in Ireland) handles card payments and invoices. It receives your billing details and your invoice lines, and also handles them under its own privacy policy. Stripe belongs to a group based in the United States; for what reaches the United States, we rely on the EU-U.S. Data Privacy Framework where Stripe takes part in it, and otherwise on the EU’s standard contractual clauses.
- OVHcloud runs the cluster in Frankfurt, Germany. The cluster holds the names and settings of your apps, which it needs to run them.
- Amazon Web Services (Amazon Web Services EMEA SARL, in Luxembourg) keeps the cluster’s backups in Frankfurt, Germany, and with them the cluster’s records of the names and settings of your apps, and the patterns and counts your watchers keep (section 5).
- Resend delivers Koru’s emails, such as sign-in links. It receives your email address and the content of the email. Resend is based in the United States; for this transfer we rely on the EU-U.S. Data Privacy Framework where Resend takes part in it, and otherwise on the EU’s standard contractual clauses.
- Anthropic (Anthropic Ireland, Limited, part of a group based in the United States) runs the AI model behind the watcher. It receives the log patterns, counts and instance states of the environments where you turned on a watcher, with the names of those environments and their apps and when each was last deployed, and nothing else (section 5).
- Authorities, when the law requires us to share data.
We never sell your data.
7. How long we keep it
| Data | How long |
|---|---|
| Your apps’ settings and sealed values | Until you change or delete them, or delete the app; copies in the cluster’s backups stay until those backups are deleted |
| Account and card | Until you end Koru hosting for your account, or remove the card |
| Usage, invoices and payments | Until the end of the seventh year after the year in which the financial year they belong to ended, as the Swedish Bookkeeping Act requires |
| Build records | Until you delete the app, or the environment it was built for |
| Notices and statements of reasons | 12 months after the matter is closed |
| A watcher’s patterns and counts | While the watcher is on, and deleted from the cluster when you turn it off; copies in the cluster’s backups stay until those backups are deleted |
| A watcher’s alerts | As long as your account’s other hosting alerts |
| The copy kept after a removal order | Six months, or longer if an authority or a court asks us to |
8. Your rights
You have the right to get a copy of your data, to have it corrected or erased, to restrict or object to its processing, and to take it with you. Write to support@flybywire.se; we answer within a month. Some data we must keep by law, such as invoices, even if you ask us to erase it.
You can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at imy.se, or to the data protection authority where you live or work.
9. If you send us a notice or a report
When you tell us about illegal content or abuse, we keep your name, your email address and what you sent us, to handle it, to tell you what we decided and to keep a record of our decision. The legal basis is our legal obligation under the Digital Services Act (Art. 6(1)(c)) and our legitimate interest in a safe service (Art. 6(1)(f)). We keep it for 12 months after the matter is closed. We give your details to the customer concerned only when that is strictly necessary, and we tell you before we do.
10. If you use an app on Koru hosting
If you use a website or service that one of our customers runs on Koru hosting, that customer decides what happens to your data and is responsible for it. Read its privacy policy and send your requests to it. If you send them to us, we pass them on.
11. Changes
When this page changes, we update the date at the top, and we tell hosting customers about important changes by email.