Draft, under review. This text is a plain-English starting point and is not legal advice.

Privacy Policy

Effective 2026-10-15.

[MicroHost operator legal name] ([Postal address]) runs MicroHost and is responsible for the personal data described here. Contact: abuse@example.com.

What we collect

Account: your email address and name, and sign-in sessions (with the IP address and browser they came from).
Your sites: the files you publish, their link names and settings, and a history of what was published when.
Billing: if you pay, Stripe handles your card. We keep your Stripe customer id, subscription status and renewal date, never your card number.
Terms acceptance: which version you accepted and when, with a one-way hash of your IP address and your browser’s user agent.
Abuse reports: what a reporter tells us, their email address if they give one, and a one-way hash of their IP address (used to limit report floods).
Logs: an audit log of actions on accounts and sites, and a short-lived count of publishes per hour.
Email log: which emails we sent you and when (kind and subject), with a one-way hash of the address rather than the address itself.

We do not add analytics or tracking to the sites you publish. Visitors to your site are served by Vercel, which keeps its own request logs.

Why we use it

To run the service you signed up for (the contract with you).
To bill you, and to keep records the law requires.
To prevent abuse and keep the service safe (our legitimate interest, and our legal duties as a host).
To email you about your account: sign-in links, billing, and notices about your sites.

Who processes it for us

Vercel (hosting the dashboard and your sites, file storage).
Supabase (the database), in [region].
Stripe (payments), if you subscribe.
Resend (email delivery).

We do not sell personal data. We disclose it to authorities only when the law requires it.

How long we keep it

Deleted sites: kept 30 days (so the link name stays reserved for you), then removed with their history and archives.
Archived versions: the newest 10 per site, while the site exists.
Publish counts: one day. Resolved abuse reports: one year.
Account, terms acceptance and audit records: while your account exists, and longer where needed to handle a dispute or a legal obligation.

Deleting your account. You can delete your account from your account page. At once, your sites go offline, your subscription is cancelled and your Stripe customer record deleted, you are signed out everywhere, and your email address and name are replaced with placeholders, so your address is stored nowhere. The anonymized account record and your deleted sites’ history are removed 30 days later. After that, the audit log keeps the ids of the actions taken (never your email), the email log keeps what was sent without linking it to you, and Stripe keeps invoices and payment records as tax law requires.

Your rights

Depending on where you live you can ask to see, correct, export or delete your personal data, or object to how we use it. Email us and we will answer within 30 days. You can also complain to your data protection authority.

You can download everything we hold about your account yourself, as one file, from your account page (“Download my data”), and correct your name and email there.