Privacy policy

The service is provided by Ackee, a service operated from the United States by its developer. In this policy "Ackee", "we" and "us" mean that operator, and "you" means the person or organisation with an Ackee account, or a visitor to the site. We act as controller for account, billing, security and support information because we decide why and how it is processed. Customer content is addressed below.

Ackee is a visual editor for cloud infrastructure. You draw a graph, Ackee compiles it to OpenTofu, shows you the plan, and applies it in a cloud account that belongs to you. That shape decides most of what follows: we hold the drawing, the credentials you hand us to act on your behalf, and the logs of what happened, and we hold as little else as we can.

This policy applies to the Ackee sites, the deployment manager, the API and the mobile apps. It does not apply to the cloud providers, to GitHub, or to any other service you connect to Ackee. Those services have their own policies, linked in section 5.

For personal data you or your organisation include in project content and build inputs, you are responsible for authority to provide it and instructions for its use. Where we process that content on your behalf, applicable data-processing terms are needed; this policy does not replace them or govern your application’s privacy practices.

Everything in this table is collected either because you typed it in, because you connected something, or because the server has to record it to keep your account safe. We also receive information from people who invite you or share projects with you, and from connected identity, repository, payment and cloud services. We do not buy personal information from data brokers.

• •Payment card entry happens on Stripe-hosted pages; Ackee does not store your card number.
• •We do not track browsing across third-party sites for advertising or build advertising profiles. Automated security checks and plan limits can reject sign-ins or deployments, but we do not use personal information for solely automated decisions with legal or similarly significant effects on individuals.
• •We do not routinely read application database rows, ordinary object contents or end-user traffic. Infrastructure discovery, source staging, state processing and information included in your logs and reports do involve access to cloud and repository data as described below.
• •Connected providers process information under their own policies when you visit or authorise them. We do not use service content to train general-purpose AI models.

Graphs, build context, raw plan JSON, OpenTofu state, logs and outputs can contain sensitive values. Encryption of connected credentials does not mean every pasted or printed value is separately encrypted or redacted. Prefer secret-manager references and review what you share with collaborators or submit in reports.

European and UK law ask a controller to name the legal basis for each use of personal data. Ours are these:

• •Providing the service you signed up for — your account, your projects and environments, shared workspaces, invitations, deploys, source builds, connected repositories and cloud credentials, requested agent and API operations, and email that is part of using the product (verification, reset, two-factor links). Basis: performance of our contract with you (the terms of service). Where your organisation holds the contract, our legitimate interest in providing its requested service supports processing your business account and collaboration information; customer content processed on its behalf follows its instructions and applicable data-processing terms.
• •Keeping accounts secure — session records, sign-in attempts and throttling, two-factor challenges, credential protection, API-token and connected-app authorisations, revocation and usage records. Basis: our legitimate interest in preventing unauthorised access and investigating misuse.
• •Billing — plan enforcement, usage counts, Stripe identifiers, invoices. Basis: performance of the contract, and our legal obligation to keep financial records.
• •Investigating bug reports, supporting collaboration for your organisation, answering you and telling you about changes to your account or to these documents. Basis: performance of the contract and our legitimate interest in being reachable. We do not send marketing email.
• •Complying with the law — responding to a lawful request, notifying you of a breach, keeping records we are required to keep. Basis: legal obligation.

Authorising GitHub or Google grants technical access for the connected features, not blanket consent to unrelated processing. Account and deployment processing uses the bases above. Where a specific use legally requires consent, we request it and you can withdraw it without affecting earlier lawful processing. Disconnect connections in Ackee or revoke access at the provider. Agreeing to this policy does not waive privacy rights or substitute for separately required consent.

Providing your email address is a condition of having an account; without it we cannot verify you or let you recover access. Cloud and repository access are required for their connected features, and billing information for a paid subscription. We also receive invitation information from collaborators and operational information automatically. Optional diagnostic context can be unchecked before sending a bug report.

We do not sell personal data and we do not share it for advertising. We never have. The services below process data on our behalf or because you chose to connect them.

Organisation members can see member emails and roles. Team and project permissions govern access to shared graphs, configuration, deployments, logs and outputs across the project’s environments. A collaborator may be able to use a shared connection without seeing its stored secret. Authorised Ackee administrators can read submitted bug reports and relevant service records for support and security. We may also disclose information for binding legal requests, protection of people or the service, legal claims, or a business transfer with applicable notice and privacy protections. Google API data remains subject to the additional transfer restrictions below.

Connecting an app through Ackee's consent screen, or supplying a personal API token to a client, enables that client to request data and actions as your account within the access described in the terms. Review the client and its recipients before connecting it, including whether you have authority to share team content. Client registration or a displayed app name is not an Ackee endorsement or independent verification of the operator.

MCP tools do not return stored cloud credentials, compiled OpenTofu configuration or raw plan JSON, and withhold outputs marked sensitive. Graph fields, logs, error messages and other returned text may still contain personal data or secrets; these protections do not mean every tool result is redacted. A personal API token can also call permitted API routes beyond MCP, so the MCP response restrictions do not describe every API response.

Ackee does not use service content to train general-purpose AI models. An independently selected client's retention, model use and onward processing depend on its terms, settings and applicable obligations; our commitment does not make a promise about that provider's practices. Google API data remains subject to section 7 even when accessed through an agent. Disconnect apps under Account → Connected apps and revoke personal tokens under Account → API tokens. Revocation stops subsequent authenticated access through those credentials; it does not recall data already received by a client or cancel work already running. Request deletion of copies held by an independent client from its operator.

Connected cloud credentials are stored encrypted and decrypted by the API or worker when needed. Access includes identity and connection tests, supported AWS, Google Cloud and Azure resource discovery for import, permission and service checks when an environment opens, Google API enablement and Azure resource-provider registration needed for requested features, state and runner preparation, source builds and deployment operations. These actions can also be requested through supported agent tools. Access is not limited to the moment you press Apply.

Discovery reads supported infrastructure metadata and returns an import preview; selected references become saved project content. It is not a scan of database rows or ordinary application files. Use the least privilege suitable for your workflow, since a credential may grant access beyond the resources in a graph.

For supported Google Cloud source builds, Ackee downloads the selected GitHub commit archive through its worker, uploads it to your Google Cloud storage, and uses Cloud Build to build and push an image to Artifact Registry. Source archives, images and provider build records may remain after a run. Other configured workflows can build through GitHub Actions and notify Ackee when an image is ready.

With durable state configured, OpenTofu state lives in your AWS S3 or Google Cloud Storage bucket, or an Azure Blob Storage container in your subscription. Ackee stores its location and processes state-derived plans and outputs. Depending on configuration, execution uses an Ackee worker or a runner in your cloud: AWS Fargate, Google Cloud Build or an Azure Container Apps job. Runner preparation can create supporting cloud resources and stage configuration and execution files there; provider records and artifacts follow your cloud settings. Unsupported or development configurations may keep state on worker disk, which is not durable across replacement. State and plan data can contain sensitive values.

Disconnecting removes that stored connection from future use but may not revoke a key, an already issued token, another project/node connection, or a running job. Revoke access at the provider and remove separate connections when needed. Deleting Ackee records does not delete deployed resources, cloud state, source archives, images or provider logs.

When you connect Google Cloud through Google OAuth, Ackee requests OpenID and email access to identify the connected account, and the Google Cloud Platform scope for the discovery, readiness, build and deployment features described above. This connects Google Cloud to an environment; it is separate from signing in to Ackee.

Ackee's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In plain terms: data Ackee receives through a Google API is used only to provide the features you see, is never used for advertising, is never sold, and is never used to train a general-purpose model. Transfers are limited to providing or improving prominent user-facing features with your consent, security, legal requirements, or a business transfer with explicit prior consent. Human access is limited to affirmative agreement to view specified data, necessary security investigations, legal requirements or permitted aggregated internal operations. You can revoke access through your Google account and request deletion at our contact address.

These first-party cookies support requested authentication, security and return navigation. They are server-readable only, use SameSite protections and are marked Secure in production. Blocking them can prevent sign-in. We do not set advertising or analytics cookies.

Local storage named ackee.palette.starred.v1 saves starred node types on your browser until you change them or clear site data; it has no automatic expiry. Account deletion does not clear another browser’s local storage. Console history is held in page memory; saved project content is stored by the service.

We do not change behaviour in response to Do Not Track or Global Privacy Control: we do not sell data, share it for cross-context behavioural advertising, or perform that tracking. Providers you visit separately may use cookies under their own policies.

Ackee's servers and database are hosted in the United States by Railway. If you use Ackee from outside the United States, your data is transferred there and processed there. Ackee is operated from the United States.

If EEA, UK or Swiss transfer rules apply, international processing requires an applicable transfer mechanism and any required supplementary safeguards. Creating an account is not consent to bypass those rules. Contact us for the transfer arrangements and a copy of any safeguards applicable to your information. Ackee does not claim EU–US Data Privacy Framework certification. Your cloud region selection does not determine the location of all Ackee account, support or billing records.

Request account deletion in settings or through our contact address. Deletion is refused while an affected deployment is active. Coordinate with collaborators first: deleting the account recorded as an organisation’s billing account can delete that team and its shared work. Content in other organisations and copies others lawfully hold may remain; contact us about personal information within them.

Destroy unwanted cloud resources and preserve exports and state needed to manage retained infrastructure before deleting Ackee records. Resources and storage can continue to incur charges. Applicable preservation obligations and backup cycles can delay removal of particular copies; we explain relevant exceptions when responding to requests.

• •Every connection to Ackee is encrypted in transit.
• •Passwords are stored only as salted hashes designed to be slow to guess. Two-factor authentication is available to every account and works with any authenticator app.
• •Cloud credentials, GitHub tokens and authenticator secrets are encrypted at rest with a key that is not in the database, using a key held separately from the database. Other stored configuration, plan data, logs and reports may still contain sensitive content.
• •The web sign-in session token lives in a server-only cookie and is not readable by browser scripts. Personal API tokens are different: the account interface displays a new token once so you can give it to your chosen client. Connected apps receive their own Ackee OAuth tokens. Treat those credentials as secrets.
• •Sign-in is throttled per address and per account. Every session is visible to you and revocable by you, and changing your password revokes all of them.
• •Cloud runners can isolate deployment execution in your own cloud account when configured. Isolation reduces exposure but does not guarantee that a compromised run cannot affect other resources reachable with its credentials.

No system is perfectly secure. If we learn of a breach that affects your personal data, we will tell you without undue delay, in the way and within the time the laws that apply to you require, and we will tell the authorities those laws name.

You can make the following requests. Legal rights and exceptions depend on applicable law:

• •Tell you what personal data we hold about you and give you a copy in a common, machine-readable form.
• •Correct anything that is wrong. Contact us to correct account information that you cannot change in settings.
• •Request deletion of your personal data or account, subject to the shared-workspace, retention and cloud-resource distinctions in section 10.
• •Stop or restrict a particular use of your data, or object to one that rests on our legitimate interests.
• •Withdraw a consent you gave — most simply by disconnecting GitHub or a cloud credential, or by revoking Ackee at that provider.

To ask, write to legal@ackee.dev from the address on your account, or from any address if you can otherwise show the account is yours — we verify a request against the account before acting on it, because acting on a stranger's request would itself be a breach. We aim to answer within 30 days and meet applicable deadlines, including one month under the GDPR/UK GDPR and generally 45 days for CCPA access, correction and deletion requests. We explain any permitted extension or refusal within the required time. You do not need to create an account to make a request; do not send passwords or recovery codes. If you disagree with our answer, reply and say so; a different person will look at it, where we have one, and you will get a written decision. Requests are generally free; we explain any legally permitted exception. We do not discriminate for exercising privacy rights. If you appeal a refusal, we provide a reasoned response within the applicable deadline and information on contacting the relevant regulator.

Someone acting for you may make a request on your behalf if they show us that you authorised them.

State privacy laws apply according to their scope, thresholds and exemptions. This section describes our practices and rights where those laws apply; it does not assert that every state statute applies to Ackee. The request process above is available wherever you live.

In the last twelve months, to the extent relevant features were used, the categories collected include identifiers (email, account and GitHub identifiers, IP address); account log-in credentials as sensitive personal information; commercial information (subscription and usage); internet activity (sessions, sign-in attempts and operational records); and information in team memberships, invitations, project content, repositories, builds, reports and correspondence. Sources include you, your browser, collaborators and connected providers. Section 2 identifies sources and purposes, section 5 describes recipients for business and collaboration purposes, and section 10 describes retention.

Ackee does not sell personal information and does not share it for cross-context behavioural advertising, has not done so in the last twelve months, and has no actual knowledge of selling or sharing the personal information of anyone under sixteen. These practices also apply when your browser sends Global Privacy Control. We do not use sensitive personal information for anything beyond what the law permits without a limit request, and not to infer characteristics about you.

Where applicable state law provides them, rights include knowing, accessing, correcting, deleting and porting your data, opting out of sale, advertising sharing, targeted advertising or qualifying profiling, appealing a refused request, and freedom from discrimination for exercising rights. Section 12 gives the request and appeal process at legal@ackee.dev. Contact us also for any applicable state-specific right to information about the third parties that received your data.

If you are in the EEA, the UK or Switzerland, the controller is the operator named in section 1, reachable at the address in section 17. Section 4 gives the legal basis for each use; section 9 explains the transfer to the United States; section 12 covers the rights the GDPR and the UK GDPR give you — access, rectification, erasure, restriction, portability, objection, and withdrawal of consent.

You also have the right to complain to a supervisory authority: the data protection authority of the country you live in, the Information Commissioner's Office in the UK, or the Federal Data Protection and Information Commissioner in Switzerland. We would rather hear from you first, but you do not have to.

Privacy enquiries, including questions about an applicable representative or data-protection contact, go to the contact address below. This policy does not claim an exemption based solely on Ackee’s size.

Ackee is a tool for deploying production infrastructure and it charges money. It is not for children. You must be at least eighteen to have an account, and Ackee does not knowingly collect personal data from anyone under thirteen. If we learn that we hold data from a child, we delete it. If you believe we do, tell us at the contact address.

Version 0.3.0 is dated September 9, 2026 and applies to new accounts from publication. For earlier accounts, substantive changes apply no sooner than 14 days after we email a summary. Publication alone does not establish that this email was sent or that the notice period elapsed. The earlier notice commitment remains in place during that period.

Future substantive changes also receive at least 14 days’ advance email notice and a new version. Corrections that change no practice may apply on publication. We obtain any legally required consent before a new use, including consent required by Google’s policy and provider authorisation for additional OAuth permissions. Continued use is not a substitute for such consent, and a revised notice cannot retroactively authorise an undisclosed use.

Version history summarises revisions; prior text is available on request. Statutory and deletion rights continue if you stop using the service.

Questions, requests and complaints about privacy go to legal@ackee.dev. That address reaches the developer who runs Ackee. If you write about a right in section 12, say which account you are writing about, and write from that account's address if you can.

Every version of this document has a number. While Ackee is in preview the number starts with 0: a change to the middle digit (v0.2.0) means something you agree to, or something we collect, has changed; a change to the last digit (v0.1.1) means the wording changed but not the substance. Version 1.0.0 will be the text in force when Ackee leaves preview. This address shows the latest published version. The changes section explains when it applies to existing accounts; the history records what changed and when.

1. v0.3.0September 9, 2026currentAdds API-token and connected-app data, agent requests and billing records, environment values, recipients, access controls, retention and revocation. Updates Azure support, security and organisation-account processing. Existing-account notice and required consent still apply.
2. v0.2.0September 6, 2026Updated for teams, environments, invitations, bug reports, discovery, source builds, four authentication cookies and browser storage. Corrects cloud access, state, retention, deletion and privacy disclosures.
3. v0.1.0September 2, 2026First draft, written for the preview. Describes the email, GitHub and Google sign-in paths, encrypted cloud credentials, the state bucket in your own account, the two cookies, Stripe billing, and the Railway, Stripe and Resend providers.

Questions about this document go to legal@ackee.dev.