# Privacy Policy

> What shedix keeps about you, why, which services handle it, how long it's kept, and what you can ask of us.

Last updated: 3 November 2026

Shedix, Chandigarh, India ("shedix", "we") runs shedix.dev. This policy says what we
keep about you, why, who else handles it, and what you can ask of us. Contact: support@shedix.dev.

## What we keep

- **Your account:** your email address and name from your sign-in, when you joined and last used shedix, and the
  short name your machines start with.
- **Your machines:** names, sizes, stack, project names and labels you give them, their history (who created,
  started, stopped, put to sleep or deleted each, and when), how full their disks are and how much memory is in use,
  and when they were last used. Your machines keep their own files; we don't copy or read them.
- **Access:** the public SSH keys you add, and for each token you create its name, a hash of it (never the token
  itself), and each call it makes (time, action, machine, result, IP address and browser or tool name).
- **Billing:** your credit balance and its ledger (top-ups, what each machine used by the second, refunds, credit
  given), your monthly cap and limits, and the top-ups you start (amount and status). We don't receive your card
  details.
- **Invites:** if you're invited, or sign in without an invite, your email and name and when you last tried.
- **Logs:** our servers' logs (requests and errors) for running and securing the service.

We don't use advertising trackers or sell your data.

## Why

To run shedix for you (machines, sign-in, billing and the emails about them), to keep it secure and fair (limits,
abuse, disputes), and to keep records the law requires, such as payment records.

## Who else handles it

| Service | For | What it handles |
|---|---|---|
| Clerk | Sign-in | Your email, name and sign-in sessions |
| Google Cloud | Running machines (Iowa, United States) | The machines and disks you create, and their contents |
| Cloudflare | The site, API, tunnels to your machine's browser terminal and editor, email sending, backups | Requests to shedix and your machines' browser tunnels; emails we send you; daily copies of billing records |
| Neon | The database | Everything listed under "What we keep" except your machines' files |
| Dodo Payments | Payments, as merchant of record | Your payment details, billing address and tax details, under its own privacy policy |
| GitHub | "Use my GitHub keys" | Fetches your public keys, only when you ask |

These providers may process data outside your country, including in the United States.

## How long

- Your account and machine history: while your account is open, and 30 days after you ask us to close
  it.
- A deleted machine's disk is deleted at once; its name and history stay in your account's history.
- Billing records (the ledger, top-ups): as long as tax and accounting law requires, up to 8 years.
- Daily copies of billing records: 180 days.
- Token call logs: 1 year.

## Your choices and rights

You can see most of this on your account page, delete machines and revoke tokens at any time, and ask us at
support@shedix.dev for a copy of your data, to correct it, or to close your account and delete it (except records
we must keep by law). Depending on where you live (for example under the GDPR or California's CCPA) you may have more
rights, including to complain to a data protection authority.

## Emails

We send emails about your account: low credit, machines put to sleep or deleted for credit, your monthly cap, a
suspension, and an invite if someone invites you. We don't send marketing emails.

## Cookies and storage

The site uses Clerk's cookies to keep you signed in, and your browser's local storage for preferences such as the
theme and your machine list. No analytics or advertising cookies.

## Changes

We'll post changes here and email you before a significant one takes effect.