Privacy
How we handle your data
What the build service stores when you pair Device Builder with it, for how long, and who can read it.
What pairing changes on your machine
- Every compile goes to the service once you pair. That covers OTA installs, USB/serial and Web-Serial installs, Download builds and bulk updates alike. Stock Device Builder has no per-build switch. To build locally again, unpair (or turn off build offloading) in Device Builder's settings.
- Pairing opens a connect-back listener on your local network. This is part of the stock peer-link protocol, not something we add: a paired Device Builder listens on your LAN for a build server that connects back to it. The Apollo service never connects to it. It answers every connect-back attempt with a refusal and never dials your machine.
- When you run out of minutes, installs still work. The service tells Device Builder it cannot build that job, and Device Builder builds locally on your machine as it did before you paired. You are not billed for those builds. The same happens when no build worker is free.
- Pairing keys work once. A key is shown once, expires after 60 minutes and pairs a single Device Builder. We store only a keyed hash (HMAC) of it.
Your configuration and secrets
- Device Builder sends a bundle with each build: your YAML,
secrets.yamland any included files. It is encrypted at rest with a per-build key (AES-256-GCM). That key is itself wrapped by a master key, and the object store never sees the master key. - Your secrets exist in plaintext only inside the throwaway sandbox that runs the compile, and only for the length of that build. Every spool on our machines and every stored object holds ciphertext only. Each sandbox runs one build and is destroyed afterwards. It has no access to other customers' builds.
- The bundle is deleted as soon as the build ends. Its key is destroyed at the same moment ("crypto-shredding"). The firmware is deleted, and its key destroyed, 10 minutes after Device Builder downloads it, or after 24 hours if it is never downloaded.
- We keep a log only when a build fails because of the configuration (or an environment difference), so support can help. That log is redacted: passwords, keys, tokens and Wi-Fi credentials are masked. It is deleted after 7 days.
- The portal never shows configurations, logs or firmware. It runs as its own process with its own database role, which cannot read the build keys.
Personal data we keep, and for how long
| Data | Why | How long |
|---|---|---|
| Email address | Sign-in links, pairing notices, billing | While the account exists. Replaced by an anonymous placeholder when you delete the account |
| IP addresses of your Device Builders | Security and abuse limits | While the pairing exists. Removed when you delete the account |
| IP addresses of pairing attempts | Rate limits and abuse detection | 30 days |
| IP address that created a pairing key | Security | While the key row exists. Removed when you delete the account |
| IP address and browser user agent of a portal session | Session security | Until you sign out, 30 days of inactivity, or 90 days at most |
| IP address of a sign-in link request | Rate limits | Until the link expires (15 minutes); expired links are purged |
| Dashboard label, friendly name and dashboard id | Shown to you in the portal and in emails | While the pairing exists. Read notices are deleted after 30 days. Removed when you delete the account |
Device name, configuration file name, device name from storage.json | Your usage page | 90 days, then removed from the build record |
| Pre-flight finding details and firmware warnings | Explaining a failed or unusual build | 90 days, then emptied |
| Short failure message of a build (redacted) | Your usage page | 7 days |
| Redacted log of a configuration-caused failure | Support | 7 days |
| Live build output relayed to Device Builder | Delivering the log while you watch | 1 hour after the build ends |
| Your configuration bundle (encrypted) | Compiling | Deleted, and its key destroyed, when the build ends |
| Your firmware (encrypted) | Delivery to Device Builder | 10 minutes after download, at most 24 hours |
| Stripe customer details (email, name, address, phone, shipping) contained in billing events | Reconciling payments | 90 days. Stripe's ids, amounts and period dates are kept for accounting |
| Audit trail of account actions | Security (insert-only, redacted) | Operator-action details 7 days. Every detail of your account is blanked when you delete the account |
| Build minutes and build counts | Billing | Kept for accounting, without names, labels or IP addresses |
Payment cards never reach us: Stripe hosts the checkout page and the billing portal.
Deleting your account
Settings → Delete account does the following, in this order:
- Cancels your Stripe subscription immediately, so you are never charged again. If Stripe cannot be reached, nothing is deleted and you can retry.
- Revokes every paired Device Builder and every pairing key. A connected Device Builder is disconnected at once.
- Destroys the encryption keys of all your builds.
- Deletes your portal sessions, sign-in links, invites and notices.
- Removes IP addresses, labels, names, device names and build details from the remaining rows.
- Blanks the details of your audit trail.
- Replaces your email address with an anonymous placeholder.
Billing totals stay, without anything that identifies you or your devices.
Backups: our database backups are kept for 30 days. For up to 30 days after you delete your account, or after a build's keys are destroyed, a backup can still contain the wrapped (encrypted) build keys and the redacted failure logs. The master key that unwraps build keys is never stored in a database backup. Backups age out on their own after 30 days.
Who can access what
- You, through the portal, see your own account only. Every page and action is checked against your session's account. Another account's pairing, key or build looks exactly like one that does not exist.
- Apollo operators use an audited command-line tool. Every operator action is recorded under the operator's own database identity in an insert-only audit log. The tool never prints configuration contents.
- Build workers receive a build's keys only while they run that build. They have no database or storage credentials.
- Stripe processes payments. Our email provider delivers sign-in links and pairing notices.
Verifying the service
Device Builder pins the gateway's identity when you pair. Before pairing, compare the 7 emoji, and ideally the full hex fingerprint, with the gateway fingerprint. If they differ, do not pair.