Privacy Policy
Last updated 14 August 2026 · Effective 14 August 2026
The short version. We collect your email address, what you pay us, and how much computing your apps use. We store and retain the data that you and your applications put on NukeBase, and we are able to access it — to run and secure the platform, to help you when you ask, to investigate suspected abuse, and where the law requires it. We do not run advertising trackers and we do not sell your personal data. You can download everything you have with us at any time, and delete your account whenever you like.
1. Who we are
NukeBase is an application hosting platform operated by Anderson Web Consulting ("NukeBase", "we", "us"), a business registered in the State of Idaho, United States, with a registered address at 17834 Stony Ridge Ave, [CITY], Idaho [ZIP], USA.
For the account you hold with us, we are the data controller. For the data your own applications store about your users, we are a data processor acting on your instructions — see section 4 and our Data Processing Addendum.
2. What we collect
Information you give us
- Email address. This is your account identity. NukeBase accounts use sign-in links rather than passwords, so for ordinary accounts we never receive or store a password.
- Project names and content. The code and files you deploy.
- Custom domain names, if you connect one.
- Anything you send us in a support email.
Information created by using the service
- Account identifiers — an internal user id and hashed session tokens.
- Usage measurements, per project — processor seconds, memory gigabyte-hours, disk gigabyte-hours, bandwidth in bytes, and the number of sign-in emails sent. These drive your bill, so they are recorded continuously.
- Billing records — your credit balance, monthly usage history, and the plan you are on.
- Application logs — whatever your app prints to its output, retained by the operating system's journal and shown to you in your dashboard.
Information we receive from others
- Stripe sends us a customer identifier, a subscription identifier, whether a payment succeeded, and the email on the payment. We never receive or store your full card number. Card details go directly to Stripe.
What we deliberately do not do
- We run no advertising or analytics trackers on nukebase.com. There are no third-party scripts on the page.
- Your IP address, browser user-agent and referring page are read from each request to enforce rate limits and security rules, and are not written to our database as part of your account record.
- We do not sell personal data, and we do not "share" it for cross-context behavioural advertising as those terms are used in US state privacy laws.
3. Why we use it, and our lawful basis
If you are in the UK, EU or EEA, the UK GDPR and EU GDPR require us to name a lawful basis for each use:
| What we do | Data used | Lawful basis |
|---|---|---|
| Create and run your account, deploy and host your apps | Email, project content, account identifiers | Performance of a contract |
| Send sign-in links | Performance of a contract | |
| Meter usage and charge you | Usage measurements, billing records, Stripe identifiers | Performance of a contract; legal obligation (tax and accounting records) |
| Keep the platform secure and available — rate limiting, abuse prevention, spend caps | Request metadata, usage measurements | Legitimate interests (protecting our service and our other customers) |
| Respond to your support requests | Whatever you send us | Performance of a contract; legitimate interests |
| Service announcements that affect your account | Legitimate interests |
We do not send marketing email to customers unless you opt in, and you can withdraw that at any time without affecting your account.
4. Data you store on NukeBase, and our access to it
We store it and we keep it
Everything you deploy to NukeBase — your code, your files, your database contents and your application logs — is stored on our servers so that we can run it for you. We retain it for as long as your account and projects exist, and for the periods set out in section 8 afterwards. Copies also exist in operational backups, which age out on their own cycle.
We are able to access it
NukeBase is not a zero-knowledge or end-to-end encrypted service, and we do not want to imply otherwise. Our personnel and automated systems are technically able to access the contents of your projects, databases, files and logs. We may do so:
- to operate, maintain, migrate, back up and restore the platform;
- to diagnose and fix faults, including problems you report to us;
- to provide support you have asked for;
- to investigate suspected breaches of our Acceptable Use Policy — we cannot enforce a prohibition on illegal or prohibited content without being able to look at what is being stored;
- to protect the security, integrity and availability of the platform, our other customers, or the public; and
- where we are required to by law, or in response to valid legal process.
We do not access your content to sell it, to share it with advertisers, or to build a profile of you. We do not use it to train machine learning models.
It is still your data
- You decide what your app collects and why. Where your app holds personal data about your own users, you are the controller of that data and we act as your processor. It is your responsibility to have your own privacy notice and lawful basis for it.
- If you use our hosted sign-in email feature, we process your end users' email addresses solely to deliver the sign-in links your app asks us to send.
- You can download your entire project — every file, exactly as it sits on our servers — at any time from your dashboard, and you can delete it at any time.
The terms governing this are in our Data Processing Addendum, which forms part of your contract with us.
5. Cookies
We set exactly two cookies, both strictly necessary to keep you signed in:
| Cookie | Purpose | Lifetime |
|---|---|---|
uid |
Identifies your account to the server | 30 days |
token |
Proves the session is genuinely yours | 30 days |
Both are HttpOnly, Secure and SameSite=Strict, meaning they
cannot be read by JavaScript and are not sent to other sites. Because they are strictly necessary for a
service you have asked for, they do not require consent under the ePrivacy Directive or the UK PECR.
We use no analytics, advertising or profiling cookies. If that ever changes, we will
ask for your consent first.
6. Who we share data with
We use a small number of service providers ("sub-processors"). Each is bound by contract to protect your data and to use it only for the purpose we engage them for.
| Provider | What they do | Data they see |
|---|---|---|
| Stripe | Payments and subscription billing | Email, payment details (collected directly by them), billing history |
| Mailgun | Sending sign-in links and transactional email | Recipient email address and message content |
| OVHcloud | Servers and infrastructure | Hosts all platform and customer data at rest |
| Let's Encrypt (ISRG) | TLS certificates for custom domains | Domain names you connect |
We may also disclose data where we are legally required to, or to establish or defend legal claims. If NukeBase is ever sold or merged, your data may transfer to the acquirer, and we will tell you before that happens.
7. Where your data is stored
NukeBase runs in two regions, both in the United States — US West
(usw1) and US East (use1). You choose your region at sign-up. Your account
record is replicated between regions so you can sign in to either; your project files and database
stay in the region you deployed to.
If you are in the UK, EU or EEA, this means your personal data is transferred to the United States. We rely on the European Commission's and the UK's Standard Contractual Clauses as the transfer mechanism, together with the technical measures described in section 10. You can request a copy of the clauses from us.
8. How long we keep it
| Data | Retention |
|---|---|
| Account record and project data, while your account is open | Until you delete it |
| Projects after a subscription is cancelled | Stopped immediately; deleted after a 30-day grace period |
| Account record after you delete your account | Marked deleted at once and purged within 30 days (the delay exists so the deletion propagates to both regions and is not undone by replication) |
| Billing and payment records | As long as tax and accounting law requires, typically 6–7 years |
| Application logs | Held by the server journal and rotated automatically; not archived long-term |
9. Your rights
Depending on where you live, you have some or all of the following rights. We honour these requests for everyone, wherever you are, rather than only where the law compels us to.
- Access — a copy of the personal data we hold about you.
- Portability — your data in a usable format. You already have this without asking: the download button in your dashboard gives you your entire project.
- Correction of data that is wrong.
- Deletion — available directly from your dashboard.
- Restriction or objection to processing based on legitimate interests.
- Withdraw consent where we relied on it.
- Not be discriminated against for exercising these rights (California).
Email support@nukebase.com and we will respond within 30 days. We may need to confirm you control the account's email address first.
If you are in the UK or EEA and think we have handled your data badly, you can complain to your local supervisory authority — in the UK, the Information Commissioner's Office (ico.org.uk). We would much rather you told us first.
10. Security
- All traffic is served over HTTPS.
- Session tokens are stored hashed, never in the clear. Ordinary accounts have no password at all, which removes an entire category of breach.
- Each customer's projects run in an isolated environment with its own operating system user, memory limits and disk quota, so one project cannot reach another's data.
- Payment card details never touch our servers.
- Access to production systems is limited to people who need it.
No system is perfectly secure. If we discover a breach affecting your personal data, we will notify you and the relevant regulator as required by law.
11. Children
NukeBase is not intended for anyone under 16, and we do not knowingly collect their data. If you believe a child has given us personal data, email us and we will delete it.
12. Changes to this policy
If we make a change that materially affects you, we will email you at least 14 days beforehand. The date at the top always reflects the current version.
13. Contact
Privacy questions, data requests and complaints: support@nukebase.com
Anderson Web Consulting, 17834 Stony Ridge Ave, [CITY], Idaho [ZIP], USA