Privacy policy

Who we are

Sokie is run by Abyssinia Labs, which decides how the personal data in this policy is used. It covers sokie.sh, the sokie CLI, Sokie's API and the servers Sokie hosts. Using Sokie is also covered by the Terms of service.

What we collect

• Your account. When you sign in with GitHub or Google, we receive your name, email address and profile picture from them; when you sign in with a link by email, only the address you gave. Your name and picture refresh each time you sign in. Sokie never sees or stores a password.
• Your sessions. Each signed-in browser and CLI session is stored so you stay signed in, and can include the IP address and browser it came from.
• The waitlist. While Sokie lets people in a few at a time, signing in with an address that isn't let in yet puts it on a waitlist instead of making an account: we keep the name, verified email address and profile picture the provider sent (for a link by email, only the address), how you signed in, and when you signed in, and send you one email saying so.
• Sign-in checks. Signing in is checked by Cloudflare Turnstile, which looks at your browser to tell a person from a bot, and the number of sign-ins from each IP address is counted for a minute at a time, and the sign-in links sent to each email address for an hour, to limit abuse.
• Your workspace and servers. The workspace's name, the specs you upload or point Sokie at, the files Sokie reads from repositories you connect through its GitHub app, the servers it builds, their tool settings and deploy history, and the secrets and API credentials you give your servers, which are stored encrypted.
• Usage. Each tool call is counted at the edge, per server, per day and per month, for your usage page and for billing. The count is all that's kept for billing: never what a call sent or returned.
• Server logs. For each call, a log line with its time, the tool, how it ended, its status code and duration, the kind of error if any, and the name of the client that made it. Not the call's arguments or results.
• Webhooks. The addresses you give Sokie to send events to, their signing secrets, stored encrypted, and each delivery: the event Sokie sent and the status your endpoint answered, never what else it said.
• The audit trail. A record of who did what in your workspace: sign-ins, deploys, changes to servers, secrets (never their values) and billing. Where a workspace on a paid plan turns it on, an event also records the IP address and browser it came from.
• Billing. Stripe holds your card and billing details. We keep the Stripe customer and subscription references, your plan, your spending cap, and the counts of billable calls we report to Stripe.
• Email. A record of each email we send you: what kind it was, the address, and whether it was delivered. Not its contents.

How we use it

To run Sokie for you: signing you in, building and serving your servers, showing your usage, logs and audit trail, and billing you. To email you about your account: sign-in links you ask for, a welcome, your server's first call, a failed deploy, a broken sign-in to your API, usage warnings and plan changes. You can turn off the ones about your servers in Settings, under Notifications, or from the link in each. And to keep Sokie secure and meet our legal duties.

We don't sell your data, show ads, or use third-party analytics or tracking. We don't use your specs, servers or calls to train AI models.

Who processes it

These providers handle data for us, only to run their part of Sokie:

• Cloudflare hosts sokie.sh and your servers, stores your specs and server files in R2, carries calls to your servers across its network, and checks sign-ins with Turnstile.
• Convex runs Sokie's database, sign-in and backend.
• Stripe takes payments, keeps billing details and sends receipts and invoices.
• ZeptoMail, by Zoho, sends Sokie's email.
• GitHub and Google sign you in. GitHub also serves the repositories you connect to Sokie.

They may process data outside the country where you live.

Cookies

Sokie sets only the cookies it needs, all its own:

• a session cookie that keeps you signed in;
• a theme cookie that remembers light, dark or your system's setting;
• in the app, a cookie that remembers whether the sidebar is collapsed.

There are no advertising or analytics cookies. Stripe's checkout and billing pages are Stripe's own, and set cookies under Stripe's policy.

How long we keep it

• Server logs: 7 days on Hobby and pay as you go, and up to 30 days on Pro.
• The audit trail: one year. It outlives a deleted server, so the record stays whole.
• Records of sent email and of GitHub's notifications to Sokie: 30 days.
• Webhook deliveries, with what was sent and the status your endpoint answered: 7 days.
• The waitlist: until you're let in or ask us to take you off it. Sign-in counts per IP address: a minute. Sign-in links sent per email address: an hour.
• Stripe's reports of usage it couldn't bill: 90 days.
• Your account, workspace and servers: for as long as you keep them. A server you delete is removed with its files and deploys.
• Billing records: as long as tax and accounting law requires, mostly at Stripe.

Your rights and deletion

You can delete any server yourself, at any time. To get a copy of your data, correct it, or delete your account and everything in it, write to us at legal@sokie.sh. We'll do it within 30 days, keeping only what the law requires us to keep and audit events until their year is up.

Depending on where you live, you may also have the right to object to or restrict how we use your data, and to complain to your data protection authority. Write to us first and we'll try to put it right.

Sokie is made for developers and isn't directed at children.

Changes to this policy

When this policy changes, we'll update the effective date at the top, and for changes that matter we'll email account owners before they take effect.

Contact

Questions about your data go to legal@sokie.sh.