Last updated: October 13, 2026
Policy version: 2026-10-13
Scope and operator
This notice covers the Ashore dashboard, authentication service, billing integration, worker, hosting control plane, and support channels operated by Ashore Hosting LLC. It covers the dashboard only; hosted applications and services you connect may process information under their own notices.
Contract acceptance is not privacy consent
Checking the Terms of service and Acceptable-use policy box is contractual acceptance, not a substitute for any consent required by privacy law. Ashore processes information needed to provide the service, secure it, comply with law, and perform the contract or requested pre-contract steps. Where law requires consent for an optional purpose, Ashore will request it separately. Ashore currently uses no optional advertising or analytics purpose.
Information categories and sources
Information you provide
- Account identifiers: normalized username, account ID, role, account state, terms version, accepted policy snapshots, and acceptance timestamps.
- Authentication: password input used only to produce an Argon2id hash, opaque session token input represented in the database only by a hash, and invite-code input used to authorize registration. Ashore does not store the raw password, raw session token, or rejected invite as an account record.
- Hosted-service data: instance names, hostnames, configuration, encrypted credentials, resource state, deployment records, logs and job metadata, and content that you submit to or cause an application to store.
- Billing and support: Stripe customer/subscription identifiers and state, checkout authorization records, and information you send to support or abuse contacts. Ashore does not store payment-card numbers or complete Stripe webhook payloads in its application database.
Information collected from requests and providers
Requests may provide IP address, request time, path, method, user agent, origin, error, and security metadata. After terms acceptance, Ashore hashes client IP and normalized username values into short-lived login and registration throttling keys; hashed IP and username keys may still be personal information because they can be linked to an account or request. Stripe, hosting, Kubernetes, DNS/TLS, support, and other providers may provide identifiers or operational status.
Acceptance boundary
Before current terms acceptance, Ashore rejects login and registration before creating a session, account, policy-acceptance row, IP or username rate-limit row, invite claim, password hash, or hosted resource. Request processing is transient so the server can validate the submitted body. Reverse proxies, networks, hosting providers, and security systems may still receive connection metadata before acceptance; Ashore cannot erase logs controlled by those systems through this application.
Cookies and browser storage
Ashore creates no application-controlled cookie, local-storage item, analytics tracker, advertising tracker, pixel, session replay, or cross-site identifier before acceptance. After acceptance, the dashboard sets only the host-only paas_session authentication cookie described in the cookie and browser-storage notice. Existing browser cookies or storage created before a user visits Ashore are not read or deleted by Ashore. Stripe Checkout, the customer portal, and hosted applications are separate services.
Purposes and access
Ashore uses information to authenticate accounts, record acceptance, enforce access and abuse controls, provision and operate hosting, display status, process payments, investigate security incidents, answer support requests, improve reliability, and meet legal obligations. Authorized operators and support personnel may access account records, hosted configuration, credentials, volumes, application status, or logs only when needed for provisioning, support, security, deletion, legal compliance, or service operation. Credentials are encrypted and are not displayed as raw values by routine diagnostics.
Sharing and processing roles
Information may be shared with Ashore Hosting LLC, authorized staff, database and hosting providers, Kubernetes and image-registry providers, reverse-proxy/DNS/TLS providers, Stripe, support providers, and connected services needed to operate your applications. These providers act as subprocessors or independent providers depending on the service and applicable law. For hosted application data, Ashore may act as a processor or service provider on your instructions; request a data-processing agreement through support when your use or applicable law requires one. Hosted applications and downstream providers selected by your configuration remain independent recipients.
Retention and deletion
- Session records and the authentication cookie last up to 24 hours; expiry is separate from database cleanup, which the authorized worker performs periodically.
- Login and registration throttle records expire after 15 minutes and are periodically deleted.
- Policy snapshots and acceptance timestamps remain with the account as contract evidence. Legacy acceptances without a complete snapshot require renewed acceptance.
- Account, instance, deployment, job, telemetry, audit, billing, security, and support records are retained while needed to operate the service, resolve disputes or incidents, meet accounting or legal obligations, or enforce the terms. Backups and providers may retain copies under their own schedules.
- Account deletion removes hosted resources through the deletion workflow, removes entitlements, sessions, and idempotency records, and pseudonymizes the account. Billing, policy, audit, legal-hold, job-history, provider-log, backup, and independent hosted-application records may remain when needed for the purposes above.
U.S. state privacy rights
Where applicable law provides these rights, you may request access to or a copy of personal information, correction, deletion, portability, restriction, or an explanation of a denied request. California residents may also request the categories and purposes described here, information about disclosures, and appeal a denied request. Ashore does not sell personal information for money or share it for cross-context behavioral advertising, and does not use it for legal or similarly significant automated decisions. Ashore does not discriminate because someone exercises a privacy right.
Ashore does not currently read, store, or act on Global Privacy Control or similar browser preference signals. Because Ashore does not sell personal information for money or share it for cross-context behavioral advertising, no advertising opt-out is required; the signal would not disable essential authentication, hosting, security, billing, or support processing. Contact privacy if applicable law requires a signal-specific response.
Send requests to the privacy contact below. Ashore may verify identity using account and transaction information and may require an authorized agent to provide proof of authority. Ashore responds within timelines required by applicable law; California requests generally receive an initial response within 45 days, subject to a permitted extension. Appeals are reviewed by the operator and receive a response within the applicable legal period.
Processing locations and transfers
The current deployment and service providers may process information in the United States and in other locations where those providers operate. The exact locations can change with infrastructure configuration. Where applicable law requires transfer safeguards, Ashore Hosting LLC will use the legally required contractual or equivalent safeguards. Contact privacy for the current provider and location list.
Security and incidents
Ashore uses Argon2id password hashing, opaque hashed session tokens, same-origin checks, authorization, encrypted configuration, immutable application images, network controls, and fenced worker cleanup. No system can guarantee complete security. If Ashore confirms a personal-data breach, Ashore Hosting LLC will investigate, contain, preserve evidence, and notify affected people or regulators when required by applicable law. Report suspected unauthorized access promptly through support.
Children
The service is intended for people 18 or older and is not directed to children under 13. Ashore does not knowingly request or retain a child’s account. If a parent or guardian believes a child provided information, contact privacy; the operator will verify the request, restrict access, and delete the information where legally required.
Contact and changes
Use the privacy contact below for access, correction, deletion, portability, appeal, DPA, breach, or children’s-privacy requests. Material changes will be directly communicated or presented for renewed acceptance where required. The effective date and policy version appear above.
Structure adapted from the General Legal privacy-policy-us template, released under CC0. This Ashore notice is service-specific and is not legal advice.