Privacy Policy
wabi is built on privacy. Your secrets are sealed in your browser and opened only inside your own microVM, and we keep as little about you as running the service takes. This policy says what we hold, what we can't read, and who else is involved. [Operator] is responsible for it.
What we can't read
- Environment variables. Your browser seals every value to a key that lives only inside our cluster, and only your own microVM opens it. Our control plane, its database, its backups and our staff tools hold ciphertext only. To show you a value in the dashboard, your browser opens a second copy with a key derived from your wallet's signature; we never see that key.
- Database backups. Daily backups of your Postgres services are encrypted to your own tenant key and open only inside your tenant.
- Keyless accounts. We store no link between your services and the on-chain accounts they use. The keys that control them are derived in your browser and never reach us.
What we hold
| Data | Why | Kept |
|---|---|---|
| Your wallet address | it is your account | until you ask us to delete the account |
| Your email, if you add one | expiry and service notices | until you remove it |
| Projects, services, domains, plan and deployment history | running your services | while the account exists |
| Payment records (amounts, plans, transaction signatures) | billing, accounting, disputes | as long as accounting law requires |
| Logs and metrics your services produce | the logs and metrics views in your dashboard | 7 days |
| GitHub installation and repository names, if you connect GitHub | building your repositories | until you disconnect |
| Reports and abuse records | enforcing the Acceptable Use Policy | as long as needed for that |
After your paid time ends and the 14 days of suspension pass, your paid services' data is deleted, as the Terms describe.
Public by nature
Solana is a public ledger. Your payments to our treasury, your staking position and its locks are visible to anyone, linked to your wallet. We can't change that. Keyless accounts are built so they don't link to your wallet on chain.
Cookies and tracking
The dashboard sets one cookie to keep you signed in, plus a short-lived one during sign-in. We use no advertising, analytics or tracking cookies, and no third-party trackers.
Who else is involved
| Provider | Role |
|---|---|
| OVH | the servers wabi runs on |
| Cloudflare | DNS, the proxy in front of free-tier sites, object storage for uploads and backups |
| A Solana RPC provider | reading the chain and sending transactions |
| An email provider | sending notices, only if you add an email |
| GitHub | access to repositories you connect |
| Google Web Risk | checking the public URLs of free-tier sites against phishing lists |
They process data only to provide their part of the service. We don't sell your data and don't share it for advertising.
Your choices
- Remove your email at any time in the dashboard.
- Ask for a copy of what we hold about you, or for your account to be deleted, by writing to
privacy@wabi.isfrom the email on the account, or with a message signed by your wallet. - Deleting your account ends your services and deletes their data. Payment records we must keep by law stay for that period.
Changes and contact
We announce material changes to this policy in the dashboard, and by email if you added one.
Questions: privacy@wabi.is.