Privacy policy

Upstate is operated by Succinct Software LLC, which is responsible for the data described here.

• Account details: your email address, name and time zone, a hashed password, the accounts and members you belong to, and an account billing email.
• From your servers: what the observer sends is listed on What leaves your server: CPU, memory and disk usage; container state and image versions; health results; request counts and timings from kamal-proxy; selected Docker facts and labels; and basic cloud provider identity when available.
• From deploys and apps: deploy metadata your Kamal hooks send (such as the version being shipped), check-in pings, the HTTP checks and domains you add, and, with the upstate-rails gem, counts and timings such as queue depth and slowest actions.
• Production audits: when you run upstate audit for a connected project, the CLI uploads sanitized Kamal configuration, including environment variable names. With --hosts, it can also upload platform and host-security inspection facts after SSH inspection consent (or --yes). Use --local or --no-upload to keep results local. No environment values are included.
• Optional log snapshots: only if you turn them on for the account and for each server. Tails are bounded, redacted before upload and again before storage, encrypted, and deleted after 72 hours. Redaction can’t catch every secret.
• Settings you give us: notification destinations such as Slack, Discord or webhook URLs, and the monthly costs you enter.
• Security records: an audit log of sign-ins, access and billing changes, which may include the IP address and browser user agent of the request.
• Billing: Stripe handles card details; we never see your full card number. We keep the subscription status, plan and Stripe customer reference.

We don’t collect container environment values, database contents, request bodies, job arguments or application files. Application logs stay on your server unless you enable snapshots.

We use cookies only to keep you signed in and protect forms: a session cookie and, when you stay signed in, a remember-me cookie. Your light or dark theme choice is stored in your browser. There are no third-party analytics, advertising or tracking scripts on upstate.cloud.

• to run the service: receipts, the overview, alerts, check-ins and the weekly digest;
• to send the emails and notifications you set up, and account emails such as sign-in links;
• to bill paid plans and enforce plan limits;
• to keep the service secure, investigate problems and answer support requests.

We don’t sell your data or use it for advertising. Coding agents you connect over MCP read your account only with access you approve, and you can revoke it.

We use these providers to run Upstate:

• Stripe — payments, subscriptions, invoices and the billing portal.
• Amazon Web Services (Amazon SES, us-east-1) — sending email such as sign-in links, alerts and digests.
• Cloudflare (R2) — storing encrypted off-site backups of the Upstate database.
• Better Stack — monitoring that backups ran. It receives status pings, not customer data.
• Server hosting — the infrastructure provider that runs Upstate’s production server and database.
• GitHub — distributing the CLI and observer downloads. GitHub sees the requests you make to download them.

When you add a Slack, Discord, email or webhook destination, we send alerts there on your instruction. To check domain expiry we look up your domains in public registration data (RDAP).

We share data with these providers only as needed to operate the service. We don’t sell personal information.

• Your plan sets how far back you can see history: 7 days on Free, 90 days on Solo. The latest production receipt stays available on every plan.
• Some data is deleted on a fixed schedule: log snapshots after 72 hours, per-minute app-health data after 48 hours on Free and 14 days on Solo, and hourly app-health data after 7 days on Free and 90 days on Solo. Server capacity history follows your plan’s history window.
• A downgrade preserves durable deployment receipt evidence, with access subject to the new plan’s history window. Metrics are pruned according to the new plan: for example, hourly app-health and server capacity metrics older than 7 days are deleted after moving to Free. Resubscribing cannot restore pruned metrics. Beyond these, retention varies by data type and operational needs.
• Database backups are kept for up to about three months (7 daily, 4 weekly, 3 monthly), so deleted data can remain in encrypted backups until they age out.
• Security audit records are kept for account security and history. After an account is closed only a minimal record remains.

• To stop paying but keep your data, cancel Solo from Billing. The account moves to Free. Your resources and durable receipt evidence remain; metrics are pruned according to Free’s retention periods.
• To close an account, the account owner chooses Close account in the app and confirms with the account name. The Solo subscription is cancelled straight away and the account closes.
• Closing ends access for everyone in the account and revokes its credentials and coding-agent access. The data is kept for 7 days so we can undo a mistake if you email us, then deleted once Stripe confirms nothing can still be charged. A minimal record of the closure (who, when and the account ID) is kept.
• Closing your last account doesn’t delete your login. To delete your login and data, email support@upstate.cloud.

You can see and change your account details in settings. To ask for a copy of your data, a correction or deletion, email us at the address below.

Your information may be processed in locations where our providers operate.

Data is sent over HTTPS. Observers use their own revocable credentials, log snapshots are encrypted, and backups are encrypted before they leave the server. No system is perfectly secure, and you remain responsible for protecting your own servers and credentials.

Upstate is a tool for developers and isn’t meant for children.

We may update this policy as the product evolves. Changes are reflected by an updated effective date at the top of this page. Privacy questions and requests: support@upstate.cloud.