Your email, and your files.

Account data. Your email address, and a password hash held by our authentication provider — the service never sees your password. If you sign in through an assistant, we also store the fact that you granted that client access, so it can be revoked.

Content you publish. The files themselves. Published sites are public by design: anyone with the URL can read them. We ask search engines not to index them, which is not the same as secrecy — do not publish anything here that must stay private.

Publish metadata. For each version: the slug, every file’s path, size, content type and SHA-256, the total byte count, and the timestamps for prepare, finalize and rollback. This is the manifest, and it is what makes verification and rollback possible.

An audit log. Publish, finalize, rollback, delete and suspend events, each recorded with the acting account, the site it concerned and when it happened. Without it, an abuse report cannot be answered accurately.

Ordinary technical logs. Our hosting providers record request metadata — IP address, user agent, path, timestamp, response status — for operating and protecting the service.

• No analytics product, no tag manager, no advertising network, no third-party scripts on these pages at all.
• No tracking cookies. The only cookies set are the session cookies that keep you signed in, and they are removed when you sign out.
• No access to your conversation with an assistant. The assistant calls our tools; it does not send us the chat around them.
• We never sell personal data, and we do not share it with anyone beyond the infrastructure providers below.

To protect people from phishing and malware, the URL of a published site — not its contents, and nothing about you — may be submitted to a public safe-browsing reputation service.

We use all of it to run the service and nothing else: authenticating you, serving your sites, verifying uploads, enforcing quotas and rate limits, answering abuse reports, and fixing the product when it breaks. No profiling, no automated decision-making about you, no marketing use of your address — the only email you receive is transactional.

• Account data: retained while the account exists, and removed when you delete it.
• Published files: retained per version so rollback works. Deleting a site stops it serving immediately; the stored objects are reclaimed by a periodic sweep afterwards, and deleting your account removes them.
• Audit log: retained for twelve months. It is append-only on purpose, so entries are not edited after the fact.
• Provider request logs: retained by each provider on their own schedule, typically days to a few weeks.

You can delete any site from the dashboard, or by asking your assistant to delete it. That takes it off the public internet straight away.

To delete your account and everything attached to it, write to abuse@share-flame-nine.vercel.app from the address on the account. Your sites, their versions and their stored files go with it. We keep a minimal record that a deletion happened, because an audit log that can be erased is not an audit log.

Depending on where you live you may also have the right to access, correct, export, restrict or object to the processing of your personal data. Ask and we will do it — no form, no fee, and no verification theatre beyond confirming you control the account’s email address. Requests are answered within thirty days and usually far sooner.