> For the complete documentation index, see [llms.txt](https://docs.seawise.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.seawise.io/legal/privacy-policy.md). # Privacy Policy **Last Updated:** October 7, 2026 **Effective Date:** October 7, 2026 for new accounts. For existing accounts, November 6, 2026, or earlier if you accept the updated Terms in the app. This Privacy Policy describes how Seawise.io ("Seawise.io", "we", "us", or "our") collects, uses, discloses, and protects your personal information when you use the Seawise.io platform, including the website at seawise.io, the Seawise.io API, the Seawise.io Client software, portals, and all related services (collectively, the "Service"). We are committed to protecting your privacy in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation. *** ## 1. Information We Collect ### 1.1 Account Information When you create an account or sign in, we collect: * **Email address:** Used for sign-in, account recovery, and service communications. * **Sign-in provider details:** If you sign in with Google or GitHub, we receive your email address and basic profile information (such as your name and profile picture) from that provider. * **Preferences:** Settings you choose in the app, such as your theme. We use email sign-in links and Google or GitHub sign-in. We do not collect or store passwords. ### 1.2 Servers, Apps, and Portals When you connect servers, add apps, and create portals, we store: * **Server details:** The server name (which may default to your machine's hostname), online status, last seen time, and Seawise.io Client version. * **App configuration:** Name, nickname, local host and port, subdomain, icon, and health status for each app, as reported by the Seawise.io Client. * **Portals:** Portal name, description, logo, address, the apps it contains, and whether it is public. * **People you add:** The email addresses of people you add to your portals. * **Custom domains:** Domain names you connect, and their verification and certificate status. * **Tunnel credentials:** A cryptographically generated token that authenticates your server's tunnel connection. We store only a hashed form of it. ### 1.3 Session and Access Data When you or people you share with sign in to and open apps and portals, we collect: * **Session tokens:** Cryptographically generated tokens that keep you signed in. We store only hashed forms of them. App sessions expire after 8 hours and custom domain portal sessions after 24 hours. * **IP addresses:** Collected when you sign in, open apps and portals, and use the Service, for security and abuse prevention. * **User agent strings:** Browser and client identifiers, collected for security logging. * **Timestamps:** When sessions are created, last used, and expire. ### 1.4 Usage Data * **Bandwidth usage:** The amount of data transferred through each app per day, and per person who opened it, used to enforce plan limits and show you your usage. We do not record the content of that traffic. * **Request metadata:** For sign-ins, errors, and blocked or rate-limited requests, our systems log the IP address, time, URL path, and response status. We do not log request or response bodies. * **Audit logs:** Records of security-relevant actions (such as sign-ins, server pairing, adding or removing apps, public link changes, portal sign-ins, custom domain changes, and account and billing changes), including timestamps, IP addresses, and user agents. * **Error and performance reports:** When something goes wrong on our website or API, we collect technical details such as the page or endpoint, browser type, and error message. We do not record user sessions. ### 1.5 Billing Information If you subscribe to a paid plan, payment is processed by our third-party payment processor (currently Paddle), who acts as the Merchant of Record. We store: * **Subscription status:** Plan, billing period, trial, and renewal dates. * **Customer and order identifiers:** References to your account with our payment processor (not payment card details). We **do not** collect, store, or have access to your payment card numbers, bank account details, or other financial instruments. All payment processing, tax collection, and billing is handled by our payment processor. ### 1.6 Marketing Preferences If you choose to receive marketing emails, we record your choice and when you made it, so we can honour it and show that you consented. ### 1.7 Information We Do NOT Collect * **Application traffic content:** We do not inspect, store, or analyze the content of traffic flowing through your tunnels. * **Passwords:** We do not use passwords. * **Payment card details:** Handled entirely by our payment processor. * **Location data:** We do not collect GPS or precise location data. * **Device fingerprints:** We do not use browser fingerprinting. * **Advertising trackers:** We do not use advertising or analytics trackers on our website. *** ## 2. How We Use Your Information We use the information we collect for the following purposes: | Purpose | Legal Basis (PIPEDA) | | --------------------------------------------------------------------------- | ----------------------------------------------------------- | | Providing and operating the Service | Necessary for the service you requested | | Signing you in and keeping your sessions secure | Necessary for the service you requested | | Managing your subscription and billing | Necessary for the service you requested | | Enforcing bandwidth limits and plan restrictions | Necessary for the service you requested | | Showing you who used your shared apps and how much | Necessary for the service you requested | | Preventing abuse and ensuring security | Legitimate interest in protecting the Service and its users | | Investigating violations of our Terms of Service and abuse reports | Legitimate interest in enforcing our Terms | | Sending service communications (sign-in, outages, security alerts, billing) | Necessary for the service you requested | | Sending marketing emails and newsletters | Your consent | | Improving the Service | Legitimate interest in improving our product | | Complying with legal obligations | Legal requirement | We **do not** use your information for: * Advertising or ad targeting. * Selling or renting to third parties. * Profiling or automated decision-making. * Marketing emails, unless you have given consent. *** ## 3. How We Share Your Information We do not sell your personal information. We share information only in the following circumstances: ### 3.1 Service Providers We use the following third-party service providers who process data on our behalf: | Provider | Purpose | Data Shared | | ---------------------------- | -------------------------------------------------------- | --------------------------------------------------------------------- | | Supabase | Database and sign-in | Account data, server, app and portal data, session data | | Hetzner | Hosting of our tunnel relays and gateway | Traffic passing through tunnels (not stored), request metadata | | Cloudflare | DNS, CDN, and DDoS protection for seawise.io and our API | IP addresses, request metadata | | Let's Encrypt | TLS certificates for app and custom domain addresses | Domain names | | Paddle | Payment processing and tax (Merchant of Record) | Email, subscription data | | Resend | Email delivery | Email address, email content | | Grafana Labs (Grafana Cloud) | Logs and monitoring | Request metadata, including IP addresses | | Sentry | Error and performance monitoring | Error and request details | | Google, GitHub | Sign-in, if you choose it | Email address, basic profile information | | GitBook | Hosting our documentation site | Standard web request data when you visit the docs | | incident.io | Hosting our status page | Standard web request data, and your email if you subscribe to updates | Service providers may only use your data to provide their services to us. ### 3.2 Portals and Sharing * **People you add to a portal** can see the portal's name, description, and logo, and the apps in it (name, icon, address, and online status). They cannot see your server details or app configuration. * **Owners of portals and apps** can see the email addresses of the people they have added, and how much data each person has used through their apps. * **Public portals and apps** can be seen and opened by anyone with the link. * **Custom domains** become publicly visible in certificate transparency logs when we issue their certificates. No other personal information is shared between users. ### 3.3 Legal Requirements We may disclose your information if required to do so by law, legal process, or government request, or if we believe in good faith that disclosure is necessary to: * Comply with applicable law or legal process. * Protect the rights, property, or safety of Seawise.io, our users, or the public. * Detect, prevent, or address fraud, abuse, security, or technical issues. ### 3.4 Business Transfers If Seawise.io is acquired, merged, or sells substantially all of its assets, your information may be transferred as part of that transaction. We will notify you by email or prominent notice on the Service before your information becomes subject to a different privacy policy. *** ## 4. Data Retention We retain your information for as long as your account is active or as needed to provide the Service. Specifically: | Data Type | Retention Period | | ------------------------------------- | ---------------------------------------------------------- | | Account information and preferences | Until you delete your account | | Server, app, and portal configuration | Until you delete it or your account | | People you add to portals | Until you remove them or delete the portal or your account | | App and portal sessions | Deleted when they expire or are revoked | | One-time sign-in codes | Expire after 30 seconds | | Daily bandwidth totals | 90 days | | Per-person usage of your apps | Until your monthly bandwidth allocation resets | | Audit logs | 90 days | | Request logs (Grafana Cloud) | Up to 30 days | | Error reports (Sentry) | Up to 90 days | | Billing records | As required by Canadian tax law (typically 7 years) | When you delete your account: * Your profile, servers, apps, portals, sessions, and the people you added are deleted. * Your sign-in account is deleted from Supabase. * Billing records may be retained as required by law, with your personal details removed where possible. * Logs that reference your account are kept until they expire under the periods above. *** ## 5. Data Security We implement appropriate technical and organizational measures to protect your information: * **Encryption in transit:** Connections to the Service use TLS. Tunnel connections between the Seawise.io Client and our infrastructure are encrypted. * **Encryption at rest:** Our database provider encrypts stored data at rest. * **Access control:** Database access rules ensure users can only access their own data. Internal systems use least-privilege access. * **Credential security:** Session tokens and tunnel credentials are stored only as hashes, generated with secure randomness, and compared using timing-safe methods. Sessions expire automatically. * **Infrastructure security:** Network policies, rate limiting, and DDoS protection. * **Audit logging:** Security-relevant events are logged for incident investigation. No method of transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. *** ## 6. Your Rights Under PIPEDA and applicable provincial privacy laws, you have the right to: * **Access:** Request a copy of the personal information we hold about you. * **Correction:** Request correction of inaccurate or incomplete personal information. * **Deletion:** Request deletion of your personal information (subject to legal retention requirements). You can delete your account at any time from the settings page in the web app. * **Withdraw consent:** Withdraw consent for processing where consent is the basis, including marketing emails, which you can stop at any time using the unsubscribe link or your settings. Withdrawing consent for essential processing may affect your ability to use the Service. * **Complaint:** File a complaint with the Office of the Privacy Commissioner of Canada if you believe your privacy rights have been violated. To exercise your rights, contact us at . We will respond within 30 days. ### 6.1 European Users (GDPR) If you are located in the European Economic Area, you also have the right to: * **Data portability:** Receive your data in a structured, machine-readable format. * **Restriction:** Request restriction of processing in certain circumstances. * **Object:** Object to processing based on legitimate interests. ### 6.2 California Users (CCPA) If you are a California resident, you have the right to: * Know what personal information is collected and how it is used. * Request deletion of your personal information. * Non-discrimination for exercising your privacy rights. We do not sell or share personal information as defined by the CCPA. *** ## 7. Cookies and Browser Storage ### 7.1 Essential Cookies We only use cookies that are needed for the Service to work: | Cookie | Purpose | Duration | | ----------------------------------- | ------------------------------------------- | ------------------------------------------ | | Supabase sign-in cookies (`sb-...`) | Keep you signed in to seawise.io | Until you sign out or your sign-in expires | | `seawise_session_[subdomain]` | Signs you in to a specific app | 8 hours | | `seawise_portal` | Signs you in to a portal on a custom domain | 24 hours | ### 7.2 Browser Storage Our website stores a few preferences in your browser, such as your theme, whether the sidebar is collapsed, which announcements you have dismissed, and recently loaded data so pages appear faster. This stays on your device and is not used for tracking. ### 7.3 Third-Party Cookies Cloudflare may set security cookies (for example, `__cf_bm`) on seawise.io as part of its bot protection. These are essential security cookies. See Cloudflare's privacy policy for details. We do not use cookies for analytics, advertising, or tracking. Apps you open through Seawise.io may set their own cookies, which are controlled by the app's owner. *** ## 8. International Data Transfers Our servers and database are located in Virginia, United States. Some service providers, such as our monitoring and email providers, may process data in other countries. If you use the Service from outside the United States, your data will be transferred to and processed in these locations. For transfers of personal data from the EEA, we rely on Standard Contractual Clauses (SCCs) or other safeguards offered by our service providers, in accordance with GDPR Article 46. *** ## 9. Children's Privacy The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected information from a child under 18, we will take steps to delete that information. *** ## 10. Consent We obtain your consent for the collection and use of your personal information as follows: * **Express consent:** When you create an account or sign in and accept the Terms of Service, you provide express consent for the collection and use of your information as described in this Privacy Policy. * **Implied consent:** When you use the Service, consent for essential operational data collection (such as session tokens and IP addresses for security) is implied as part of the service you requested. * **Marketing consent:** We only send marketing emails if you opt in. You can withdraw this consent at any time. * **Third-party sign-in:** If you choose to sign in with Google or GitHub, you consent to sharing your sign-in information with those providers as part of the sign-in process. You may withdraw consent at any time by contacting us or by deleting your account. Withdrawing consent may affect your ability to use the Service. *** ## 11. Data Breach Notification In the event of a security breach that poses a real risk of significant harm to affected individuals, we will: * Notify affected users by email as soon as feasible after we determine that a breach has occurred. * Report the breach to the Office of the Privacy Commissioner of Canada as required by PIPEDA. * Keep a record of all breaches, whether or not they meet the threshold for notification. Notification will include the nature of the breach, the types of information involved, steps we are taking to address the breach, and steps you can take to protect yourself. *** ## 12. Changes to This Policy We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the Service at least 30 days before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy. *** ## 13. Contact Us If you have questions about this Privacy Policy or wish to exercise your privacy rights, contact our Privacy Officer at: * **Email:** * **Website:** For complaints, you may also contact the Office of the Privacy Commissioner of Canada at .