Privacy Policy
This policy explains what personal data Froog LLC ("froog", "we") collects when you use froog.tech, api.froog.tech and the froog CLI, and what we do with it. We collect as little as we can: no tracking, no analytics, no advertising, and no cookies beyond the ones needed to keep you signed in.
What we collect
| Data | Why |
|---|---|
| Your email address | To identify your account, send invites and invoices, and contact you about the Service. |
| API keys, stored only as a SHA-256 hash | To authenticate your requests. We can't recover a key from its hash. |
| SSH public keys you add | To let you log in to your sandboxes. |
| Environment variables and secret files you set (for example AI API keys), encrypted (XChaCha20-Poly1305) | To put them into your sandboxes when they start. They're also part of each sandbox's boot settings on our servers. |
| Sandbox and snapshot records: names, sizes, states, IP addresses, timestamps | To run the Service and show you your sandboxes. |
Command history: the commands you run through the API (froog exec, froog prompt, background jobs), their exit codes and their output, up to 8 MiB per output stream per command and 512 MiB (compressed) per account. Not kept for sandboxes with monitoring off. | To show you your command history and logs, also while a sandbox is stopped. |
| The busiest processes of a sandbox, sampled when it stops (not with monitoring off) | To answer froog processes for a stopped sandbox. |
| Audit log: changes to your account (API keys, sandboxes, environment, webhooks, billing, data controls), the API key or dashboard session that made each one, the IP address it came from, and the request ID | To show you who changed what (GET /v1/audit) and to investigate abuse. |
| Address log: the public addresses each sandbox had (its host's IPv4 address and SSH port, and its own IPv6 address), with when it had them | To answer abuse reports about traffic from our addresses. |
| Abuse check results: when an automated check finds what looks like a crypto miner, port scanning or a traffic flood, which check it was and what showed it (for example a process's command line, a port, or a connection count) | To stop abuse that would get our shared addresses blocked, and to review it. |
| Usage records: when each sandbox started and stopped | To bill you. |
| Your Stripe customer ID, whether a card is on file, your invoices, and your wallet payments (amount, status, Stripe payment ID) | To charge you. Card details are entered on Stripe's page and stored by Stripe; we never see or store card numbers. |
| An email and optional note, if you request an invite | To send you an invite. |
Your sandboxes' contents. Files and data inside your sandboxes and snapshots are stored on our hosting provider's servers. We don't inspect them except to investigate abuse, comply with the law, or when you ask us to help. Commands you run with froog exec or froog prompt, and their output, are kept in your command history (above) unless the sandbox has monitoring off. Each sandbox has its own public IPv6 address that anyone on the internet can connect to; its IPv4 address is its host's, shared with other sandboxes.
Abuse checks. Every few minutes, froog checks each running sandbox for abuse: it lists the busiest processes (with their command lines) and counts the sandbox's network connections, and its host counts the sandbox's CPU use, traffic and connections. These checks run also on sandboxes with monitoring off (monitoring off only stops froog keeping history and samples). Nothing they read is kept unless a check finds something; then we keep the result (above) and may stop the sandbox.
What we don't collect. The website uses no analytics, advertising or third-party scripts. The only cookies are functional: signing in to the dashboard sets a session cookie, and opening a private preview URL sets a cookie for that URL's address so the link keeps working. Fonts are served from froog.tech. Our web server and API don't keep access logs. The API stores an IP address only in the audit log entry for a change made to an account, and counts requests per IP address in memory for a minute to enforce rate limits. Our server's operational logs record errors and account, sandbox and server IDs.
Legal basis
Where the GDPR or similar laws apply, we process account, sandbox and usage data to perform our contract with you, and keep billing records to meet legal obligations. We process invite requests and security-related data (the audit log, the address log, abuse check results, and data we look at to investigate abuse) based on our legitimate interest in running a safe service.
Where it's stored and who processes it
| Provider | What for | Location |
|---|---|---|
| Hetzner Online GmbH | Hosts our servers, our database and its encrypted backups, and your sandboxes and snapshots | Germany (Falkenstein, Nuremberg) or Finland (Helsinki) |
| GitHub, Inc. | Serves CLI downloads to the installer, which sees your IP address | USA |
| Stripe, Inc. | Payments: stores your card, charges invoices, emails receipts | USA |
| Cloudflare, Inc. | DNS for froog.tech and froogusercontent.com, and forwarding email to @froog.tech addresses | Global |
| Resend, Inc. | Sends our emails to you (warnings about your sandboxes, wallet and trial, and a welcome): your email address and the email's content | USA |
| Discord Inc. | Our team's own notifications: your email address and sandbox names when you sign up, change your plan, or start, stop or delete a sandbox | USA |
We don't sell your data or share it with anyone else, except when required by law. If we add a provider, we'll update this list first.
How long we keep it
- Running sandboxes and saved snapshots: until you delete them, or until 30 days after your account closes. A stopped sandbox's disk: 14 days after it stops. Deleting a sandbox deletes its server and snapshots right away.
- Account data and SSH keys: while your account is open, then deleted within 30 days of closing it.
- Command history and output: 90 days, and at most 512 MiB per account (the oldest goes first). Deleted with the sandbox or the account. Process samples: 7 days.
- Audit log: 90 days, also after your account closes.
- Address log: 13 months after a sandbox gave up the address, also after your account closes (your email is erased then; the log keeps account and sandbox IDs).
- Abuse check results: 13 months, also after your account closes.
- Usage and billing records, including invoices at Stripe: as long as tax and accounting law requires.
- Database backups: hourly copies on our server for 14 days, and encrypted off-site copies for up to 12 months (hourly ones for 2 days, daily ones for 30 days, then one a month). Data you delete stays in these backups until they age out.
Security
Traffic to froog.tech and api.froog.tech is encrypted with TLS. API keys are stored as hashes; environment variables, secret files and sandboxes' SSH keys are encrypted. Sandboxes accept SSH logins only with your keys, and the CLI verifies each sandbox's pinned host key. Each sandbox is its own virtual machine with its own kernel.
Your rights
You can ask us to access, correct, export or delete your personal data, or object to or restrict how we use it, by emailing hello@froog.tech. We'll answer within 30 days. If you're in the EU or UK, you can also complain to your data protection authority.
Changes
We'll post changes here and update the date at the top. For material changes we'll email you before they take effect.
Contact
The data controller is Froog LLC, 1500 N Grant St #12477, Denver, CO 80203, USA. Email hello@froog.tech.