Privacy policy

Last updated November 7, 2026

This policy explains what Dawnrose LLC (“Dawnrose”, “we”) collects when you use dawnrose.ai, the Dawnrose dashboard at app.dawnrose.ai, its API, CLI and MCP server (together, the “Service”), and what we do with it.

What we collect

Account details. Your name, email address and password hash. If you sign in with Google or connect GitHub, we receive your name, email address, profile picture and account ID from that provider, and for GitHub an access token so we can list and deploy the repositories you choose.
What you run on Dawnrose. Source code and files you deploy, container images, environment variables (encrypted at rest), domains, volumes, backups, and the build, runtime and request logs and metrics your services produce.
Activity. Actions taken in your workspaces, by you, your team or an AI agent using your tokens, so you can see who changed what.
Waitlist. If you ask to hear when a paid plan opens, we keep your email address and which plan, only to tell you when it opens. Until you open the link in the confirmation email the address is pending, and pending addresses are deleted after 7 days. A confirmed address gets one email when the plan opens, and is then removed. We also delete it whenever you ask.
Billing. Plan, usage and invoices. Payments are handled by Paddle.com, our Merchant of Record and reseller, who collects the card and billing details a payment needs. We never see or store full card numbers.
Technical data. IP addresses, browser type and request logs needed to run and secure the Service. We use a single session cookie to keep you signed in and no advertising or tracking cookies.

How we use it

To provide the Service: build and run your apps, route traffic, issue certificates, send the notifications you set up, and bill usage.
To keep the Service secure and reliable, including preventing abuse and investigating incidents.
To contact you about your account, security, billing and important changes.

We do not sell your personal information, and we do not use your code, data or logs to train AI models.

Google user data

When you sign in with Google we request only your basic profile and email address (the openid, email and profile scopes), and use them only to create and sign in to your Dawnrose account. Dawnrose’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How we check for abuse

To keep the platform safe, we look for signs of abuse using information we hold anyway and what anyone can see on the internet.

Public pages. When you deploy or add a domain, and about once a day, we read the HTML of the public root page of your domains and a few common paths such as /login, as any visitor could, using an ordinary browser’s User-Agent. We don’t load images, video or anything else the page links to. We keep the page title, a hash of the page and which categories it matched, for up to 90 days, not the page.
Names and logs. We compare the names of your images and repositories, and the text of your build logs, to lists of known-bad software. We keep which patterns matched, not the logs’ contents.
Usage. We look at CPU use and how much traffic your services send and serve.
Your account. We record the IP address you signed up from, and your sign-in method.
Reports. People can report what you host. We keep reports and what we did about them.

We don’t read your variable values, your volumes, your databases or the contents of your containers. When we look into a report, a person on our team may view your service’s settings, deployments and logs, and we record each time they do. Your app’s logs hold what your app prints. These checks only flag things for a person to look at, and a person makes any decision. We keep a record of those decisions.

If we restrict your service we’ll tell you why and how to dispute it, unless the law or an investigation stops us. Write to support@dawnrose.ai.

We share data only with service providers that help us run Dawnrose, under agreements that limit their use of it:

Hetzner Online (servers in the United States, where your apps and our database run)
Cloudflare (DNS)
Paddle.com (payments, as our Merchant of Record and reseller)
Google and GitHub (sign-in and repository access, when you choose them)
Our email provider (account and notification emails)
Let’s Encrypt (TLS certificates for your domains, which contain only domain names)

We may also disclose information if the law requires it, or to protect the rights and safety of our users and the Service.

How long we keep it

Metrics are kept for 1, 7 or 30 days and build and deploy logs for 7, 14 or 30 days, depending on your plan. Page checks are kept for up to 90 days, and which log patterns matched for 180 days. The IP address you signed up from is kept as long as your account exists. Your projects and their data are kept until you delete them or your account. When you delete your account, we delete your data within 30 days, except records we must keep for billing, tax or legal reasons.

Your choices and rights

You can view and delete your projects at any time from the dashboard, and disconnect Google or GitHub from Account settings. To access, correct or delete your personal information, or to ask a question about this policy, email support@dawnrose.ai. Depending on where you live, you may have additional rights under laws such as the GDPR or CCPA, and we will honor them.

Security

Traffic is encrypted with TLS, secrets are encrypted at rest, every app runs in its own gVisor sandbox on a private network, and agent tokens are limited to one workspace. No system is perfectly secure; if we learn of a breach that affects your data, we will tell you promptly.

Children

Dawnrose is not intended for anyone under 16, and we do not knowingly collect their information.

Changes

If we change this policy in a way that matters, we will update the date above and, for significant changes, email account owners before the change takes effect.