Privacy Policy
Last updated: September 7, 2026
Videan ("we", "the platform") is a hosting platform: you push application code, we run it and serve it at a URL. This policy describes what information we collect to do that, what we do with it, and the choices you have. It is written to be read — if anything here is unclear, ask us at support@videan.xyz.
What we collect
Account information. When you sign up we store your email address, your name if you provide one, and a salted hash of your password (never the password itself). If you sign in with Google, we receive your email address and name from Google and store those; we never see your Google password.
Your applications and their data. The platform stores what you push to it: your application code (as versioned snapshots), the secrets and environment variables you set (encrypted at rest), the contents of any managed database you provision, files you place in object storage, and the logs your applications write. This is the product — hosting it is the entire point — and it is yours: we access it to operate the platform (building, running, backing up, and debugging the service itself), not to mine, sell, or train on it.
Operational data. We record deployment history, request metrics (counts, status codes, latency, bytes transferred), resource usage for metering and billing, and an audit log of account and app actions (who deployed, who invited whom, who changed a setting). Request metrics are aggregated at the edge; we do not log the bodies of requests to your applications.
Billing information. Payments are handled by Stripe. We store your plan, your usage totals, and Stripe's identifiers for your customer record — we never see or store your card number.
Cookies and local storage
_cloud_session— a signed session cookie, scoped to.videan.xyz, set when you sign in. It is what lets you access gated applications without each app implementing its own login. It expires after 12 hours.- The dashboard keeps your API token and selected organization in your browser's local storage so you stay signed in to the console.
That is the full list. We use no advertising cookies, no third-party analytics trackers, and no fingerprinting.
How your applications see visitors
When someone accesses a gated application, the platform injects their identity — user ID, email address, and role — as request headers so the app knows who they are. The app owner therefore sees the email addresses of the people who use their app. If you visit someone else's app on Videan, the app's owner controls what that app does with your identity; this policy covers the platform, and each app's owner is responsible for their app.
Who processes data on our behalf
| Subprocessor | What for |
|---|---|
| Amazon Web Services (us-east-1, United States) | All infrastructure: compute, databases, storage, logs, secrets, email delivery (SES) |
| Stripe | Payment processing and subscription billing |
| Optional "Sign in with Google" authentication |
All data is stored in the United States (AWS us-east-1). We do not sell personal information to anyone, and we do not share it with third parties except the subprocessors above, or where the law requires it.
How long we keep it
- Applications you delete stop serving immediately; their snapshots, database schema, storage and logs are removed from the live system. Application logs are retained for 30 days on a rolling basis.
- Accounts you delete are removed along with their organizations and apps, except records we must keep for billing and legal compliance (invoices, audit entries).
- Backups exist to recover from failure and expire on their own schedule; deleted data can persist in backups for a bounded period before aging out.
Security
Secrets are encrypted with a dedicated key-management service; passwords are hashed with scrypt; all traffic is TLS; each application runs isolated with its own database schema, credentials and secrets scope; access to gated apps is enforced at the edge before a request ever reaches an app. Signing out everywhere invalidates existing sessions platform-wide. No system is perfectly secure — if we learn of a breach affecting your data, we will notify you without undue delay.
Your choices
- Access and export: your code, databases and files are exportable at any time through the platform's own tools, in standard formats.
- Correction: account details can be changed from the dashboard.
- Deletion: you can delete apps and your account from the dashboard, or ask us at support@videan.xyz and we will do it.
- Two-factor authentication is available in account settings.
If you are in a jurisdiction that grants specific data rights (such as the GDPR or CCPA), you can exercise them through the same address.
Children
Videan is not directed at children and we do not knowingly collect information from anyone under 16.
Changes to this policy
When this policy changes materially we will update the date at the top and, for significant changes, notify account holders by email. Continued use of the platform after a change means you accept the updated policy.