Privacy
Data we use to provide the service
We store uploaded files, project metadata, private drafts, retained deployments, owner email, hashed session and API tokens, and the feedback or form responses a site owner chooses to collect. Publishing makes your site files available to its visitors.
Google sign-in uses Google to verify your identity. We retain the Google account subject and verified email to associate your login; we do not retain Google access or refresh tokens. Email sign-in uses a one-time link sent through Cloudflare Email Service. We record the policy version and time accepted, plus successful registration and login events. Account sessions use host-only, HTTP-only cookies. User content is served on a separate configured origin. The platform does not place raw HTML, form answers, email addresses, or authentication secrets into product analytics.
Visitor traffic and collection
On DeployHTML's public marketing pages, Google Analytics is optional and loads only after you allow analytics cookies. It measures public page visits and selected publishing-tool actions. We remove query strings and fragments and do not send account details, uploaded content, or form answers. Analytics cookies are limited to the application host and are not shared with hosted customer sites. Use Analytics settings in the footer to decline or exclude this device. Do Not Track and Global Privacy Control disable this collection. Signed-in administrators are excluded where recognized; unidentified anonymous owner visits cannot be reliably identified.
Site traffic reports aggregate page views, coarse countries, device categories, page paths, and referrer hosts. Daily rotating hashes support approximate visitor counts without a persistent visitor tracking cookie. Bot requests are separated where identifiable; estimates are not exact identity or location.
The Free badge links to our landing page through a counted redirect. We store the source project, click and landing timestamps, and a host-only, HTTP-only attribution cookie for up to 30 days. If you create an account during that period, we associate the referral with that new account to measure subsequent publishing. Counts describe requests and attributed accounts, not unique people or verified visible impressions. Known bots and Do Not Track requests are excluded from badge tracking. Raw referral records expire after 30 days; aggregate badge response counts and authentication event records are retained for up to 12 months. Feedback and Pro forms are separate from analytics. Site owners must provide an appropriate purpose and notice, collect only necessary data, and obtain consent where required. Form data is visible only to the owner workspace; respondents are not emailed.
Retention and deletion
Free sites, with their files and traffic data, are deleted when the 24-hour public lifetime ends. Canceled paid hosting has a 7-day paused recovery period after paid-through access ends. Basic keeps 3 versions per site and 90 days of analytics; Pro keeps 10 versions and 12 months of analytics. Deduplicated unreferenced file objects are removed by scheduled cleanup.
Deleting a project stops public serving immediately and removes associated versions, drafts, feedback, responses, and traffic data. Minimal security, billing, and audit records may be retained for operational or legal requirements. Use owner support to request account access, export, correction, or deletion.
Infrastructure and contact
Abuse reports contain the reported site, selected reason, written details and time. Authorized operators use them to investigate and record moderation decisions. Do not submit passwords, illegal media or unnecessary personal information; describe the concern. Reports and review records are limited to 12 months unless a legal obligation requires longer retention. The application is designed for Cloudflare hosting, storage, security checks, and owner email. A separately configured payment provider handles payment details. The platform does not store card numbers.
The operating entity, provider agreements, international transfer arrangements, and jurisdiction-specific privacy information must be completed before commercial public launch. Contact the operator through the owner support route.