Privacy Policy

• Account information — name, email address, and authentication data you provide at sign-up.
• Billing information — for paid plans, billing details processed by our payment provider (Stripe). We do not store full card numbers.
• Content you host — websites, databases, files, domains, and email you create or upload (“Your Content”).
• Usage and technical data — logs, IP addresses, request metadata, and diagnostic information used to operate, secure, and support the Service.

• To provide, maintain, secure, and improve the Service.
• To authenticate you and protect against fraud and abuse.
• To communicate about your account, security, and service changes.
• To comply with legal obligations and enforce our Terms and AUP.

We do not sell your personal information, and we do not use it to serve third-party advertising.

Hosted site databases are encrypted at rest (SQLCipher), and archived email in ArmoredPost is encrypted before it is stored in our content-addressed storage. Access to production systems is restricted. This is encryption at rest managed by us to operate the Service; it is not end-to-end or zero-knowledge encryption, and we are technically able to access content where necessary to provide and support the Service. No system is perfectly secure, and you are responsible for the security of the credentials and content within your own sites.

We use a limited set of providers to deliver the Service. Each processes data only as needed for its function:

• Cloud infrastructure / origin hosting — Google Cloud and Linode (compute, storage).
• CDN, DNS, and object storage — Bunny.net (content delivery, DNS, and encrypted backup/archive storage).
• Email backend — Mailbux (mailbox hosting for ArmoredPost).
• Domain registration — CentralNic / Key-Systems GmbH (registrar of record).
• Authentication / database — Supabase (account and auth data).
• Payments — Stripe, for paid plans.

We may update this list as our providers change and will keep this page current.

We share information only with the service providers above, when required by law or valid legal process, to protect rights and safety, or in connection with a merger or acquisition (with notice where required). Domain registration requires sending registrant data to the registry/registrar per ICANN requirements.

We retain account and content data for as long as your account is active. You can delete content or your account at any time from the dashboard. After account deletion we remove Your Content within 30 days, except where longer retention is required by law or for legitimate business records (e.g., billing). Operational logs are retained for up to 90 days. Backups and email archives are purged on their normal rotation, typically within 90 days, unless you request earlier deletion.

Depending on your location, you may have rights to access, correct, export, or delete your personal information, and to object to or restrict certain processing (e.g., under GDPR or CCPA/CPRA). To exercise these, contact privacy@armoredgate.com. We will verify your request and respond within 30 days, or as otherwise required by applicable law.

Our infrastructure is primarily located in the United States. If you access the Service from elsewhere, your information may be transferred to and processed there. Where we transfer personal data of individuals in the EEA or UK, we rely on appropriate safeguards such as the Standard Contractual Clauses.

The Service is not directed to children under 18, and we do not knowingly collect their personal information.

We may update this policy; material changes will be communicated by email or in-dashboard notice. For any privacy question or request, contact privacy@armoredgate.com.