Privacy Policy.

Account email. When you sign up, Clerk (our authentication provider) hands us your email address and any identity-provider claims you authorize Clerk to share. That email is the only identity attribute we store in our own database.

Encrypted provider credentials. When you connect Neon, Vercel, Sentry, Resend, Cloudflare, or any other provider, we receive either an OAuth refresh token or a pasted API key. Each credential is encrypted with pgcrypto using a server-side key that never leaves our environment, then written to Postgres as ciphertext. The plaintext never lands in a table column, a log line, an API response, or an admin tool.

Stack metadata. The names you give your stacks, the regions you pick, which providers each stack uses, the status of provisioning sagas, and the 8-character master-key prefix (e.g. ss_4f9c) that lets you identify a key in the UI.

Audit events. Every credential resolution, key derivation, environment promotion, revocation, and member action is appended to an immutable audit log. Each row records the acting user, IP, user agent, workspace scope, event type, and structured event metadata. This is the ledger your security team would ask us for under SOC 2.

Provider credentials are used for exactly two things: provisioning(calling the provider's API on your behalf to create the resources you instructed us to create) and audit (recording that the call happened, who triggered it, and against which stack). They are not used for analytics, not used for training models, not used for support tooling, not used for anything else.

Your account email is used to identify you across sessions, to bind workspace membership, and to send the rare operational email (security advisories, billing receipts, scheduled maintenance). We don't add you to a marketing list.

Audit events are used for security forensics, billing reconciliation, and the audit-log surface available on your dashboard.

Your application's data. That lives on your Neon, your Supabase, your Cloudflare R2. Stack start provisions resources on your provider accounts and then steps out of the data plane entirely. We have no read-back path into the providers we set up for you.

Resolved environment-variable values, when you opt into HPKE encryption on the resolve endpoint. The ciphertext is encrypted to your client's ephemeral keypair before it leaves our process, and we have no key material capable of decrypting it.

Cross-page session tracking.We aggregate product telemetry at the counter level (how many stacks exist, median provision latency) but don't follow individual sessions around the marketing site.

Our primary Postgres database runs on Neon, in the US-East region (AWS us-east-2). Backups stay in the same region. If you access stack start from outside the United States, your information is transferred to and stored in the US — by using the service you consent to that transfer. Standard contractual clauses are available for European customers on request to security@stackstart.co.

At rest: every stored credential, OAuth refresh token, and master-key hash is encrypted with pgcrypto inside Postgres. The encryption key is held in our server environment and rotated on a defined schedule; no engineer queries the database with a plaintext-revealing path.

In flight: TLS for every connection. The resolve endpoint optionally upgrades to HPKE (Hybrid Public Key Encryption, RFC 9180) so the env-var bundle is encrypted to a client-supplied ephemeral keypair end-to-end — we serve the ciphertext but cannot read it.

Master keys are stored only as bcrypt hashes. The raw key is displayed exactly once at generation; after that, only the 8-character prefix is ever visible in the UI or in audit rows.

Audit events: 90 days on every paid plan. Older events are archived and read-back is available on request; on Free tier, audit events are retained for 30 days.

Stack data is retained for the life of your workspace. When you delete a stack, the encrypted credentials, stack metadata, and associated audit rows are removed from the primary database. Encrypted backups roll off on a 30-day cycle; deletion requests are honored across primary and backup storage within 60 days.

Account deletion removes every workspace you sole-own (which cascades to every stack, credential, key, and audit row anchored to those workspaces), removes your membership from co-owned workspaces, tombstones any audit attribution you authored, and deletes your Clerk identity. Encrypted backups storing the deleted ciphertext roll off within 30 days.

We rely on a small number of subprocessors. Each operates under standard data-processing terms:

• ↳Clerk (US) — authentication. Receives your email and identity-provider claims when you sign in.
• ↳Neon (US, AWS) — our Postgres database host. Holds the encrypted-at-rest ciphertext for credentials and the audit ledger.
• ↳Render (US, Oregon) — application hosting. Runs the stack start web service and processes every request in transit.
• ↳Stripe (US) — payment processor. Receives workspace ID metadata, billing email, and payment instruments at checkout. We never see card data — Stripe Checkout owns that surface.
• ↳Inngest (US) — background job orchestration. Step payloads are HMAC-signed; payloads never include credential bytes or PII per our internal policy.
• ↳Anthropic (US) — powers the in-app helper. Receives the conversation you have with the helper and redacted stack context; never receives plaintext provider credentials.
• ↳OpenRouter (US) — optional LLM gateway for the assistant when enabled. Same data envelope as Anthropic; receives only conversation context.

The providers you connect through stack start (Vercel, Sentry, Resend, Supabase, etc.) are not our subprocessors — those are direct relationships between you and the provider, governed by their own terms.

Export. Account data and the audit log can be exported as CSV/JSON from the dashboard at any time. For machine-readable bulk export, email security@stackstart.co.

Delete. Workspace deletion is available from settings. Full account deletion (GDPR Art. 17 / CCPA erasure included) runs programmatically: signed-in users step up via reverification, then POST /api/account/delete cascades workspaces you sole-own, removes you from co-owned workspaces, tombstones any audit attribution you authored (rewriting the user-id portion to a stable hash so trail integrity stays intact while the PII is gone), and deletes your Clerk identity. Backups roll off within 30 days. For an email-driven request, write to security@stackstart.co.

Correction.Update your account information via Clerk's account portal.

Portability. Credential bundles can be resolved through the resolve endpoint at any time; audit logs export via CSV.

Stack start is not intended for users under 13, and we do not knowingly collect data from children under 13.

When we change this policy materially, we email every workspace owner with the diff at least 30 days before the new version takes effect. Non-material clarifications can be applied with the "Last updated" date refreshed at the top of this page.

Privacy questions, data-subject requests, or anything else that touches your data: security@stackstart.co. General inquiries: hello@stackstart.co.